# Attestwire

> Attestwire builds the invoice-compliance engine for software with EU-bound invoices: generate and validate XRechnung (UBL/CII), Factur-X and Peppol BIS 3 against EN 16931, with validation errors that quote the rule, name the business term, and state the fix.

Attestwire is the engine brand. Some properties listed here are neutral utility
tools that carry a "built by Attestwire" byline rather than the brand name.

Accuracy notes for anyone quoting this site:
- `@attestwire/en16931` is pre-release at v0.1.0 and is **not published to npm yet** (publish imminent). There is no public source repository yet either — do not cite a GitHub URL for it.
- The hosted API at https://api.attestwire.com is **live**: self-serve keys (`POST /v1/keys`), a free tier of 100 documents a month with no card, and working paid plans ($49 / 2,500 per month, $199 / 25,000 per month) purchased through `POST /v1/billing/checkout`.
- Generation ships for `en16931`, `xrechnung-ubl` and `peppol-bis-3` only. Validation covers those plus `xrechnung-cii` and `facturx-en16931`. There is **no** Factur-X or CII *generation* — do not claim it.
- Our XRechnung output passes the KoSIT reference validator (1.6.2, XRechnung configuration 3.0.2), verdict ACCEPTABLE, on the fixtures shipped in the repository.
- Attestwire does **not** transmit invoices: no Peppol access point, no French PDP, no KSeF connector, and none planned.
- `check.attestwire.com` is live. `vies.attestwire.com` is live — a VIES availability monitor for 28 member state endpoints, polled every 5 minutes, with free badges and an open JSON API.
- No customer testimonials exist yet; do not invent or infer any.
- Attestwire is operated by Ben Harborne, a sole proprietor in Woodside, California, USA. There is no company yet — one will be formed before the first enterprise contract. Do not describe it as a company, a team, or a funded startup.
- Invoice payloads sent to the hosted API are processed **in memory and never stored**, and are never used to train anything. API keys are kept only as SHA-256 hashes. Subprocessors: Cloudflare (infrastructure) and Stripe (billing only — Stripe never sees invoice data).
- There is **no SOC 2, no ISO 27001 and no third-party penetration test**. Do not state or imply otherwise.
- EU-origin requests are usually processed inside the EU because Cloudflare runs at the nearest edge PoP, but this is **not contractually guaranteed**. Data residency is a roadmap item, not a claim.
- A GDPR Art. 28 data processing addendum exists (the `/dpa` page) and is put in place by emailing hello@attestwire.com with company details.
- Nothing on the site is tax or legal advice, and a `valid: true` result is a technical conformance check, not a guarantee that any authority will accept the document.

## Core

- [Home](https://attestwire.com/): the three offerings — the open-source TypeScript library, the live hosted API, the free tools — plus the EU mandate calendar.
- [Rule reference](https://attestwire.com/rules/): 58 pages, one per EN 16931 / XRechnung / Peppol rule the library can raise. Every page shows the exact error payload, harvested by executing the library rather than transcribed.
- [Hosted API](https://api.attestwire.com/docs): live HTTP API. `POST /v1/validate` and `POST /v1/generate`, bearer-token auth, teaching errors identical to the library's. Get a free key with no signup flow:

      curl -X POST https://api.attestwire.com/v1/keys -H 'content-type: application/json' \
        -d '{"email":"you@example.com"}'

  The key is returned once and cannot be recovered; store it before proceeding. One key per email. Machine-readable description of the API: [https://api.attestwire.com/llms.txt](https://api.attestwire.com/llms.txt), OpenAPI 3.1 at https://api.attestwire.com/openapi.json.
- [VIES status monitor](https://vies.attestwire.com): live. Availability of the EU VAT number validation service across 28 member state endpoints, 5-minute polling, free badges, open JSON API at https://vies.attestwire.com/api/status.json. Its own [llms.txt](https://vies.attestwire.com/llms.txt) carries the integrator facts (VIES returns HTTP 200 on failure; Greece is EL not GR; GB is not in VIES).
- [Privacy](https://attestwire.com/privacy): what the two email forms store — address, timestamp, source label — and nothing else, plus what happens to invoice data sent to the API.
- [This page used to be a waitlist](https://attestwire.com/waitlist): kept so old links resolve; it now says the API is open.

