Upload an issuer's signing certificate
using System.Net.Http.Headers;var client = new HttpClient();var request = new HttpRequestMessage{ Method = HttpMethod.Post, RequestUri = new Uri("https://api.flashpi.com.ec/v1/issuers/example/certificates"), Headers = { { "Authorization", "Bearer <token>" }, }, Content = new MultipartFormDataContent { new StringContent("") { Headers = { ContentType = new MediaTypeHeaderValue("application/octet-stream"), ContentDisposition = new ContentDispositionHeaderValue("form-data") { Name = "file", FileName = "file", } } }, new StringContent("example") { Headers = { ContentType = new MediaTypeHeaderValue("text/plain"), ContentDisposition = new ContentDispositionHeaderValue("form-data") { Name = "password", } } }, },};using (var response = await client.SendAsync(request)){ response.EnsureSuccessStatusCode(); var body = await response.Content.ReadAsStringAsync(); Console.WriteLine(body);}package main
import ( "fmt" "strings" "net/http" "io")
func main() {
url := "https://api.flashpi.com.ec/v1/issuers/example/certificates"
payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"file\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"password\"\r\nContent-Type: text/plain\r\n\r\nexample\r\n-----011000010111000001101001--\r\n")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>") req.Header.Add("Content-Type", "multipart/form-data; boundary=---011000010111000001101001")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close() body, _ := io.ReadAll(res.Body)
fmt.Println(res) fmt.Println(string(body))
}HttpRequest request = HttpRequest.newBuilder() .uri(URI.create("https://api.flashpi.com.ec/v1/issuers/example/certificates")) .header("Authorization", "Bearer <token>") .header("Content-Type", "multipart/form-data; boundary=---011000010111000001101001") .method("POST", HttpRequest.BodyPublishers.ofString("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"file\"; filename=\"file\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"password\"\r\nContent-Type: text/plain\r\n\r\nexample\r\n-----011000010111000001101001--\r\n")) .build();HttpResponse<String> response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());System.out.println(response.body());const url = 'https://api.flashpi.com.ec/v1/issuers/example/certificates';const form = new FormData();form.append('file', 'file');form.append('password', 'example');
const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
options.body = form;
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.flashpi.com.ec/v1/issuers/example/certificates \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: multipart/form-data' \ --form file=@file \ --form password=exampleUploads the .p12 (PKCS#12) file and its password as multipart/form-data. Flashpi encrypts both at once and checks them asynchronously (password, signing key, validity, trusted Ecuadorian certification authority, revocation): the certificate starts processing, then becomes accepted or rejected; follow it with GET. The password is never stored in clear nor returned. Requires an account-scoped (global) API key with read_write access. Test keys manage test certificates and live keys live ones; a certificate of the issuer onboarding serves both modes (allModes) and both read it.
Authorizations
Sección titulada «Authorizations»Parameters
Sección titulada «Parameters»Path Parameters
Sección titulada «Path Parameters»Header Parameters
Sección titulada «Header Parameters»Makes the request safe to retry: 1 to 255 visible ASCII characters (a UUID works well), remembered for 24 hours per account and mode. A retry with the same key and the same request returns the first successful response again, with the header Idempotent-Replayed: true. The same key with a different request gets 422 idempotency_key_reused; while the first request still runs, 409 idempotency_key_in_progress. A failed request does not keep its key.
Language of error messages and of the localized texts of resources (SRI messages, failures, certificate rejections): Spanish when the entry with the highest q-value is es or es- plus a region (es-EC, es-419), English otherwise. Errors state it in Content-Language.
Your own ID for the request (letters, digits and -_.:/+=), echoed back in the X-Correlation-Id response header and logged next to the request ID. An invalid value gets 400 invalid_correlation_id.
Request Bodyrequired
Sección titulada «Request Bodyrequired»object
The .p12 file, at most 1048576 bytes.
Its password, at most 1024 bytes in UTF-8.
Responses
Sección titulada «Responses»Accepted for checking: status processing.
