Audit files
The files a company hands its auditors, for one fiscal year: the FEC (fichier des écritures comptables) in France, the GoBD data carrier (Datenträgerüberlassung, CSV with index.xml) in Germany, the OECD SAF-T 2.0 XML elsewhere, and the audit evidence pack (AICPA Audit Data Standards) everywhere.
| Operation | Summary | Scope | Idempotency-Key |
|---|---|---|---|
GET /v1/entities/{entity}/audit-files |
What the audit file of a year covers | read |
|
GET /v1/entities/{entity}/audit-files/evidence |
Download the audit evidence pack | read |
|
GET /v1/entities/{entity}/audit-files/fec |
Download the FEC (France) | read |
|
GET /v1/entities/{entity}/audit-files/gobd |
Download the GoBD audit file (Germany) | read |
|
GET /v1/entities/{entity}/audit-files/saft |
Download the SAF-T file (outside France and Germany) | read |
GET /v1/entities/{entity}/audit-files
What the audit file of a year covers
The audit file formats that fit the entity's country (its tax audit file first: fec in
France, gobd in Germany, saft elsewhere; then evidence, the audit evidence pack, in
every country), the dates the files of the fiscal year (or of the periods asked for) cover,
whether the year is closed, which covered periods are still open, how many posted entries
they hold, and each file's name (file_names); missing says what stops a file (siren).
Answers 422 fiscal_year_missing for a year the entity does not have, audit_period_range
for periods outside it, and 409 audit_periods_open for a part of a year with open
periods.
| Required scope | read (admin implies every scope) |
| Operation id | audit_file_overview_v1_entities__entity__audit_files_get |
Parameters
| In | Name | Type | Required | Description |
|---|---|---|---|---|
| path | entity |
string | yes | Entity code, e.g. CH01 (GET /v1/entities). |
| query | fiscal_year |
integer | yes | The fiscal year, e.g. 2026. |
| query | from_period |
integer or null | First period of a part of the year (closed periods only); default: the first. | |
| query | to_period |
integer or null | Last period of a part of the year (closed periods only); default: the last. |
Example request
curl "$ERP_URL/v1/entities/CH01/audit-files?fiscal_year=2026" \
-H "Authorization: Bearer $ERP_KEY"
Responses
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | AuditFileOut |
| 401 | Missing or invalid API key (unauthorized). |
ErrorEnvelope |
| 403 | The caller lacks the required scope (missing_right, with scope), the key belongs to no person where a person is needed (forbidden), or the approval policy denies the action (policy_denied, with action and rule_id). |
ErrorEnvelope |
| 404 | The resource does not exist, or belongs to another organization (not_found). |
ErrorEnvelope |
| 422 | Validation failed: the error envelope (validation_failed). For a malformed body or parameter its message is in sentences ("Line 2: the quantity must be above zero") and fields lists each error with pydantic's loc, type and msg beside its sentence (message) and its parts, to word it in another language: items (name and number from 1: line 2), field (its name as sent) and the rule it breaks with its limit, count and choices (none for a validator's own sentence); FastAPI's own detail list stays beside the envelope. |
HTTPValidationError |
Example response (shape)
{
"entity": "string",
"country": "string",
"formats": [
"evidence"
],
"fiscal_year": 1,
"from_period": 1,
"to_period": 1,
"start": "2026-09-21",
"end": "2026-09-21",
"closing_date": "2026-09-21",
"year_closed": true,
"open_periods": [
1
],
"entries": 1,
"file_name": "string",
"file_names": {
"evidence": "Audit_Evidence_CH01_2026.zip",
"saft": "SAF-T_CH01_2026.xml"
},
"missing": [
"siren"
]
}
GET /v1/entities/{entity}/audit-files/evidence
Download the audit evidence pack
What an external auditor pulls from the books of an entity's fiscal year, in any
country: a ZIP laid out after the AICPA Audit Data Standards (|-delimited UTF-8 text with
a header row, . as decimal separator, ISO dates) holding the journal lines with who
entered, approved and posted each entry, a trial balance that ties to them, the chart of
accounts, the company, the organization's users and their rights, sign-ins and security
events, the audit trail, the master data changes, the four-eyes approvals, the period
closes, the receivables and payables with what is open at the end, the deals won with their
invoices, the hash chain's verification, and a README describing every file and column
(Audit_Evidence_<entity>_<year>.zip). Recorded in the audit trail.
