Launch

Time tracking (control horario) — 2026-07-11

Factuarea now covers the Spanish employer's duty to keep a daily working-time record — RD-ley 8/2019, art. 34.9 of the Workers' Statute — and exposes the whole workforce system over the same v1 contract. It is the VeriFactu of attendance: an append-only ledger sealed by a per-company SHA-256 hash chain, where nothing is ever edited or deleted and any tampering breaks the chain. The whole surface is gated by the new control_horario module. Start with the Time tracking overview.

• Eight new domains — employees (with invitations and per-seat billing), work schedules, time entries (clock in/out, pauses, retroactive entries and corrections), monthly register closes, payroll exports, absences (types, policies, requests, balances and calendar), presence, and public holidays.
• New scopes — a dedicated set in the closed catalog: employees:*, time_entries:*, work_schedules:*, absences:*, presence:read, holidays:read and payroll_exports:read, all behind the control_horario module. See Scopes & irreversibility.
• Sealed monthly close — freeze a finished month, then seal it with a detached RSA-SHA256 signature over the snapshot; the seal is irreversible (one per close) and independently verifiable. Export the daily record in the rdley_8_2019 format, or a payroll incidents file for A3, Sage or NominaSOL. See Monthly time-record close.
• Portal-only employee role — an employee clocks in, follows a schedule and requests absences from the portal, and never counts against the plan users limit.
• Per-seat add-on — employees are billed through a dedicated monthly employee-seats subscription whose quantity follows your active roster; contracting it activates the module. An enterprise account billed by contract gets it for free. See Employee seat billing.
• MCP parity — every v1 route mirrors a public MCP tool, so an agent drives the same operations. See the MCP tools catalog.

API and MCP included in every plan — 2026-07-04

The public API and the MCP server are no longer sold as a separate developer_api add-on — they are now included in every Factuarea plan:

• Tier per plan — your rate-limit tier is derived from your plan: Emprendedor → starter (30 req/min, 5,000 req/month), Empresario → pro (300 req/min, 50,000 req/month), Enterprise → scale (custom, no caps). See Rate limits.
• Trial included — during the 10-day trial you get API access on the free tier (10 req/min, 100 req/month).
• Capacity boost — if you need more capacity without changing plans, subscribe from the dashboard to a tier strictly higher than the one your plan grants; a tier equal to or lower returns 422 boost_not_applicable. See Capacity boost.
• The add-on is gone — the Starter and Pro developer add-ons are no longer sold. The addon_not_active error code stays (it now means the company has no active plan that includes API access), so existing integrations need no change.
• Beta program closed — API access no longer requires a request: create a key from Dashboard → Developers → API Keys and start calling /v1.

For the first time you can integrate Factuarea with any external system — by code, by SDK, by command line or by AI agent — without scraping or macros. The public surface is one contract at https://api.factuarea.com/v1, reachable four ways: the REST API, the TypeScript and PHP SDKs, the factuarea CLI, and the MCP server. Each surface talks to the same resources and enforces the same scopes.

REST API v1

The public REST API exposes 413 operations across 37 resources as plain JSON over HTTPS. Every resource is identified by an opaque id (a UUID v7 string).

Sales documents

• Invoices (/v1/invoices) — full CRUD and the complete lifecycle: send, mark paid, void, annul, duplicate, PDF and public link, payments and receipts, reminders. Corrective invoices (rectificativas) with the R1–R5 correction reason codes, simplified-invoice eligibility and substitution, scheduled issuing (schedule / reschedule / unschedule), and quarterly export (ZIP and email). Bulk create, send, status change, delete and PDF, plus Excel export.
• Quotes (/v1/quotes) — CRUD + accept, reject, convert to invoice, PDF, public link.
• Pro-forma invoices (/v1/proformas) — CRUD + convert to invoice, PDF, public link.
• Delivery notes (/v1/delivery_notes) — CRUD + sign, mark delivered, convert to invoice.
• Recurring invoices (/v1/recurring_invoices) — CRUD + activate, pause, resume, cancel and preview the next occurrence.

Purchases

• Purchase invoices (/v1/purchase_invoices) — CRUD with PDF attachment, mark paid, payment registration, and pending / overdue reporting.

CRM and catalog

• Clients (/v1/clients) — full CRUD, search by tax ID (NIF/CIF), AEAT census and VIES verification, and CSV import with a downloadable template.
• Suppliers (/v1/suppliers) — full CRUD, search by tax ID.
• Products (/v1/products) — CRUD, lookup by SKU or external id, stock control (set, adjust and bulk update), low-stock report, sales analytics, and gallery images and video.
• Document series (/v1/series) — legal numbering series per document type, with monthly / annual reset, default selection and archive / unarchive.
• Taxes (/v1/taxes) — tax rates (IVA, IRPF retention, equivalence surcharge) with per-document defaults.

Spanish tax compliance

• VeriFactu (/v1/verifactu/*, /v1/invoices/{invoice}/verifactu) — billing records, the SIF hash chain and its validation, subsanación (correction records), the declaración responsable and its history, and FNMT certificate management.
• FacturaE / FACe (/v1/invoices/{invoice}/facturae, /v1/face-submissions) — FacturaE 3.2.2 XML download and B2G submissions to public administrations via FACe (submit, track, cancel).
• AEAT census (/v1/account/census-verification, /v1/clients/*) — verify a NIF/CIF against the AEAT registry.
• Tax reports (/v1/tax_reports/*) — generate, preview, download and keep history of Modelo 303 (VAT), 347 (annual operations with third parties) and 130 (IRPF instalment).

