Carta Manifiesto

The Carta Manifiesto is the letter in which the taxpayer authorizes its PAC (Proveedor Autorizado de Certificación, a SAT-authorized provider that stamps CFDIs) to certify the CFDIs (Mexico's electronic invoices) it issues with Fiscalapi and deliver them to the SAT (Mexico's tax authority, Servicio de Administración Tributaria). Signing it is required by Rules 2.7.2.5 and 2.7.2.7 of the 2026 Resolución Miscelánea Fiscal (the SAT's annual tax rules). You must sign it for each issuer RFC (Mexico's taxpayer ID, Registro Federal de Contribuyentes) in each tenant (the space in Fiscalapi that holds your issuers, recipients, credits, and data).

Besides the API, Fiscalapi offers three other signing flows in the dashboard. Read the Carta Manifiesto article to learn about them.

Signing model

The signing model contains the data to generate and sign the Carta Manifiesto for the RFC on the certificate you send. The result is the signed PDF, Base64-encoded.

Name
base64Cer
Type
string
required
Description
The certificate (.cer) of the taxpayer's e.firma (the SAT advanced electronic signature that identifies a taxpayer, formerly FIEL), Base64-encoded.
Name
base64Key
Type
string
required
Description
The private key (.key) of the taxpayer's e.firma, Base64-encoded.
Name
password
Type
string
required
Description
The password of the e.firma private key. It must open the key in base64Key; if it doesn't, Sign the Carta Manifiesto returns 400.

POST/api/v4/manifests

Sign the Carta Manifiesto

This endpoint generates and signs the Carta Manifiesto for the RFC on the certificate you send, and returns the signed PDF in Base64. Every person (any individual or legal entity registered in your tenant) with that RFC ends up with manifestStatusId set to Signed, because the letter belongs to the RFC, not to a person. If no person in the tenant has that RFC, the endpoint returns 404 and doesn't sign.

See all the invoicing examples in the Postman collection.

Request body

Name
base64Cer
Type
string
required
Description
The certificate (.cer) of the taxpayer's e.firma, Base64-encoded.
Name
base64Key
Type
string
required
Description
The private key (.key) of the taxpayer's e.firma, Base64-encoded.
Name
password
Type
string
required
Description
The password of the e.firma private key. It must open the key in base64Key; Fiscalapi rejects any other password before signing.

Errors

In the message, <rfc> is the certificate's RFC.

Status	When it happens	Message
404	No person in the tenant has the certificate's RFC. The message arrives in the `details` field.	No existe un usuario con RFC <rfc> en el tenant actual.
400	The password doesn't open the private key, or the file isn't a private key. It arrives as a validation failure on Password. See Certificates and private keys.	La contraseña de la llave privada (.key) es incorrecta o el archivo no es una llave privada.

Request

POST

/api/v4/manifests

curl --location 'https://test.fiscalapi.com/api/v4/manifests' \
--header 'X-TENANT-KEY: <tenant-key>' \
--header 'X-TIME-ZONE: America/Mexico_City' \
--header 'Content-Type: application/json' \
--header 'X-API-KEY: <api-key>' \
--data '{
  "base64Cer": "base64CerHere...",
  "base64Key": "base64KeyHere...",
  "password": "passwordPhraseHere..."
}'

Response

{
    "data": {
        "fileName": "EKU9003173C9.pdf",
        "fileExtension": ".pdf",
        "base64File": "JVBERi0xLjQKJaqrrK0KNCAwIG9iago8PA..."
    },
    "succeeded": true,
    "message": "",
    "details": "",
    "httpStatusCode": 200
}

Limits

Limit	Value
Size of each .cer and .key file	Up to 16 KB. SAT e.firma files average about 8 KB, so the limit covers any real-world variation.
Rate limit of the anonymous endpoint of the public signing portal	5 signatures per minute per IP.
Rate limit of the authenticated Sign the Carta Manifiesto endpoint	The API's global limits.
Password length	Up to 256 characters.

If you exceed any of these limits, the API returns 400 Bad Request for validation or 429 Too Many Requests for the rate limit.