ZATCA Phase 2 Integration with Odoo: Why Do Some Companies Fail?

ZATCA enforces strict technical standards across all accounting systems:

• Direct, encrypted API integration with the Fatoora platform using Cryptographic Stamp Identifiers (CSID).
• Generating invoices in standard UBL 2.1 XML formats alongside PDF/A-3 files with embedded XML payloads.
• Generating a Universally Unique Identifier (UUID) for each invoice, paired with precise timestamps, cryptographic stamps, and tamper-proof sequential hash chains.
• Maintaining an immutable audit trail that prevents modifying or deleting posted invoices while archiving official clearance responses.

1. Saudi Localization Modules

Odoo does not support Saudi e-invoicing out of the box without configuration. It requires installing and setting up dedicated localization modules: l10n_sa, l10n_sa_edi, and related point-of-sale packages.

These packages add mandatory fields such as VAT numbers, commercial registration records, and national addresses, calibrate tax calculation logic, and automatically generate compliant XML files once a journal entry is posted.

Because regulatory specifications update periodically, relying on e-invoicing packages in Odoo Enterprise compared to the Community edition becomes a decisive advantage, ensuring ongoing compliance updates with ZATCA rules while the free edition remains static.​

2. Steps to Connect Odoo with the Fatoora Portal via API

The onboarding process follows three mandatory steps:

Step One: Registering the technical solution on the Fatoora portal, generating a one-time password (OTP), and acquiring the compliance Cryptographic Stamp Identifier (CSID) alongside its security keys.

Step Two: Entering all integration parameters inside Odoo Accounting settings: portal API endpoints, security certificates, and device identifiers.

Step Three: Linking customer invoice journals and POS registers to authorized onboarding devices, initiating live transmission with real-time portal synchronization.

3. Cryptographic Invoice Generation Mechanism Inside Odoo

Once an invoice is posted, the system executes several background processes that form the technical core of compliance: generating a compliant XML payload, affixing digital signatures and sequential hash chains to prevent tampering, producing embedded PDF/A-3 files, and rendering encrypted QR codes with all statutory fields.

The final invoice is not just a standard PDF, but an audit-ready, multi-layered digital document.

1. B2B Standard Tax Invoices

• The accountant drafts the corporate tax invoice in Odoo, verifying buyer details and VAT registration numbers.
• Upon posting, the system generates an XML file and immediately transmits it via API to the Fatoora portal.
• The portal validates the invoice structure, returning a Cleared status with an official cryptographic stamp, or a rejection notification detailing specific errors.
• Odoo logs the clearance status, UUID, and ZATCA response on the invoice form, validating the document legally so it can be printed with the updated QR code for customer delivery.

2. B2C Simplified Tax Invoices

For simplified invoices issued to consumers and retail shoppers, receipts are generated directly from Odoo or point-of-sale terminals, printing encrypted QR codes and handing the slip to the customer immediately.

This workflow aligns with mechanisms for issuing simplified invoices and generating encrypted QR codes in point of sale to report sales transactions to the Fatoora portal in real time or within the mandatory 24-hour window, ensuring continuous checkout operations without interrupting the customer experience.​

• Upgrading System Versions: Ensuring you run supported Odoo releases equipped with active Saudi EDI modules.
• Verifying Master Data: Registering commercial registration numbers, VAT IDs, and national addresses accurately to match official government certificates.
• Testing in the Sandbox Environment: Validating your billing cycle within ZATCA's simulated Sandbox mode is a vital milestone before live deployment. This procedure helps in​ inspecting invoice rejection errors and hash generation in test environments to verify XML schema compliance, validate CSID certificates, and generate cryptographic stamps without technical conflicts that could lead to non-compliance penalties during live operations.
• Restricting Access Rights and Audit Logs: Documenting user actions, prohibiting direct modifications to posted entries, and enforcing formal debit and credit note workflows.
• Ensuring Infrastructure Stability: Maintaining dependable internet connectivity and reliable cloud hosting on platforms like Odoo.sh to ensure continuous integration and rapid transmission.

A frequent question asked by financial managers is: Why not rely on a standalone billing application instead of deploying a full ERP platform?

The answer lies in daily operations. Standalone billing software requires re-entering transaction details from sales systems, creating a major source of errors and wasted time. Inside Odoo, the invoice originates directly from the sales quotation or order, inventory updates automatically, and the corresponding journal entry is posted simultaneously.

Furthermore, VAT returns are compiled directly within Odoo without pulling data across scattered platforms, while the status of every invoice (submitted, cleared, or rejected) is tracked within the system without juggling multiple tools.

Everything related to the transaction stays in one central hub: PDF documents, XML files, QR codes, ZATCA clearance logs, and internal notes, cutting tax audit preparation from weeks to hours.