Payments

• Stripe auto-invoicing (/v1/stripe-autoinvoicing/*) — connect Stripe accounts and issue invoices automatically from Stripe payments, including automatic corrective invoices on refunds.
• Payouts and reconciliation (/v1/payouts, /v1/connected-accounts) — read Stripe payouts and reconcile settlements, with Norma 43 bank-statement support.

Managed companies (gestorías)

• Companies (/v1/companies) — provision and run child companies from a master account: create, activate, deactivate, track creation status, and issue per-company API keys (create, rotate, revoke). Preview seat billing before you commit with /v1/companies/seat-charge-preview. Operate on a child's behalf on a single request with the X-Active-Profile header.

Webhooks and events

• Webhooks (/v1/webhook_endpoints with nested deliveries) — subscribable endpoints signed with HMAC SHA256, dual-secret rotation, ping / test, and a delivery history you can replay.
• Events (/v1/events, /v1/event-catalog) — the historical event stream and the catalog of subscribable event types.

Account

• Account (/v1/account) — introspect the authenticated credential (company, plan, scopes and rate-limit tier), manage API keys, personalize document templates, and run your own census verification.

API foundations

Behaviour every resource shares, so an integration learns it once:

• Test mode — fact_test_* keys run against an isolated sandbox company; external effects (VeriFactu/AEAT, FACe, email, webhooks) are not executed, so you build and test without touching production data.
• Opaque identifiers — every resource exposes an id whose value is a UUID v7, with foreign keys as *_id.
• Cursor pagination — starting_after / ending_before, no ?page=.
• Idempotency — the Idempotency-Key header (max 64 chars, 24h TTL); a replay returns the original stored response — including a cached 4xx — marked with Idempotent-Replayed.
• Rate limits — per-tier per-minute and monthly quotas with X-RateLimit-* headers.
• Normalized errors — the { error: { type, code, message, param, request_id, doc_url } } envelope; validation errors point at the offending field through param. Branch on code, never on the human-facing message.
• Bulk operations — batch endpoints report partial success per item, so one bad row doesn't fail the whole request.
• Import and export — CSV client import (with a downloadable template) and Excel invoice export.
• Signed webhooks — HMAC SHA256 with ±5min tolerance and exponential retries up to 8 attempts.
• Scopes — a closed resource:action catalog; every operation you can't reach is hidden, and destructive write / delete scopes are flagged as sensitive on the OAuth consent screen and never pre-checked.
• Versioning — the URL prefix /v1 plus a pinned Factuarea-Version header. /v1 stays stable for at least 24 months; any breaking change lives in /v2 with a coexistence window of at least 12 months.

Official SDKs — TypeScript & PHP

Maintained SDKs wrap the full v1 REST API with a premium runtime, so you don't hand-roll HTTP. See the SDKs section.

• TypeScript / Node.js — @factuarea/sdk on npm. Dual ESM + CommonJS, full type declarations, Node 20+ (and Deno / Bun / Workers). Source: github.com/factuarea/factuarea-node.
• PHP — factuarea/factuarea-php on Packagist. PSR-4, Guzzle-based, PHP 8.2+. Source: github.com/factuarea/factuarea-php.

npm install @factuarea/sdk
composer require factuarea/factuarea-php

Both share the same runtime: automatic retries (with backoff, honouring Retry-After), automatic idempotency keys, cursor auto-pagination, a typed error hierarchy, constant-time webhook verification, and binary (PDF) downloads. Every page in the API reference shows a ready-to-copy TypeScript, PHP and cURL snippet. Each release pins one Factuarea-Version and sends it on every request.

Command-line interface

The official factuarea CLI (v0.1.3) drives the full v1 surface from your terminal. It is agent-first — stable JSON output, semantic exit codes and one-call discovery — and the command tree is generated from the OpenAPI spec, so it never drifts from the live surface.

• One key, two environments — the key prefix selects the environment; a fact_live_ mutation also requires the explicit --live flag as a safety net.
• Devloop — listen forwards events to your machine and trigger produces real sandbox events, so you test webhooks locally with no tunnel or ngrok.
• Install — Homebrew, npm or a curl installer. See the CLI.

MCP server for AI agents

The MCP server at https://mcp.factuarea.com exposes the public API as 391 Model Context Protocol tools over the Streamable HTTP transport, so AI agents (Claude and others) discover and call them without you wiring each endpoint.

• Two auth channels — an API key (fact_live_ / fact_test_) for the account owner (up to all 391 tools), or OAuth 2.1 for third-party apps (a curated 305-tool catalog). See Connecting a client.
• Full OAuth 2.1 — Dynamic Client Registration (RFC 7591), PKCE (S256), a consent screen with company and environment selection, refresh-token rotation with reuse detection, plus revocation and introspection.
• Scope-governed — every tool enforces a fine-grained scope; tools you can't reach are hidden from tools/list. See Scopes & permissions.
• v1-faithful errors — JSON-RPC errors preserve the same code and http_status as the REST API. See Errors & rate limits.
• Claude Code — the official factuarea-mcp plugin connects in two commands.
• Test mode — drive everything against the isolated sandbox. See Test mode.

Start in test mode

The golden rule across all four surfaces: start in test mode. Build against a fact_test_ key (or an OAuth consent with the Test environment), then switch to fact_live_ — no code changes. Welcome to the integrations era in Factuarea.