StabisoDocs

API reference

Audit files

The files a company hands its auditors, for one fiscal year: the FEC (fichier des écritures comptables) in France, the GoBD data carrier (Datenträgerüberlassung, CSV with index.xml) in Germany, the OECD SAF-T 2.0 XML elsewhere, and the audit evidence pack (AICPA Audit Data Standards) everywhere.

Operation Summary Scope Idempotency-Key
GET /v1/entities/{entity}/audit-files What the audit file of a year covers read
GET /v1/entities/{entity}/audit-files/evidence Download the audit evidence pack read
GET /v1/entities/{entity}/audit-files/fec Download the FEC (France) read
GET /v1/entities/{entity}/audit-files/gobd Download the GoBD audit file (Germany) read
GET /v1/entities/{entity}/audit-files/saft Download the SAF-T file (outside France and Germany) read

GET /v1/entities/{entity}/audit-files

What the audit file of a year covers

The audit file formats that fit the entity's country (its tax audit file first: fec in France, gobd in Germany, saft elsewhere; then evidence, the audit evidence pack, in every country), the dates the files of the fiscal year (or of the periods asked for) cover, whether the year is closed, which covered periods are still open, how many posted entries they hold, and each file's name (file_names); missing says what stops a file (siren). Answers 422 fiscal_year_missing for a year the entity does not have, audit_period_range for periods outside it, and 409 audit_periods_open for a part of a year with open periods.

Required scope read (admin implies every scope)
Operation id audit_file_overview_v1_entities__entity__audit_files_get

Parameters

In Name Type Required Description
path entity string yes Entity code, e.g. CH01 (GET /v1/entities).
query fiscal_year integer yes The fiscal year, e.g. 2026.
query from_period integer or null First period of a part of the year (closed periods only); default: the first.
query to_period integer or null Last period of a part of the year (closed periods only); default: the last.

Example request

curl "$ERP_URL/v1/entities/CH01/audit-files?fiscal_year=2026" \
  -H "Authorization: Bearer $ERP_KEY"

Responses

Status Meaning Body
200 OK AuditFileOut
401 Missing or invalid API key (unauthorized). ErrorEnvelope
403 The caller lacks the required scope (missing_right, with scope), the key belongs to no person where a person is needed (forbidden), or the approval policy denies the action (policy_denied, with action and rule_id). ErrorEnvelope
404 The resource does not exist, or belongs to another organization (not_found). ErrorEnvelope
422 Validation failed: the error envelope (validation_failed). For a malformed body or parameter its message is in sentences ("Line 2: the quantity must be above zero") and fields lists each error with pydantic's loc, type and msg beside its sentence (message) and its parts, to word it in another language: items (name and number from 1: line 2), field (its name as sent) and the rule it breaks with its limit, count and choices (none for a validator's own sentence); FastAPI's own detail list stays beside the envelope. HTTPValidationError

Example response (shape)

{
  "entity": "string",
  "country": "string",
  "formats": [
    "evidence"
  ],
  "fiscal_year": 1,
  "from_period": 1,
  "to_period": 1,
  "start": "2026-09-21",
  "end": "2026-09-21",
  "closing_date": "2026-09-21",
  "year_closed": true,
  "open_periods": [
    1
  ],
  "entries": 1,
  "file_name": "string",
  "file_names": {
    "evidence": "Audit_Evidence_CH01_2026.zip",
    "saft": "SAF-T_CH01_2026.xml"
  },
  "missing": [
    "siren"
  ]
}

GET /v1/entities/{entity}/audit-files/evidence

Download the audit evidence pack

What an external auditor pulls from the books of an entity's fiscal year, in any country: a ZIP laid out after the AICPA Audit Data Standards (|-delimited UTF-8 text with a header row, . as decimal separator, ISO dates) holding the journal lines with who entered, approved and posted each entry, a trial balance that ties to them, the chart of accounts, the company, the organization's users and their rights, sign-ins and security events, the audit trail, the master data changes, the four-eyes approvals, the period closes, the receivables and payables with what is open at the end, the deals won with their invoices, the hash chain's verification, and a README describing every file and column (Audit_Evidence_<entity>_<year>.zip). Recorded in the audit trail.

Required scope read (admin implies every scope)
Operation id evidence_file_v1_entities__entity__audit_files_evidence_get

Parameters

In Name Type Required Description
path entity string yes Entity code, e.g. CH01 (GET /v1/entities).
query fiscal_year integer yes The fiscal year, e.g. 2026.
query from_period integer or null First period of a part of the year (closed periods only); default: the first.
query to_period integer or null Last period of a part of the year (closed periods only); default: the last.

