Authentication

Every call needs a bearer token. You get it with the client id and secret VAT IT issues to you. Sandbox and production have separate credentials.

Environment	Token URL
Sandbox	`https://api.sandbox.vatcompliance.com/v1/auth/token`
Production	`https://api.vatcompliance.com/v1/auth/token`

Get a token

curl -X POST "https://api.sandbox.vatcompliance.com/v1/auth/token" \
  -H "Content-Type: application/json" \
  -d '{"client_id": "<your client id>", "client_secret": "<your client secret>"}'

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 86400,
  "scope": "read:transactions write:transactions",
  "created_at": "2026-11-06T09:00:00Z",
  "expire_at": "2026-11-07T09:00:00Z"
}

This is not the form-encoded body of standard OAuth2. Send JSON, with no grant_type and no scope: the scopes are fixed on your credential.

Use it

curl -X POST "https://partner-api.sandbox.vatcompliance.com/v1/transactions" \
  -H "Authorization: Bearer <access_token>" \
  -H "Content-Type: application/json" \
  -H "X-Request-Id: <your id for this call>" \
  -d @documents.json

Keep it and renew it

A token lasts 24 hours (expires_in is 86400). Keep it and reuse it for every call, from every worker, until it nears expire_at. Never ask for a token per call.
Get a new token once the one you hold is within 10 minutes of expire_at. Asking earlier returns the same token.
If a call returns 401 with expired_token, get a new token and retry the call once.

Scopes

Scope	Grants
`write:transactions`	Submit and void documents
`read:transactions`	Read documents, lines, statuses and errors

When it fails

Status	`code`	What to do
`401` from the token call		The client id or secret is wrong, or the credential was revoked or has expired. VAT IT must issue a new one
`401`	`expired_token`	Get a new token and retry once
`401`	`invalid_token`	The token is missing, malformed or not for this API. Check the `Authorization` header
`403`	`insufficient_scope`	Your credential lacks the scope for this call. VAT IT must add it
`403`	`forbidden`	The client is not one of yours

Keeping the secret safe

Keep the client secret on your servers only, never in a browser or desktop client, and never in logs. Each credential has an expiry date: VAT IT tells you the date and issues a replacement before it. If a secret leaks, tell VAT IT and it is revoked at once.

Overview

Sending transactions