---
title: "Download a signed report of a retained result"
method: POST
path: "/v2/einvoices/reports"
tags: ["reports"]
---

# Download a signed report of a retained result

`POST /v2/einvoices/reports`

## Request

- Base URL: `https://api.ironfang.com/finance`
- URL: `https://api.ironfang.com/finance/v2/einvoices/reports`
- Auth: HTTP bearer

A ZIP binding the exact retained result, its complete findings and
the facts it records to an Ed25519 signature by Ironfang Finance.
The report is in its result's version. A V2 validation, XML or
hybrid PDF, gets the V2 manifest
(`ironfang/finance/einvoice/report-manifest/v2`): the input and, for
a PDF, its embedded XML by hash; the ruleset release with its
family, variant, syntax, scope and manifest checksum (see the
ruleset's `manifest_sha256`); for
a hybrid release the PDF engine, PDF/A profiles and binding table it
pins; both engines by image digest; every check group and layer;
what was not checked; and the release's rule artefacts by hash. A
result made through V1 gets exactly the bundle
`POST /finance/v1/einvoices/reports` issues, V1 manifest and all.

The ZIP holds `manifest.json` (canonical), `signature.json`,
`result.json` (the retained bytes), `findings.json` and a readable
`report.html` derived from the manifest; with RFC 3161 timestamps
configured, `timestamp.tsq` and `timestamp.tsr` too. V2 reports
sign under their own domain and envelope schema, so a V1 signature
can never be read as V2 or the reverse. Both are signed by the keys
at `GET /finance/v1/einvoices/reports/keys`.

Send `operation_id` (and, for a V1 generation only, `include_pdf`)
in a JSON body of at most 1024 bytes. A V2 result has no readable
PDF: `include_pdf` on one is `503 report_unavailable`. Truncated
findings are `422 report_incomplete`. Nothing is validated or
charged again and nothing is stored; issuance time and signature may
differ between downloads of one result, its facts never do. Expiry
and deletion are checked again before the bundle is released.
A signature does not certify compliance.

## Request body

- ReportRequest
  - `include_pdf` boolean: A readable PDF of a retained V1 generation. A V2 result has none.
  - `operation_id` string, required

## Response `200`

The signed report ZIP as an attachment. Cache-Control is no-store.

## Other responses

- `400`: The request is malformed.
- `401`: The credential is missing or not accepted.
- `403`: The key lacks the scope this operation needs.
- `404`: No such release or result is visible.
- `410`: The result expired or was erased. Its operation record remains.
- `415`: The media type, encoding or content is not accepted.
- `422`: The retained findings are truncated; no complete signed report can be issued.
- `429`: Too many requests.
- `500`: Ironfang Finance failed. Not a verdict on anything.
- `503`: Signed reports are not configured, or a readable PDF was asked for a result that has none. The result is unchanged.

---

[API](https://skmtc.dev/ironfang/apis/ironfang-finance-e-invoicing-api-2.md) · [All operations](https://skmtc.dev/ironfang/apis/ironfang-finance-e-invoicing-api-2/llms.txt) · [OpenAPI document](https://skmtc.dev/ironfang/apis/ironfang-finance-e-invoicing-api-2/revisions/8140667e556b?raw)