BIR EIS API documentation

{
  "CompInvoiceId": "SI-000123",
  "IssueDtm": "20261007",
  "EisUniqueId": "20261007A1B2C3D40000012F",
  "DocType": "SI",
  "TransClass": "VT",
  "CorrYN": "N", "CorrectionCd": null, "PrevUniqueId": null, "Rmk1": "",
  "SellerInfo": {
    "Tin": "123456789", "BranchCd": "00000", "Type": "V",
    "RegNm": "Sample Trading Corp.", "BusinessNm": "Sample Trading",
    "Email": "billing@sample.ph", "RegAddr": "123 Ayala Ave, Makati City"
  },
  "BuyerInfo": {
    "Tin": "987654321", "BranchCd": "00000",
    "RegNm": "Example Retail Inc.", "BusinessNm": "Example Retail",
    "Email": "ap@example.ph", "RegAddr": "45 Ortigas Ave, Pasig City", "DevAddr": "",
    "AirNum": "", "AirNumDt": "", "LadNum": "", "LadNumDt": ""
  },
  "ItemList": [
    { "Nm": "Thermal paper roll 80mm", "Desc": "Box of 50", "Qty": 100, "Unit": "box",
      "UnitCost": 25.00, "SalesAmt": 2500.00, "RegDscntAmt": 0.00, "SpeDscntAmt": 0.00, "NetSales": 2500.00 },
    { "Nm": "Receipt printer", "Desc": "USB/LAN", "Qty": 2, "Unit": "pc",
      "UnitCost": 4750.00, "SalesAmt": 9500.00, "RegDscntAmt": 0.00, "SpeDscntAmt": 0.00, "NetSales": 9500.00 }
  ],
  "TotNetItemSales": 12000.00,
  "Discount": { "ScAmt": 0.00, "PwdAmt": 0.00, "RegAmt": 0.00, "SpeAmt": 0.00, "Rmk2": "" },
  "OtherTaxRev": 0.00,
  "TotNetSalesAftDisct": 12000.00,
  "VATAmt": 1440.00,
  "WithholdIncome": 120.00, "WithholdBusVAT": 0.00, "WithholdBusPT": 0.00,
  "OtherNonTaxCharge": 0.00,
  "NetAmtPay": 13320.00,
  "ForCur": { "Currency": "PHP", "ConvRate": 1.00, "ForexAmt": 0.00 },
  "PtuNum": ""
}

// npm i jose · Algorithms, AES mode and the HMAC string-to-sign are placeholders:
// take the exact values from the official EIS API Guide.
import { CompactSign, importPKCS8 } from 'jose';
import crypto from 'node:crypto';

// 1) Login body, RSA-encrypted with the BIR public key (auth call only)
const sessionKey = crypto.randomBytes(32);
const loginData = crypto.publicEncrypt(
  { key: BIR_PUBLIC_KEY_PEM, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: 'sha256' },
  Buffer.from(JSON.stringify({ userId, password, sessionKey: sessionKey.toString('base64'), forceRefreshToken: false }))
).toString('base64');

// 2) Sign each invoice as a JWS with your private signing key
const signingKey = await importPKCS8(process.env.EIS_SIGNING_KEY, 'RS256');
const jws = await new CompactSign(new TextEncoder().encode(JSON.stringify(invoice)))
  .setProtectedHeader({ alg: 'RS256' })
  .sign(signingKey);

// 3) Encrypt the batch with the session key
function aesEncrypt(key, text) {
  const iv = crypto.randomBytes(16);
  const c = crypto.createCipheriv('aes-256-cbc', key, iv);
  return Buffer.concat([iv, c.update(text, 'utf8'), c.final()]).toString('base64');
}
const body = { submitId, data: aesEncrypt(sessionKey, JSON.stringify([jws])) };

// 4) HMAC-SHA256 Authorization header, keyed with the Application Key
const datetime = new Date().toISOString();
const toSign = [accreditationId, applicationId, datetime, JSON.stringify(body)].join('');
const authorization = crypto.createHmac('sha256', APP_KEY).update(toSign).digest('base64');

# pip install python-jose cryptography · placeholders: follow the official API Guide
import os, json, base64, hmac, hashlib, datetime
from jose import jws
from cryptography.hazmat.primitives import hashes, padding as sympad, serialization
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes

session_key = os.urandom(32)

# 1) Login body, RSA-OAEP with the BIR public key
bir_pub = serialization.load_pem_public_key(BIR_PUBLIC_KEY_PEM)
login = json.dumps({"userId": USER, "password": PWD,
                    "sessionKey": base64.b64encode(session_key).decode(), "forceRefreshToken": False})
login_data = base64.b64encode(bir_pub.encrypt(login.encode(),
    padding.OAEP(mgf=padding.MGF1(hashes.SHA256()), algorithm=hashes.SHA256(), label=None))).decode()

# 2) JWS signature
signed = jws.sign(invoice, os.environ["EIS_SIGNING_KEY"], algorithm="RS256")

# 3) AES-256 encryption
def aes_encrypt(key, text):
    iv = os.urandom(16)
    p = sympad.PKCS7(128).padder(); data = p.update(text.encode()) + p.finalize()
    enc = Cipher(algorithms.AES(key), modes.CBC(iv)).encryptor()
    return base64.b64encode(iv + enc.update(data) + enc.finalize()).decode()

body = {"submitId": SUBMIT_ID, "data": aes_encrypt(session_key, json.dumps([signed]))}

# 4) HMAC-SHA256 Authorization header
dt = datetime.datetime.now(datetime.timezone.utc).isoformat()
to_sign = ACCREDITATION_ID + APPLICATION_ID + dt + json.dumps(body)
authorization = base64.b64encode(hmac.new(APP_KEY, to_sign.encode(), hashlib.sha256).digest()).decode()