attestwireStart free. Pay when you need more documents.
free is free. The paid plans buy more documents, and an unwatermarked PDF.
The hosted API checks invoice data or creates an e-invoice file from your software. The free plan includes 100 documents a month, with no card. What counts as a document.
Choose a monthly allowance
Free
€0
No card, no expiry
100 documents a month
Build the integration and run real development traffic.
Enough to wire the integration up and run a real month of a side project.
Solo
€9/mo
Monthly billing only
1,000 documents a month
For a single integration or a low-volume project ready to go live.
1,000 docs ≈ a solo consultant or small studio invoicing every client, every month.
Starter
€29/mo
or €290/yr billed annually, two months free
5,000 documents a month
For small production integrations and early customer rollouts.
5,000 docs ≈ monthly invoicing for ~160 SMB customers.
Scale
€99/mo
or €990/yr billed annually, two months free
50,000 documents a month
For established billing products and higher-volume workflows.
50,000 docs ≈ a mid-size billing platform issuing ~1,600 invoices a day.
The hosted API checks invoice data and generates EN 16931, XRechnung and Peppol BIS 3 XML. It accepts JSON, UBL/CII XML or a Factur-X PDF and reports the rule, field and suggested correction. The XML it returns is not a Factur-X file; every plan can also generate the Factur-X PDF (a Factur-X / ZUGFeRD PDF, EN 16931 profile), watermarked as a preview on the free plan and, on the Solo, Starter, and Scale plans, without it.
It does not send invoices through Peppol or a French platform; on request, it can e-mail one to the recipient you name. Country-specific Peppol rules may require additional checks. See all limits.
New to Attestwire? Start free.
Your key appears on this page the moment you submit. No inbox visit, no confirmation link.
Or create it from your terminal: the same call, one curl
curl -sX POST https://api.attestwire.com/v1/keys \
-H content-type:application/json \
-d '{"email":"you@example.com"}'Store this key now. It is shown once and cannot be recovered. We keep only its SHA-256 hash.
The curl, Node.js, Python and PHP snippets post a conformant
en16931 invoice with your key
already in it, so your first call answers
valid: true. Each validation spends one of the
100 documents your free key gets each month,
including the teaching example below.
Or run one deliberate error instead
An XRechnung invoice with its buyer reference removed. The
response is valid: false with exactly one
BR-DE-15 finding, naming the rule,
the business term and the fix. It costs a document like any other
call.
Already have a key? Upgrade.
Same key, same integration. Just a bigger allowance.
Or from your terminal
curl -X POST \
https://api.attestwire.com/v1/billing/checkout \
-H 'content-type: application/json' \
-d '{"key":"YOUR_API_KEY","plan":"starter"}'The link is single-use. Full flow, with every error code: api.attestwire.com/docs#upgrade.
Try the API before you create a key
The hosted API has a public demo key, demo. Paste this
into a terminal: it validates a small invoice and answers
"valid": true.
curl -X POST https://api.attestwire.com/v1/validate \
-H "authorization: Bearer demo" \
-H 'content-type: application/json' \
-d '{"profile": "en16931", "invoiceNumber": "DEMO-1", "issueDate": "2026-09-26", "currency": "EUR",
"seller": {"name":"Demo GmbH","vatId":"DE123456789","address":{"city":"Berlin","postalCode":"10115","countryCode":"DE"}},
"buyer": {"name":"Kunde AG","address":{"city":"Koeln","postalCode":"50667","countryCode":"DE"}},
"lines": [{"id":"1","description":"Consulting","quantity":2,"unitCode":"HUR","unitPrice":100,"vatCategory":"S","vatRate":19}]}'The demo key belongs to nobody and is limited per IP address: 6 requests a minute and 30 documents a UTC day, shared across POST /v1/validate, POST /v1/generate and POST /v1/recipient; every other route refuses it.
Only fixing one rejected invoice?
The Invoice Fix Report costs €99 once. You get a signed validation record, guidance for each finding, 30 days of Starter API access and a reply from a person within one business day. Start with the free check; it may be all you need.
What counts
One successful POST /v1/validate,
POST /v1/parse or POST /v1/generate is one document, whatever its size: we
count calls, not findings. A refusal does not consume one. Quotas are per
key and reset at 00:00 UTC on the 1st, with no rollover. Keys, usage and
health calls are free, and the library is not metered at all.
Questions before you choose
Who answers when something breaks?