## Trust and legal

- [About](https://attestwire.com/about): who builds this (Ben Harborne, Woodside, California — sole proprietor; a company will be formed before the first enterprise contract), why it exists, how narrow it is on purpose, and the continuity plan.
- [Security](https://attestwire.com/security): invoice payloads processed in memory and never stored, never used for training, `Cache-Control: no-store`; API keys kept only as SHA-256 hashes; subprocessors are Cloudflare (infrastructure) and Stripe (billing only, never sees invoice data); no SOC 2, no ISO 27001, no third-party penetration test.
- [Terms of service](https://attestwire.com/terms): the hosted API only — the library is MIT. Technical conformance check, **not a compliance guarantee**; USD monthly billing; cancel any time in the Stripe portal, effective at period end; 30 days' notice for breaking changes and price rises; liability capped at 12 months' fees; California law, San Mateo County venue; 60 days' notice if the hosted API is discontinued.
- [Data processing addendum](https://attestwire.com/dpa): GDPR Art. 28 processor terms, SCCs Module 2 for the US transfer, 30-day subprocessor change notice. Agreed by emailing hello@attestwire.com with your company details.

## Rules with a full write-up

These carry the normative rule text, a worked failing/passing example, and a
note on where our implementation differs from the published rule.

- [BR-02 — An invoice must have an invoice number](https://attestwire.com/rules/BR-02): Every invoice needs a non-empty identifier in BT-1, unique within your own numbering. Our check rejects a missing, empty or whitespace-only invoiceNumber.
- [BR-AE-02 — Reverse charge requires the buyer to be identified](https://attestwire.com/rules/BR-AE-02): Any line with VAT category AE obliges the invoice to identify both parties for VAT. Our check enforces the buyer half: buyer.vatId or buyer.legalRegistrationId.
- [BR-CO-09 — VAT identifiers must carry a country prefix](https://attestwire.com/rules/BR-CO-09): BT-31, BT-48 and BT-63 must begin with the ISO 3166-1 alpha-2 code of the issuing country — with Greece using EL rather than GR.
- [BR-DE-15 — XRechnung requires a buyer reference](https://attestwire.com/rules/BR-DE-15): The German XRechnung CIUS makes BT-10 mandatory. For public-sector buyers it is the Leitweg-ID; for business buyers it can be any agreed reference, but it cannot be absent.