An issuer’s .p12 signing certificate. Flashpi checks the upload asynchronously (processing, then accepted or rejected); the file and its password are never returned.
object
Mode of the API key that uploaded it. A certificate of the issuer onboarding serves every mode (allModes): it shows the mode of the API key that reads it.
Whether it serves every mode (test and live): a certificate uploaded through the issuer onboarding (POST /v1/issuer-onboardings). False for one uploaded for one mode.
Whether it signs documents now: accepted, within its validity and not blocked.
Subject distinguished name.
Distinguished name of the certification authority that issued it.
SHA-256 of the certificate, hex.
The RUC found in the certificate, when its authority writes one.
Whether the certification authority revoked the certificate. good: verified not revoked. pending: could not be verified yet; it still signs until blockAt and is checked again hourly. blocked: still unverified after 7 days, or its chain is no longer trusted (blockedReason); it does not sign. revoked: never signs again.
object
Pending only: when it stops signing if still unverified.
Example
{ "environment": "test", "status": "processing", "serialNumber": "4f2a9c01", "ruc": "1790000000001", "revocation": { "status": "good", "blockedReason": "revocation_status_unverified" }, "rejection": { "code": "invalid_password", "message": "The password does not open the .p12 file." }}Headers
Sección titulada «Headers»Path of the certificate: /v1/issuers/{issuerId}/certificates/{id}. Not sent on an idempotent replay (Idempotent-Replayed: true): build it from the body as shown.
true when this is the stored answer of an earlier request with the same Idempotency-Key (same status and body, no Location). Absent otherwise.
Flashpi’s ID of the request, a UUIDv7 (also requestId in errors). Include it when you contact support.
Invalid_idempotency_key: the Idempotency-Key header is malformed.
RFC 9457 problem details, in the language of Content-Language (en, or es with Accept-Language: es). Some codes add extension members, listed below; others may appear.
object
URI of the problem type: the page that documents code, in the language of the response (https://flashpi.com.ec/docs/en/errors/{code} in English, https://flashpi.com.ec/docs/errors/{code} with Accept-Language: es). It changes with the language, so branch on code, never on type.
Localized summary of the type.
HTTP status code.
Localized explanation of this occurrence.
Path of the request.
Stable machine-readable error code, the same in every language. Branch on it, never on type, title or detail. New codes may be added: handle an unknown one by its HTTP status.
Field-level errors (may be empty).
object
Path of the invalid field.
Stable machine-readable reason. New codes may be added: treat an unknown one like invalid_value.
Localized message.
Request ID (UUIDv7); include it when contacting support.
idempotency_key_reused: the document the Idempotency-Key already created.
The daily limit that was reached (email_resend_limit_reached, account_email_limit_reached, demo_issuer_quota_exceeded).
When the daily limit resets: the next midnight in Ecuador (the three codes above and platform_email_limit_reached). Retry-After gives the same in seconds.
ride_not_available: the status of the RIDE.
document_not_authorized: the status of the document.
email_sending_paused: the mode whose email sending is paused.
total_mismatch: the expectedTotal you sent.
total_mismatch: the total Flashpi computed.
Example
{ "type": "https://flashpi.com.ec/docs/en/errors/validation_failed", "title": "Validation failed", "status": 422, "detail": "One or more fields are invalid. See errors for details.", "instance": "/v1/invoices", "code": "validation_failed", "errors": [ { "field": "customer.id", "code": "required", "message": "This field is required." } ], "requestId": "017f22e2-79b0-7cc3-98c4-dc0c0c07398f", "rideStatus": "pending", "documentStatus": "processing", "environment": "test", "expectedTotal": "112.00", "computedTotal": "111.99"}authentication_required: no Authorization: Bearer header. invalid_api_key: the key is malformed, unknown or revoked.
RFC 9457 problem details, in the language of Content-Language (en, or es with Accept-Language: es). Some codes add extension members, listed below; others may appear.
object
URI of the problem type: the page that documents code, in the language of the response (https://flashpi.com.ec/docs/en/errors/{code} in English, https://flashpi.com.ec/docs/errors/{code} with Accept-Language: es). It changes with the language, so branch on code, never on type.