Example request

curl "$ERP_URL/v1/entities/CH01/audit-files/evidence?fiscal_year=2026" \
  -H "Authorization: Bearer $ERP_KEY"

Responses

Status Meaning Body
200 A ZIP with pipe-delimited tables and README.txt. application/zip
401 Missing or invalid API key (unauthorized). ErrorEnvelope
403 The caller lacks the required scope (missing_right, with scope), the key belongs to no person where a person is needed (forbidden), or the approval policy denies the action (policy_denied, with action and rule_id). ErrorEnvelope
404 The resource does not exist, or belongs to another organization (not_found). ErrorEnvelope
422 Validation failed: the error envelope (validation_failed). For a malformed body or parameter its message is in sentences ("Line 2: the quantity must be above zero") and fields lists each error with pydantic's loc, type and msg beside its sentence (message) and its parts, to word it in another language: items (name and number from 1: line 2), field (its name as sent) and the rule it breaks with its limit, count and choices (none for a validator's own sentence); FastAPI's own detail list stays beside the envelope. HTTPValidationError

GET /v1/entities/{entity}/audit-files/fec

Download the FEC (France)

The fichier des écritures comptables (LPF art. L47 A, A47 A-1) of a French entity's fiscal year: the 18 fields, one record per line of every posted entry, the opening balances first, tab-separated, <SIREN>FEC<closing date>.txt. Recorded in the audit trail. Answers 422 audit_file_country for an entity outside France and siren_missing when its French VAT number (where the SIREN is taken from) is missing.

Required scope read (admin implies every scope)
Operation id fec_file_v1_entities__entity__audit_files_fec_get

Parameters

In Name Type Required Description
path entity string yes Entity code, e.g. CH01 (GET /v1/entities).
query fiscal_year integer yes The fiscal year, e.g. 2026.
query from_period integer or null First period of a part of the year (closed periods only); default: the first.
query to_period integer or null Last period of a part of the year (closed periods only); default: the last.

Example request

curl "$ERP_URL/v1/entities/CH01/audit-files/fec?fiscal_year=2026" \
  -H "Authorization: Bearer $ERP_KEY"

Responses

Status Meaning Body
200 The FEC as tab-separated text in ISO-8859-15. text/plain
401 Missing or invalid API key (unauthorized). ErrorEnvelope
403 The caller lacks the required scope (missing_right, with scope), the key belongs to no person where a person is needed (forbidden), or the approval policy denies the action (policy_denied, with action and rule_id). ErrorEnvelope
404 The resource does not exist, or belongs to another organization (not_found). ErrorEnvelope
422 Validation failed: the error envelope (validation_failed). For a malformed body or parameter its message is in sentences ("Line 2: the quantity must be above zero") and fields lists each error with pydantic's loc, type and msg beside its sentence (message) and its parts, to word it in another language: items (name and number from 1: line 2), field (its name as sent) and the rule it breaks with its limit, count and choices (none for a validator's own sentence); FastAPI's own detail list stays beside the envelope. HTTPValidationError

GET /v1/entities/{entity}/audit-files/gobd

Download the GoBD audit file (Germany)

The data carrier for the German tax audit (AO § 147 para. 6, Z3 access) of a German entity's fiscal year: a ZIP with the chart of accounts and its balances, the journal of the posted entries, customers, vendors, the tax codes used and the open items at the end, as CSV, described by index.xml (Beschreibungsstandard 1.6) with its DTD. Recorded in the audit trail. Answers 422 audit_file_country for an entity outside Germany.

Required scope read (admin implies every scope)
Operation id gobd_file_v1_entities__entity__audit_files_gobd_get

Parameters

In Name Type Required Description
path entity string yes Entity code, e.g. CH01 (GET /v1/entities).
query fiscal_year integer yes The fiscal year, e.g. 2026.
query from_period integer or null First period of a part of the year (closed periods only); default: the first.
query to_period integer or null Last period of a part of the year (closed periods only); default: the last.