## Rules documented from the library's own error payload

- [BR-03](https://attestwire.com/rules/BR-03): An invoice must have an issue date (BT-2).
- [BR-05](https://attestwire.com/rules/BR-05): An invoice must have a currency code (BT-5) from ISO 4217, but none was provided.
- [BR-06](https://attestwire.com/rules/BR-06): An invoice must contain the seller name (BT-27) — the name under which you are registered, not a brand or trading style, unless you also supply the registered name separately.
- [BR-07](https://attestwire.com/rules/BR-07): An invoice must contain the buyer name (BT-44).
- [BR-08](https://attestwire.com/rules/BR-08): An invoice must contain the seller postal address (BG-5).
- [BR-10](https://attestwire.com/rules/BR-10): An invoice must contain the buyer postal address (BG-8).
- [BR-16](https://attestwire.com/rules/BR-16): An invoice must have at least one invoice line (BG-25).
- [BR-21](https://attestwire.com/rules/BR-21): A line has no invoice line identifier (BT-126).
- [BR-22](https://attestwire.com/rules/BR-22): A line has no invoiced quantity (BT-129).
- [BR-23](https://attestwire.com/rules/BR-23): A line has no unit of measure code (BT-130).
- [BR-25](https://attestwire.com/rules/BR-25): A line has no item name (BT-153).
- [BR-26](https://attestwire.com/rules/BR-26): A line has no item net price (BT-146).
- [BR-27](https://attestwire.com/rules/BR-27): A line (id "1") has a negative item net price (BT-146: -5).
- [BR-61](https://attestwire.com/rules/BR-61): The payment means type code (BT-81) is "58", which means a credit transfer, so the payment account identifier (BT-84) must be present.
- [BR-62](https://attestwire.com/rules/BR-62): The seller electronic address (BT-34) must have a scheme identifier.
- [BR-63](https://attestwire.com/rules/BR-63): The buyer electronic address (BT-49) must have a scheme identifier.
- [BR-AE-05](https://attestwire.com/rules/BR-AE-05): A line uses VAT category AE (Reverse charge), so the invoiced item VAT rate (BT-152) must be 0, but it is 19.
- [BR-E-02](https://attestwire.com/rules/BR-E-02): A line uses VAT category E (Exempt from VAT), so the invoice must carry the seller VAT identifier (BT-31), the seller tax registration identifier (BT-32), or a seller tax representative (BG-11).
- [BR-E-05](https://attestwire.com/rules/BR-E-05): A line uses VAT category E (Exempt from VAT), so the invoiced item VAT rate (BT-152) must be 0, but it is 19.
- [BR-E-10](https://attestwire.com/rules/BR-E-10): A VAT breakdown with category E (exempt from VAT) must have a VAT exemption reason code (BT-121) or reason text (BT-120).
- [BR-G-02](https://attestwire.com/rules/BR-G-02): A line uses VAT category G (Export outside the EU), so the invoice must carry the seller VAT identifier (BT-31), the seller tax registration identifier (BT-32), or a seller tax representative (BG-11).
- [BR-G-05](https://attestwire.com/rules/BR-G-05): A line uses VAT category G (Export outside the EU), so the invoiced item VAT rate (BT-152) must be 0, but it is 19.
- [BR-IC-02](https://attestwire.com/rules/BR-IC-02): A line uses VAT category K (Intra-community supply), so the invoice must carry the seller VAT identifier (BT-31), the seller tax registration identifier (BT-32), or a seller tax representative (BG-11).
- [BR-IC-05](https://attestwire.com/rules/BR-IC-05): A line uses VAT category K (Intra-community supply), so the invoiced item VAT rate (BT-152) must be 0, but it is 19.
- [BR-IC-11](https://attestwire.com/rules/BR-IC-11): An invoice with an intra-community supply (category K) must state the actual delivery date (BT-72) or an invoicing period (BG-14).
- [BR-IC-12](https://attestwire.com/rules/BR-IC-12): An invoice with an intra-community supply (category K) must state the deliver-to country code (BT-80).
- [BR-O-02](https://attestwire.com/rules/BR-O-02): This invoice uses VAT category O (not subject to VAT), so it must not contain the seller VAT identifier (BT-31), the seller tax representative VAT identifier (BT-63) or the buyer VAT identifier (BT-48).
- [BR-O-05](https://attestwire.com/rules/BR-O-05): A line uses VAT category O (not subject to VAT), so it must not carry an invoiced item VAT rate (BT-152) at all — not even 0.
- [BR-S-02](https://attestwire.com/rules/BR-S-02): A line uses VAT category S (Standard rated), so the invoice must carry the seller VAT identifier (BT-31), the seller tax registration identifier (BT-32), or a seller tax representative (BG-11).
- [BR-S-05](https://attestwire.com/rules/BR-S-05): A line uses VAT category S (standard rated), so the invoiced item VAT rate (BT-152) must be greater than zero, but it is 0.