| Required scope | read (admin implies every scope) |
| Operation id | evidence_file_v1_entities__entity__audit_files_evidence_get |
Parameters
| In | Name | Type | Required | Description |
|---|---|---|---|---|
| path | entity |
string | yes | Entity code, e.g. CH01 (GET /v1/entities). |
| query | fiscal_year |
integer | yes | The fiscal year, e.g. 2026. |
| query | from_period |
integer or null | First period of a part of the year (closed periods only); default: the first. | |
| query | to_period |
integer or null | Last period of a part of the year (closed periods only); default: the last. |
Example request
curl "$ERP_URL/v1/entities/CH01/audit-files/evidence?fiscal_year=2026" \
-H "Authorization: Bearer $ERP_KEY"
Responses
| Status | Meaning | Body |
|---|---|---|
| 200 | A ZIP with pipe-delimited tables and README.txt. | application/zip |
| 401 | Missing or invalid API key (unauthorized). |
ErrorEnvelope |
| 403 | The caller lacks the required scope (missing_right, with scope), the key belongs to no person where a person is needed (forbidden), or the approval policy denies the action (policy_denied, with action and rule_id). |
ErrorEnvelope |
| 404 | The resource does not exist, or belongs to another organization (not_found). |
ErrorEnvelope |
| 422 | Validation failed: the error envelope (validation_failed). For a malformed body or parameter its message is in sentences ("Line 2: the quantity must be above zero") and fields lists each error with pydantic's loc, type and msg beside its sentence (message) and its parts, to word it in another language: items (name and number from 1: line 2), field (its name as sent) and the rule it breaks with its limit, count and choices (none for a validator's own sentence); FastAPI's own detail list stays beside the envelope. |
HTTPValidationError |
GET /v1/entities/{entity}/audit-files/fec
Download the FEC (France)
The fichier des écritures comptables (LPF art. L47 A, A47 A-1) of a French entity's
fiscal year: the 18 fields, one record per line of every posted entry, the opening balances
first, tab-separated, <SIREN>FEC<closing date>.txt. Recorded in the audit trail. Answers
422 audit_file_country for an entity outside France and siren_missing when its French
VAT number (where the SIREN is taken from) is missing.
| Required scope | read (admin implies every scope) |
| Operation id | fec_file_v1_entities__entity__audit_files_fec_get |
Parameters
| In | Name | Type | Required | Description |
|---|---|---|---|---|
| path | entity |
string | yes | Entity code, e.g. CH01 (GET /v1/entities). |
| query | fiscal_year |
integer | yes | The fiscal year, e.g. 2026. |
| query | from_period |
integer or null | First period of a part of the year (closed periods only); default: the first. | |
| query | to_period |
integer or null | Last period of a part of the year (closed periods only); default: the last. |
Example request
curl "$ERP_URL/v1/entities/CH01/audit-files/fec?fiscal_year=2026" \
-H "Authorization: Bearer $ERP_KEY"
Responses
| Status | Meaning | Body |
|---|---|---|
| 200 | The FEC as tab-separated text in ISO-8859-15. | text/plain |
| 401 | Missing or invalid API key (unauthorized). |
ErrorEnvelope |
| 403 | The caller lacks the required scope (missing_right, with scope), the key belongs to no person where a person is needed (forbidden), or the approval policy denies the action (policy_denied, with action and rule_id). |
ErrorEnvelope |
| 404 | The resource does not exist, or belongs to another organization (not_found). |
ErrorEnvelope |
| 422 | Validation failed: the error envelope (validation_failed). For a malformed body or parameter its message is in sentences ("Line 2: the quantity must be above zero") and fields lists each error with pydantic's loc, type and msg beside its sentence (message) and its parts, to word it in another language: items (name and number from 1: line 2), field (its name as sent) and the rule it breaks with its limit, count and choices (none for a validator's own sentence); FastAPI's own detail list stays beside the envelope. |
HTTPValidationError |
GET /v1/entities/{entity}/audit-files/gobd
Download the GoBD audit file (Germany)
The data carrier for the German tax audit (AO § 147 para. 6, Z3 access) of a German
entity's fiscal year: a ZIP with the chart of accounts and its balances, the journal of the
posted entries, customers, vendors, the tax codes used and the open items at the end, as
CSV, described by index.xml (Beschreibungsstandard 1.6) with its DTD. Recorded in the
audit trail. Answers 422 audit_file_country for an entity outside Germany.
