Skip to main content

Romania — ANAF e-Factura Sandbox Onboarding

Operational guide for getting test credentials at the ANAF e-Factura sandbox.

PropertyValue
AuthorityANAF (Agenția Națională de Administrare Fiscală)
Sandbox base URLhttps://api.anaf.ro/test/FCTEL/rest
CosteIDAS cert ~€50-200/yr (from authorized CA); SPV access free
Time to provision2-4 weeks (eIDAS cert procurement is the long pole)
Identity requiredRomanian CIF (tax number) + qualified eIDAS digital certificate

Steps​

  1. Procure a qualified eIDAS certificate from a Romanian-recognized CA. Common options:
    • CertSign — certsign.ro
    • Trans Sped — transsped.ro
    • DigiSign — digisign.ro
    • AlfaSign — alfasign.ro
  2. Register on SPV (Spațiul Privat Virtual) at anaf.ro using the cert.
  3. Inside SPV, register your application — receive client_id and client_secret.
  4. Authenticate via OAuth2 client_credentials flow. Cert is presented in the front-channel ONCE; refresh tokens carry forward server-side after that.
  5. Validate with a UBL 2.1 + RO_CIUS invoice POST to /upload.

GitHub secrets to set​

RO_ANAF_CIF
RO_ANAF_CLIENT_ID
RO_ANAF_CLIENT_SECRET
RO_ANAF_REFRESH_TOKEN_INITIAL    # bootstrap value; refresh_worker rotates from here

Gotchas​

  • ANAF does not honour client-supplied idempotency keys. Adapter does its own SHA-256 dedup table (per fi-9jn, now Postgres-backed). This is mandatory, not optional.
  • Content-Type: text/plain is the literal ANAF requirement — not a typo. The XML body is sent with text/plain content type. Already in rust/adapters/romania/src/runtime.rs.
  • submission_window is 5 working days, not calendar — uses SubmissionWindow::WorkingDays(5) enum (per fi-uz7). Working days exclude Romanian public holidays.
  • Refresh-token expiry is 90 days. Refresh worker must run more often than that (current implementation does daily refresh).
  • Async finalization: /upload returns index_incarcare; final acceptance via /stareMesaj polling. id_descarcare populated post-acceptance into fiscal_id_upstream.

Non-resident path​

Romanian-recognised CAs (CertSign, Trans Sped, DigiSign, AlfaSign) issue eIDAS certs to non-residents, but they require a Power of Attorney from a Romanian representative. SPV registration also requires the cert plus a Romanian fiscal representative on file.

  • POA + fiscal rep is non-negotiable for direct ANAF interaction. There's no software-vendor track that bypasses this.
  • Cheapest dev path: Romanian accountant or specialist fiscal representative — budget ~€150-400/month plus the eIDAS cert (€50-200/yr). 3-6 weeks to first credentials, given eIDAS verification timelines.
  • Production. Either a Romanian branch or VAT representative for ANAF-direct interactions, or the platform-as-integrator model where merchants hold their own CIF and we integrate against their SPV profile.
  • Research doc: romania.md
  • Adapter crate: rust/adapters/romania/
  • Sandbox tests: rust/adapters/romania/tests/error_paths.rs (already #[ignore]d)