Example request

curl "$ERP_URL/v1/entities/CH01/audit-files/gobd?fiscal_year=2026" \
  -H "Authorization: Bearer $ERP_KEY"

Responses

Status Meaning Body
200 A ZIP with the CSV tables, index.xml and its DTD. application/zip
401 Missing or invalid API key (unauthorized). ErrorEnvelope
403 The caller lacks the required scope (missing_right, with scope), the key belongs to no person where a person is needed (forbidden), or the approval policy denies the action (policy_denied, with action and rule_id). ErrorEnvelope
404 The resource does not exist, or belongs to another organization (not_found). ErrorEnvelope
422 Validation failed: the error envelope (validation_failed). For a malformed body or parameter its message is in sentences ("Line 2: the quantity must be above zero") and fields lists each error with pydantic's loc, type and msg beside its sentence (message) and its parts, to word it in another language: items (name and number from 1: line 2), field (its name as sent) and the rule it breaks with its limit, count and choices (none for a validator's own sentence); FastAPI's own detail list stays beside the envelope. HTTPValidationError

GET /v1/entities/{entity}/audit-files/saft

Download the SAF-T file (outside France and Germany)

The OECD Standard Audit File for Tax (version 2.0) of the fiscal year of an entity outside France and Germany, as XML (UTF-8, SAF-T_<entity>_<year>.xml): the header (company, VAT number, address, currency, the periods selected), the general ledger accounts with their opening and closing balances, customers and suppliers with their balances, the tax codes used, and every line of every posted entry by journal, with its document, customer or supplier, foreign currency amount and tax; the totals balance. Recorded in the audit trail. Answers 422 audit_file_country for an entity in France or Germany (they get the FEC or the GoBD file).

Required scope read (admin implies every scope)
Operation id saft_file_v1_entities__entity__audit_files_saft_get

Parameters

In Name Type Required Description
path entity string yes Entity code, e.g. CH01 (GET /v1/entities).
query fiscal_year integer yes The fiscal year, e.g. 2026.
query from_period integer or null First period of a part of the year (closed periods only); default: the first.
query to_period integer or null Last period of a part of the year (closed periods only); default: the last.

Example request

curl "$ERP_URL/v1/entities/CH01/audit-files/saft?fiscal_year=2026" \
  -H "Authorization: Bearer $ERP_KEY"

Responses

Status Meaning Body
200 The OECD SAF-T 2.0 XML in UTF-8. application/xml
401 Missing or invalid API key (unauthorized). ErrorEnvelope
403 The caller lacks the required scope (missing_right, with scope), the key belongs to no person where a person is needed (forbidden), or the approval policy denies the action (policy_denied, with action and rule_id). ErrorEnvelope
404 The resource does not exist, or belongs to another organization (not_found). ErrorEnvelope
422 Validation failed: the error envelope (validation_failed). For a malformed body or parameter its message is in sentences ("Line 2: the quantity must be above zero") and fields lists each error with pydantic's loc, type and msg beside its sentence (message) and its parts, to word it in another language: items (name and number from 1: line 2), field (its name as sent) and the rule it breaks with its limit, count and choices (none for a validator's own sentence); FastAPI's own detail list stays beside the envelope. HTTPValidationError

Schemas

AuditFileOut

What an audit file of an entity's fiscal year (or of a range of its periods) would cover.

Field Type Required Description
entity string yes Entity code.
country string yes Entity country (ISO 3166-1 alpha-2).
formats array of "evidence" | "fec" | "gobd" | "saft" yes The formats that fit the entity's country, its tax audit file first: fec for France, gobd for Germany, saft (OECD SAF-T 2.0) elsewhere; then evidence (the audit evidence pack), for every country.
fiscal_year integer yes The fiscal year.
from_period integer yes The first period covered.
to_period integer yes The last period covered.
start string (date) yes First day covered.
end string (date) yes Last day covered.
closing_date string (date) yes The last day of the fiscal year: the date in the FEC's file name.
year_closed boolean yes True when the fiscal year's close is approved. The files can be made before; they then cover what is posted so far, which can still change.
open_periods array of integer yes The numbers of the covered periods that are still open (posting into them is still possible).
entries integer yes Posted journal entries in the range.
file_name string or null yes The name the tax audit file (the first of formats) will have; null when it cannot be made (missing). file_names has the name of each format.
file_names map of string yes The name each format's file will have, by format; a format whose file cannot be made (missing) is left out.
missing array of "siren" yes What stops the file: siren (an FEC is named after the company's SIREN, taken from its French VAT number, and the entity has none); empty when it can be made.
Stabiso, the Enterprise System of Record · generated from the code and its guides · release 6f03a5e846b3