Localized summary of the type.
HTTP status code.
Localized explanation of this occurrence.
Path of the request.
Stable machine-readable error code, the same in every language. Branch on it, never on type, title or detail. New codes may be added: handle an unknown one by its HTTP status.
Field-level errors (may be empty).
object
Path of the invalid field.
Stable machine-readable reason. New codes may be added: treat an unknown one like invalid_value.
Localized message.
Request ID (UUIDv7); include it when contacting support.
idempotency_key_reused: the document the Idempotency-Key already created.
The daily limit that was reached (email_resend_limit_reached, account_email_limit_reached, demo_issuer_quota_exceeded).
When the daily limit resets: the next midnight in Ecuador (the three codes above and platform_email_limit_reached). Retry-After gives the same in seconds.
ride_not_available: the status of the RIDE.
document_not_authorized: the status of the document.
email_sending_paused: the mode whose email sending is paused.
total_mismatch: the expectedTotal you sent.
total_mismatch: the total Flashpi computed.
Example
{ "type": "https://flashpi.com.ec/docs/en/errors/validation_failed", "title": "Validation failed", "status": 422, "detail": "One or more fields are invalid. See errors for details.", "instance": "/v1/invoices", "code": "validation_failed", "errors": [ { "field": "customer.id", "code": "required", "message": "This field is required." } ], "requestId": "017f22e2-79b0-7cc3-98c4-dc0c0c07398f", "rideStatus": "pending", "documentStatus": "processing", "environment": "test", "expectedTotal": "112.00", "computedTotal": "111.99"}Headers
Sección titulada «Headers»RFC 6750 challenge: Bearer realm="flashpi", plus error="invalid_token" with invalid_api_key.
The API key cannot perform this operation: key_scope_mismatch, key_read_only or ip_not_allowed; or its account is suspended (account_suspended).
RFC 9457 problem details, in the language of Content-Language (en, or es with Accept-Language: es). Some codes add extension members, listed below; others may appear.
object
URI of the problem type: the page that documents code, in the language of the response (https://flashpi.com.ec/docs/en/errors/{code} in English, https://flashpi.com.ec/docs/errors/{code} with Accept-Language: es). It changes with the language, so branch on code, never on type.
Localized summary of the type.
HTTP status code.
Localized explanation of this occurrence.
Path of the request.
Stable machine-readable error code, the same in every language. Branch on it, never on type, title or detail. New codes may be added: handle an unknown one by its HTTP status.
Field-level errors (may be empty).
object
Path of the invalid field.
Stable machine-readable reason. New codes may be added: treat an unknown one like invalid_value.
Localized message.
Request ID (UUIDv7); include it when contacting support.
idempotency_key_reused: the document the Idempotency-Key already created.
The daily limit that was reached (email_resend_limit_reached, account_email_limit_reached, demo_issuer_quota_exceeded).
When the daily limit resets: the next midnight in Ecuador (the three codes above and platform_email_limit_reached). Retry-After gives the same in seconds.
ride_not_available: the status of the RIDE.
document_not_authorized: the status of the document.
email_sending_paused: the mode whose email sending is paused.
total_mismatch: the expectedTotal you sent.
total_mismatch: the total Flashpi computed.
Example
{ "type": "https://flashpi.com.ec/docs/en/errors/validation_failed", "title": "Validation failed", "status": 422, "detail": "One or more fields are invalid. See errors for details.", "instance": "/v1/invoices", "code": "validation_failed", "errors": [ { "field": "customer.id", "code": "required", "message": "This field is required." } ], "requestId": "017f22e2-79b0-7cc3-98c4-dc0c0c07398f", "rideStatus": "pending", "documentStatus": "processing", "environment": "test", "expectedTotal": "112.00", "computedTotal": "111.99"}Not_found: the issuer does not exist.
