FBR Digital Invoicing API Integration for ERP, POS & Accounting Software

How FBR's Digital Invoicing API works

PRAL (Pakistan Revenue Automation Limited), FBR's IT company, operates the Digital Invoicing (DI) API on FBR's API gateway. It is a JSON-over-HTTPS API with two core real-time operations: one to validate an invoice and one to post it. A successful post returns the FBR invoice number that must be printed on the invoice.

Access is controlled by a Bearer security token issued to your business through FBR's portal after you request digital-invoicing integration in IRIS. PRAL's specification states the token is valid for five years, and that the URLs are shared between sandbox and production — routing depends on the token you use.

Core endpoints

All paths are on https://gw.fbr.gov.pk. Requests carry Authorization: Bearer <token> and a JSON body. PRAL also publishes reference-data APIs — provinces, document types, HS codes, units of measure, sale types and applicable rates, SRO schedules and items — which your system should use to populate and validate fields. Always build against the latest PRAL technical documentation, as versions change.

What the invoice payload contains

Each request describes one invoice: header fields for the seller, buyer and document, plus an array of line items.

{
  "invoiceType": "Sale Invoice",
  "invoiceDate": "2026-09-26",
  "sellerNTNCNIC": "1234567",
  "sellerBusinessName": "Example Traders (Pvt) Ltd",
  "sellerProvince": "Punjab",
  "sellerAddress": "Lahore",
  "buyerNTNCNIC": "7654321",
  "buyerBusinessName": "Buyer Enterprises",
  "buyerProvince": "Sindh",
  "buyerAddress": "Karachi",
  "buyerRegistrationType": "Registered",
  "invoiceRefNo": "",
  "items": [
    {
      "hsCode": "0000.0000",
      "productDescription": "Example product",
      "rate": "18%",
      "uoM": "Numbers, pieces, units",
      "quantity": 10,
      "valueSalesExcludingST": 10000,
      "salesTaxApplicable": 1800,
      "saleType": "Goods at standard rate (default)"
    }
  ]
}

A successful response includes the FBR invoice number and a validation status for the invoice and each item. Store both against your internal invoice so you can print the QR code and reconcile later.

Sandbox testing and going live

1. 1

   Request integration in IRIS

   Choose your licensed integrator, declare your business activity and sector, and provide the public IP address of the server that will call the API. Registration steps.

2. 2

   Receive a sandbox token

   Use it against the _sb endpoints. Nothing you post in sandbox is a real invoice.

3. 3

   Pass the test scenarios

   PRAL defines numbered test scenarios (SN001 onwards) — standard-rate goods, third-schedule goods, reduced-rate, exempt and zero-rated supplies, debit notes and more. The scenarios you must pass depend on your business activity and sector.

4. 4

   Obtain the production token

   Once scenarios pass, switch to the production token and endpoints, issue a first live invoice and verify its QR code with FBR's Tax Asaan app.

Build it yourself or connect through DInvoice?

How integration through DInvoice works

DInvoice sits between your system and FBR. Your ERP, POS or accounting software sends invoices to DInvoice's secure REST API; DInvoice validates them, submits them to FBR through PRAL's Digital Invoicing API, and returns the FBR invoice number and QR code to your system. Any software that can make an HTTPS request with JSON — including custom and in-house systems — can connect.

1. 1

   Onboarding

   We review your invoicing flow, products and buyers, and help you complete the FBR registration steps.

2. 2

   Map your data

   Your item codes are mapped to HS codes and units of measure once, so every invoice goes out in the right format.

3. 3

   Connect

   Your system calls DInvoice's API — or your team uses the DInvoice web app for manual invoices.

4. 4

   Go live

   Invoices flow to FBR in real time; FBR invoice numbers and QR codes come back automatically.

Engineering best practices

• Validate before you post. Call the validate operation (or validate locally against reference data) to catch HS-code, UoM and rate mismatches early.
• Make submissions idempotent. Keep your own unique invoice reference so a retry never creates a duplicate invoice.
• Queue and retry. Treat network errors and 5xx responses as transient — queue the invoice and retry with backoff; treat validation errors as data problems to fix.
• Protect the token. Store it encrypted, never log it, and restrict which servers can use it.
• Log every call. Keep request/response pairs for audits and reconciliation against your Annexure-C.
• Respect the correction window. Invoices issued by bona fide mistake can be cancelled or edited only within 72 hours; later changes need the Commissioner's approval.

Frequently asked questions

Sources

1. PRAL — Technical Documentation for DI API v1.12 (PDF)
2. FBR — Digital Invoicing FAQs
3. FBR — List of Licensed Digital Invoicing Integrators
4. FBR — Digital Invoicing Technical Assistance
5. FBR IRIS portal

Published by DInvoice (Digital Invoice Integrator), FBR digital invoicing software for Pakistan. This page is general information, not legal or tax advice; rules and penalty amounts change, so confirm current requirements with FBR or your tax advisor. Last reviewed 26 September 2026.