Ben, in California, at hello@attestwire.com. Two business days is the target on every plan. A paid plan buys a larger allowance; support is the same on every plan, and there is no support SLA on any plan.
Is Free a trial?
No. No expiry date, no card on file, and the allowance resets each month.
What happens at the limit?
The API returns 429 with quota_exceeded, and
a refused call does not consume a document. We do not bill overage.
Can I cancel?
Yes, in the billing portal. Cancellation takes effect at the end of the period you have already paid for, then your key returns to Free, and we would rather refund a month than argue about one. See the terms and refund policy.
Are invoices stored?
No. They are processed in memory and returned to you. See security. An Article 28 DPA is available.
Does Attestwire transmit invoices?
Only by e-mail, one recipient at a time, when you ask for it — German B2B accepts plain e-mail as an invoice channel. It is otherwise not connected to any delivery network: it is not a Peppol access point, a French PDP (certified sending platform) or a KSeF (Polish national system) connection.
A valid: true result is a technical
check, and a receiver may still refuse the invoice.
Read the terms or
see the boundary.
Need more than 50,000 documents a month?
Email hello@attestwire.com for OEM or volume pricing. The price depends on the integration.
The operational ceilings, if you are sizing retry logic
Four limits apply to a key in use and one applies to getting a key.
Each returns its own error code, so none of them is reported as
quota_exceeded. /v1/validate and
/v1/generate are paced at
10 requests per second
per key, with a bucket that lets a burst of
20 through.
Going over is
429 with rate_limited and a
Retry-After header, and nothing is charged: a paced
refusal leaves your monthly allowance untouched and the same request
works a second later. The two codes are kept separate because the
waits differ: a rate limit clears in about a second, a quota clears
next month.
Any request body over 1 MB is
refused with 413 and payload_too_large, and
on this API that is the ceiling you meet first, for a JSON invoice
object and for a file alike. The reader has a second one underneath
it, 8,000,000
characters, reported as xml_too_large; you will
only reach that one running the library yourself, where there is no
body ceiling above it.
A thousand-line invoice is nowhere near either. A base64-embedded attachment is what gets you there: base64 spends four characters per three bytes, so a PDF of about 750 kB fills the request body on its own. Send the invoice without the attachment.
A findings array is capped at
500 entries per
severity; past that the response gains a
findings_truncated object, and valid still
reflects the whole document. No realistic invoice reaches that. Key
creation is limited to five requests
per IP address per UTC day, answered with 429 and
too_many_requests; it is the only limit on getting one.
The demo key is for a first try; test your own integration with a free key. Rotation, body-size handling and every error code are in the API reference.
Reference for developers: library or API, what the hosted API adds, and your key
Should you use the library or the API?
| Use the library when… | Use the API when… |
|---|---|
| Your application runs JavaScript or TypeScript | Your application uses another language |
| You want processing to stay entirely local | You want a managed endpoint |
| You prefer to control when the rule set changes | You want the deployed rule set without package upgrades |
| You do not need centralised usage | You need one shared service across several systems |
Both use the same engine. The MIT library is free at any volume and has zero runtime dependencies. Pinning a library version also pins its rules, which keeps CI stable but makes upgrades your responsibility. The hosted API uses the version we have deployed. Read about rule updates.
Why the hosted API
The hosted API adds three things:
-
The current rule set, named in every response.
Each metered response includes a
provenanceblock with the engine version, rule set and profile. To check the deployment,GET /v1/versionsis free and needs no authentication. - Tracked source updates. The tracked-artefact table lists each upstream source, its version, its release date and our latest check.
- No Java and no toolchain. Call the API over HTTPS from the tools you already use.
After you have a key
Then send your first invoice: how authentication works, and the full API reference.
If your key is exposed or lost
While you still hold the key you can replace it yourself with POST /v1/keys/rotate. You authenticate the call with the key you are replacing, your plan and usage carry over, and the old key stops working at once. That key is the entire credential, so anyone else who has a copy can rotate it away from you on the same terms.
If you think it has been exposed, rotate first and investigate afterwards. If it is lost, what we can do depends on what we can prove: the three cases are set out here.
Prices are in euros, billed in advance through Paddle, our merchant of record, monthly or annually as you chose. Paddle adds any sales tax or VAT due where you are. On an annual plan the allowance is still the monthly one, reset on the 1st as usual: you pay for the year, and the documents are counted month by month.
Thirty days' notice before any price increase. See the terms, refund policy, privacy and DPA.