RFC 9457 problem details, in the language of Content-Language (en, or es with Accept-Language: es). Some codes add extension members, listed below; others may appear.
object
URI of the problem type: the page that documents code, in the language of the response (https://flashpi.com.ec/docs/en/errors/{code} in English, https://flashpi.com.ec/docs/errors/{code} with Accept-Language: es). It changes with the language, so branch on code, never on type.
Localized summary of the type.
HTTP status code.
Localized explanation of this occurrence.
Path of the request.
Stable machine-readable error code, the same in every language. Branch on it, never on type, title or detail. New codes may be added: handle an unknown one by its HTTP status.
Field-level errors (may be empty).
object
Path of the invalid field.
Stable machine-readable reason. New codes may be added: treat an unknown one like invalid_value.
Localized message.
Request ID (UUIDv7); include it when contacting support.
idempotency_key_reused: the document the Idempotency-Key already created.
The daily limit that was reached (email_resend_limit_reached, account_email_limit_reached, demo_issuer_quota_exceeded).
When the daily limit resets: the next midnight in Ecuador (the three codes above and platform_email_limit_reached). Retry-After gives the same in seconds.
ride_not_available: the status of the RIDE.
document_not_authorized: the status of the document.
email_sending_paused: the mode whose email sending is paused.
total_mismatch: the expectedTotal you sent.
total_mismatch: the total Flashpi computed.
Example
{ "type": "https://flashpi.com.ec/docs/en/errors/validation_failed", "title": "Validation failed", "status": 422, "detail": "One or more fields are invalid. See errors for details.", "instance": "/v1/invoices", "code": "validation_failed", "errors": [ { "field": "customer.id", "code": "required", "message": "This field is required." } ], "requestId": "017f22e2-79b0-7cc3-98c4-dc0c0c07398f", "rideStatus": "pending", "documentStatus": "processing", "environment": "test", "expectedTotal": "112.00", "computedTotal": "111.99"}Idempotency_key_in_progress: a request with this Idempotency-Key is still running.
RFC 9457 problem details, in the language of Content-Language (en, or es with Accept-Language: es). Some codes add extension members, listed below; others may appear.
object
URI of the problem type: the page that documents code, in the language of the response (https://flashpi.com.ec/docs/en/errors/{code} in English, https://flashpi.com.ec/docs/errors/{code} with Accept-Language: es). It changes with the language, so branch on code, never on type.
Localized summary of the type.
HTTP status code.
Localized explanation of this occurrence.
Path of the request.
Stable machine-readable error code, the same in every language. Branch on it, never on type, title or detail. New codes may be added: handle an unknown one by its HTTP status.
Field-level errors (may be empty).
object
Path of the invalid field.
Stable machine-readable reason. New codes may be added: treat an unknown one like invalid_value.
Localized message.
Request ID (UUIDv7); include it when contacting support.
idempotency_key_reused: the document the Idempotency-Key already created.
The daily limit that was reached (email_resend_limit_reached, account_email_limit_reached, demo_issuer_quota_exceeded).
When the daily limit resets: the next midnight in Ecuador (the three codes above and platform_email_limit_reached). Retry-After gives the same in seconds.
ride_not_available: the status of the RIDE.
document_not_authorized: the status of the document.
email_sending_paused: the mode whose email sending is paused.
total_mismatch: the expectedTotal you sent.
total_mismatch: the total Flashpi computed.
Example
{ "type": "https://flashpi.com.ec/docs/en/errors/validation_failed", "title": "Validation failed", "status": 422, "detail": "One or more fields are invalid. See errors for details.", "instance": "/v1/invoices", "code": "validation_failed", "errors": [ { "field": "customer.id", "code": "required", "message": "This field is required." } ], "requestId": "017f22e2-79b0-7cc3-98c4-dc0c0c07398f", "rideStatus": "pending", "documentStatus": "processing", "environment": "test", "expectedTotal": "112.00", "computedTotal": "111.99"}Payload_too_large: the file is larger than 1 MiB.
