---
title: "Submit the OTP and obtain the Compliance CSID"
method: POST
path: "/apps/gov-sa/v1/entry/{silo_entry_id}/otp"
---

# Submit the OTP and obtain the Compliance CSID

`POST /apps/gov-sa/v1/entry/{silo_entry_id}/otp`

## Request

- Base URL: `https://api.invopop.com`
- URL: `https://api.invopop.com/apps/gov-sa/v1/entry/{silo_entry_id}/otp`
- Auth: none required
- TypeScript: <https://skmtc.dev/invopop/apis/access-service-api/docs/apps/gov-sa/v1/entry/:silo_entry_id/otp/post.ts> (a function with typed inputs; its response is checked against the schema)

Submit the One Time Password (OTP) generated in the ZATCA Fatoora portal.

## Path parameters

- `silo_entry_id` string, required

## Request body

- OTPSubmit
  - `name` string, required: Legal name of the supplier as registered with ZATCA.
  - `invoice_type` '1000' | '0100' | '1100', required: Which invoice transactions the CSID is requested for, encoded as ZATCA's 4-digit functionality map. - `1000` — standard tax invoices only. - `0100` — simplified invoices only. - `1100` — both standard and simplified invoices.
  - `branch_name` string, required: Name of the branch or organizational unit the certificate is issued for. In case of VAT Groups, this field should contain the 10-digit TIN number of the individual group member.
  - `registered_address` string, required: Registered address of the supplier as recorded with ZATCA.
  - `business_category` string, required: Business category or industry of the supplier.
  - `otp` string, required: 6-digit One-Time Password generated in the ZATCA Fatoora portal for the registering device. Valid only for a short period.

## Response `204`

OTP accepted, Compliance CSID obtained and credentials stored.

## Other responses

- `400`: The request is malformed or missing required parameters.
- `401`: Missing or invalid authentication token.
- `403`: The authenticated enrollment is not allowed to access this silo entry.
- `404`: The referenced silo entry or its party registration could not be found. The party must be registered before submitting the OTP.
- `422`: The request was well-formed but failed business validation — e.g. the uploaded file is not a valid PDF.
- `500`: An unexpected server-side error occurred.

---

[API](https://skmtc.dev/invopop/apis/access-service-api.md) - [All operations](https://skmtc.dev/invopop/apis/access-service-api/llms.txt) - [OpenAPI document](https://skmtc.dev/invopop/apis/access-service-api/revisions/fc954f96ea62?raw)