| Required scope | read (admin implies every scope) |
| Operation id | gobd_file_v1_entities__entity__audit_files_gobd_get |
Parameters
| In | Name | Type | Required | Description |
|---|---|---|---|---|
| path | entity |
string | yes | Entity code, e.g. CH01 (GET /v1/entities). |
| query | fiscal_year |
integer | yes | The fiscal year, e.g. 2026. |
| query | from_period |
integer or null | First period of a part of the year (closed periods only); default: the first. | |
| query | to_period |
integer or null | Last period of a part of the year (closed periods only); default: the last. |
Example request
curl "$ERP_URL/v1/entities/CH01/audit-files/gobd?fiscal_year=2026" \
-H "Authorization: Bearer $ERP_KEY"
Responses
| Status | Meaning | Body |
|---|---|---|
| 200 | A ZIP with the CSV tables, index.xml and its DTD. | application/zip |
| 401 | Missing or invalid API key (unauthorized). |
ErrorEnvelope |
| 403 | The caller lacks the required scope (missing_right, with scope), the key belongs to no person where a person is needed (forbidden), or the approval policy denies the action (policy_denied, with action and rule_id). |
ErrorEnvelope |
| 404 | The resource does not exist, or belongs to another organization (not_found). |
ErrorEnvelope |
| 422 | Validation failed: the error envelope (validation_failed). For a malformed body or parameter its message is in sentences ("Line 2: the quantity must be above zero") and fields lists each error with pydantic's loc, type and msg beside its sentence (message) and its parts, to word it in another language: items (name and number from 1: line 2), field (its name as sent) and the rule it breaks with its limit, count and choices (none for a validator's own sentence); FastAPI's own detail list stays beside the envelope. |
HTTPValidationError |
GET /v1/entities/{entity}/audit-files/saft
Download the SAF-T file (outside France and Germany)
The OECD Standard Audit File for Tax (version 2.0) of the fiscal year of an entity
outside France and Germany, as XML (UTF-8, SAF-T_<entity>_<year>.xml): the header (company,
VAT number, address, currency, the periods selected), the general ledger accounts with
their opening and closing balances, customers and suppliers with their balances, the tax
codes used, and every line of every posted entry by journal, with its document, customer or
supplier, foreign currency amount and tax; the totals balance. Recorded in the audit trail.
Answers 422 audit_file_country for an entity in France or Germany (they get the FEC or
the GoBD file).
| Required scope | read (admin implies every scope) |
| Operation id | saft_file_v1_entities__entity__audit_files_saft_get |
Parameters
| In | Name | Type | Required | Description |
|---|---|---|---|---|
| path | entity |
string | yes | Entity code, e.g. CH01 (GET /v1/entities). |
| query | fiscal_year |
integer | yes | The fiscal year, e.g. 2026. |
| query | from_period |
integer or null | First period of a part of the year (closed periods only); default: the first. | |
| query | to_period |
integer or null | Last period of a part of the year (closed periods only); default: the last. |
Example request
curl "$ERP_URL/v1/entities/CH01/audit-files/saft?fiscal_year=2026" \
-H "Authorization: Bearer $ERP_KEY"
Responses
| Status | Meaning | Body |
|---|---|---|
| 200 | The OECD SAF-T 2.0 XML in UTF-8. | application/xml |
| 401 | Missing or invalid API key (unauthorized). |
ErrorEnvelope |
| 403 | The caller lacks the required scope (missing_right, with scope), the key belongs to no person where a person is needed (forbidden), or the approval policy denies the action (policy_denied, with action and rule_id). |
ErrorEnvelope |
| 404 | The resource does not exist, or belongs to another organization (not_found). |
ErrorEnvelope |
| 422 | Validation failed: the error envelope (validation_failed). For a malformed body or parameter its message is in sentences ("Line 2: the quantity must be above zero") and fields lists each error with pydantic's loc, type and msg beside its sentence (message) and its parts, to word it in another language: items (name and number from 1: line 2), field (its name as sent) and the rule it breaks with its limit, count and choices (none for a validator's own sentence); FastAPI's own detail list stays beside the envelope. |
HTTPValidationError |
Schemas
AuditFileOut
What an audit file of an entity's fiscal year (or of a range of its periods) would cover.
| Field | Type | Required | Description |
|---|---|---|---|
entity |
string | yes | Entity code. |
country |
string | yes | Entity country (ISO 3166-1 alpha-2). |
formats |
array of "evidence" | "fec" | "gobd" | "saft" |
yes | The formats that fit the entity's country, its tax audit file first: fec for France, gobd for Germany, saft (OECD SAF-T 2.0) elsewhere; then evidence (the audit evidence pack), for every country. |
fiscal_year |
integer | yes | The fiscal year. |
from_period |
integer | yes | The first period covered. |
to_period |
integer | yes | The last period covered. |
start |
string (date) | yes | First day covered. |
end |
string (date) | yes | Last day covered. |
closing_date |
string (date) | yes | The last day of the fiscal year: the date in the FEC's file name. |
year_closed |
boolean | yes | True when the fiscal year's close is approved. The files can be made before; they then cover what is posted so far, which can still change. |
open_periods |
array of integer | yes | The numbers of the covered periods that are still open (posting into them is still possible). |
entries |
integer | yes | Posted journal entries in the range. |
file_name |
string or null | yes | The name the tax audit file (the first of formats) will have; null when it cannot be made (missing). file_names has the name of each format. |
file_names |
map of string | yes | The name each format's file will have, by format; a format whose file cannot be made (missing) is left out. |
missing |
array of "siren" |
yes | What stops the file: siren (an FEC is named after the company's SIREN, taken from its French VAT number, and the entity has none); empty when it can be made. |