RFC 9457 problem details, in the language of Content-Language (en, or es with Accept-Language: es). Some codes add extension members, listed below; others may appear.
object
URI of the problem type: the page that documents code, in the language of the response (https://flashpi.com.ec/docs/en/errors/{code} in English, https://flashpi.com.ec/docs/errors/{code} with Accept-Language: es). It changes with the language, so branch on code, never on type.
Localized summary of the type.
HTTP status code.
Localized explanation of this occurrence.
Path of the request.
Stable machine-readable error code, the same in every language. Branch on it, never on type, title or detail. New codes may be added: handle an unknown one by its HTTP status.
Field-level errors (may be empty).
object
Path of the invalid field.
Stable machine-readable reason. New codes may be added: treat an unknown one like invalid_value.
Localized message.
Request ID (UUIDv7); include it when contacting support.
idempotency_key_reused: the document the Idempotency-Key already created.
The daily limit that was reached (email_resend_limit_reached, account_email_limit_reached, demo_issuer_quota_exceeded).
When the daily limit resets: the next midnight in Ecuador (the three codes above and platform_email_limit_reached). Retry-After gives the same in seconds.
ride_not_available: the status of the RIDE.
document_not_authorized: the status of the document.
email_sending_paused: the mode whose email sending is paused.
total_mismatch: the expectedTotal you sent.
total_mismatch: the total Flashpi computed.
Example
{ "type": "https://flashpi.com.ec/docs/en/errors/validation_failed", "title": "Validation failed", "status": 422, "detail": "One or more fields are invalid. See errors for details.", "instance": "/v1/invoices", "code": "validation_failed", "errors": [ { "field": "customer.id", "code": "required", "message": "This field is required." } ], "requestId": "017f22e2-79b0-7cc3-98c4-dc0c0c07398f", "rideStatus": "pending", "documentStatus": "processing", "environment": "test", "expectedTotal": "112.00", "computedTotal": "111.99"}Validation_failed: the file or the password is missing or too long. Or idempotency_key_reused: the Idempotency-Key was used with a different request.
RFC 9457 problem details, in the language of Content-Language (en, or es with Accept-Language: es). Some codes add extension members, listed below; others may appear.
object
URI of the problem type: the page that documents code, in the language of the response (https://flashpi.com.ec/docs/en/errors/{code} in English, https://flashpi.com.ec/docs/errors/{code} with Accept-Language: es). It changes with the language, so branch on code, never on type.
Localized summary of the type.
HTTP status code.
Localized explanation of this occurrence.
Path of the request.
Stable machine-readable error code, the same in every language. Branch on it, never on type, title or detail. New codes may be added: handle an unknown one by its HTTP status.
Field-level errors (may be empty).
object
Path of the invalid field.
Stable machine-readable reason. New codes may be added: treat an unknown one like invalid_value.
Localized message.
Request ID (UUIDv7); include it when contacting support.
idempotency_key_reused: the document the Idempotency-Key already created.
The daily limit that was reached (email_resend_limit_reached, account_email_limit_reached, demo_issuer_quota_exceeded).
When the daily limit resets: the next midnight in Ecuador (the three codes above and platform_email_limit_reached). Retry-After gives the same in seconds.
ride_not_available: the status of the RIDE.
document_not_authorized: the status of the document.
email_sending_paused: the mode whose email sending is paused.
total_mismatch: the expectedTotal you sent.
total_mismatch: the total Flashpi computed.
Example
{ "type": "https://flashpi.com.ec/docs/en/errors/validation_failed", "title": "Validation failed", "status": 422, "detail": "One or more fields are invalid. See errors for details.", "instance": "/v1/invoices", "code": "validation_failed", "errors": [ { "field": "customer.id", "code": "required", "message": "This field is required." } ], "requestId": "017f22e2-79b0-7cc3-98c4-dc0c0c07398f", "rideStatus": "pending", "documentStatus": "processing", "environment": "test", "expectedTotal": "112.00", "computedTotal": "111.99"}