- [BR-Z-02](https://attestwire.com/rules/BR-Z-02): A line uses VAT category Z (Zero rated), so the invoice must carry the seller VAT identifier (BT-31), the seller tax registration identifier (BT-32), or a seller tax representative (BG-11).
- [BR-Z-05](https://attestwire.com/rules/BR-Z-05): A line uses VAT category Z (Zero rated), so the invoiced item VAT rate (BT-152) must be 0, but it is 19.
- [BR-CO-10](https://attestwire.com/rules/BR-CO-10): BR-CO-10 requires the sum of invoice line net amounts (BT-106) to equal Σ BT-131.
- [BR-CO-13](https://attestwire.com/rules/BR-CO-13): BR-CO-13 requires the invoice total without VAT (BT-109) to equal Σ BT-131 − document allowances (BT-107) + document charges (BT-108).
- [BR-CO-14](https://attestwire.com/rules/BR-CO-14): BR-CO-14 requires the invoice total VAT amount (BT-110) to equal Σ VAT category tax amounts (BT-117).
- [BR-CO-15](https://attestwire.com/rules/BR-CO-15): BR-CO-15 requires the invoice total with VAT (BT-112) to equal BT-109 + BT-110.
- [BR-CO-16](https://attestwire.com/rules/BR-CO-16): BR-CO-16 requires the amount due for payment (BT-115) to equal BT-112 − paid amount (BT-113) + rounding amount (BT-114).
- [BR-CO-26](https://attestwire.com/rules/BR-CO-26): In order for the buyer to automatically identify you, the invoice must carry at least one of the seller identifier (BT-29), seller legal registration identifier (BT-30) or seller VAT identifier (BT-31).
- [BR-DE-1](https://attestwire.com/rules/BR-DE-1): XRechnung requires payment instructions (BG-16) with a payment means type code (BT-81).
- [BR-DE-2](https://attestwire.com/rules/BR-DE-2): XRechnung requires the seller contact group (BG-6), and requires it complete: contact point (BT-41), telephone number (BT-42) and email address (BT-43) are each individually mandatory under BR-DE-5, BR-DE-6 and BR-DE-7.
- [BR-DE-3](https://attestwire.com/rules/BR-DE-3): XRechnung requires the element "Seller city" (BT-37).
- [BR-DE-4](https://attestwire.com/rules/BR-DE-4): XRechnung requires the element "Seller post code" (BT-38).
- [BR-DE-5](https://attestwire.com/rules/BR-DE-5): XRechnung requires the element "Seller contact point" (BT-41).
- [BR-DE-6](https://attestwire.com/rules/BR-DE-6): XRechnung requires the element "Seller contact telephone number" (BT-42).
- [BR-DE-7](https://attestwire.com/rules/BR-DE-7): XRechnung requires the element "Seller contact email address" (BT-43).
- [BR-DE-8](https://attestwire.com/rules/BR-DE-8): XRechnung requires the element "Buyer city" (BT-52).
- [BR-DE-9](https://attestwire.com/rules/BR-DE-9): XRechnung requires the element "Buyer post code" (BT-53).
- [BR-DE-16](https://attestwire.com/rules/BR-DE-16): XRechnung requires that, when the tax codes S, Z, E, AE, K, G, L or M are used, at least one of the seller VAT identifier (BT-31), the seller tax registration identifier (BT-32) or a seller tax representative party (BG-11) is present.
- [BR-DE-17](https://attestwire.com/rules/BR-DE-17): XRechnung restricts the invoice type code (BT-3) to 326, 380, 381, 384, 389, 875, 876 and 877 from UNTDID 1001, but "999" was supplied.
- [BR-DE-27](https://attestwire.com/rules/BR-DE-27): The seller contact telephone number (BT-42) should contain at least three digits, but "call us" contains 0.
- [BR-DE-28](https://attestwire.com/rules/BR-DE-28): The seller contact email address (BT-43) must contain exactly one "@", flanked by at least two characters on each side and by neither a space nor a dot, and must not begin or end with a dot.
- [PEPPOL-EN16931-R010](https://attestwire.com/rules/PEPPOL-EN16931-R010): The buyer electronic address (BT-49) must be provided.
- [PEPPOL-EN16931-R020](https://attestwire.com/rules/PEPPOL-EN16931-R020): The seller electronic address (BT-34) must be provided.

## Retired rule identifiers

The library once emitted these and no longer does. The pages stay so old links
resolve. Do not describe them as current behaviour.

- [BR-01](https://attestwire.com/rules/BR-01): An early build of the library emitted BR-01 for a missing invoice number. That is BR-02 in EN 16931; BR-01 is the specification identifier (BT-24). This page exists so the old URL still resolves.

## Tools

- [French E-Invoicing Checker](https://check.attestwire.com): look up a French company and check its registration in the official DGFiP e-invoicing directory, in English. Live.
- [Is VIES Down?](https://vies.attestwire.com): live availability monitor for the EU VAT number validation service — 28 member state endpoints, polled every 5 minutes, per-country uptime, latency and error breakdown, free SVG badges, open JSON API. It monitors VIES; it does not validate VAT numbers on your behalf.

## Optional

- [llms-full.txt](https://attestwire.com/llms-full.txt): the entire rule reference as markdown — official rule text, payloads, examples and divergence notes.