UBL E-Invoice Technical Validator

Validate a UBL 2.1 Invoice or CreditNote before importing it into your accounting or integration pipeline. Receive separate XML/security, XSD, profile and arithmetic findings, JSON/CSV exports and a summary. One document per run.

Technical validation only. A successful result is not Peppol certification, tax-authority acceptance, network delivery or legal approval. Digital signatures and certificates are not verified. Nothing is submitted to a tax system or invoice network.

Supported versions and profiles — release 1.0.0

validationProfile	Schema	Additional checks
UBL-2.1-XSD	OASIS UBL 2.1 final (2013-11-04), Invoice/CreditNote	XML safety and XSD only. No business or monetary conclusion.
EN16931-1.3.17	Same XSD	Official ConnectingEurope EN 16931 UBL artifacts 1.3.17 (2026-10-12), unmodified compiled XSLT with bundled Schematron/code lists.
EN16931-1.3.17+AFK-1.0 (default)	Same XSD	Official EN rules plus separately identified AFK line calculation, positive price-base quantity and currency consistency checks. A selected technical profile, not an official CIUS.

The current OASIS UBL release is 2.5 (2026-08-12); this product deliberately supports only the tested UBL 2.1 binding required by the bundled EN rules. Newer UBL versions and other document types are rejected. Peppol BIS, XRechnung, UBL-TR/GIB, ZATCA, FatturaPA, self-billing and country-specific tax acceptance are not supported. Official EN rules do not contain Peppol/country CIUS rules. Current Peppol documentation was checked; that package is not bundled or executed.

A document may pass EN-only and fail the stricter AFK profile. One official example has a positive quantity and negative line net amount. The original file is preserved: EN-only accepts it; AFK-LINE-01 identifies the inconsistent quantity/price calculation.

Input

Supply exactly one source:

• xmlText: XML as a string. Use file upload for originals with non-UTF-8 declarations.
• xmlFile: one XML uploaded with the Console file picker, or its HTTPS Apify key-value-store record URL. Only https://api.apify.com/v2/key-value-stores/.../records/... is accepted. No arbitrary servers, redirects, compressed files or archives.

Field	Values/default
documentType	auto (default), Invoice, CreditNote; explicit type must match exact root and namespace
schemaVersion	2.1 only
validationProfile	Exact identifier from the profile table
maxFindings	Integer 1–500, default 100. Limits returned findings, never the underlying validity decision. Summary retains full counts and truncation status.

The prefilled runnable example is official EN sample-discount-price.xml, with a price discount and four-decimal net unit price. Clear the prefilled xmlText when uploading a file. An API request must supply one source; empty API input is not silently replaced with a demo invoice.

Validation and arithmetic

1. XML/security: well-formedness, exact namespace, structural limits, forbidden DTD/entities/XInclude/processing instructions.
2. XSD: full locally packaged normative OASIS 2.1 schemas. Invoice-provided schemaLocation never selects/fetches a schema. XSD failure skips profile/arithmetic execution explicitly.
3. Profile: selected official EN assertions, with official rule IDs and source XPath locations from SVRL.
4. Arithmetic: official BR-CO-10–17, tax-category and decimal rules check line-total sums, document allowances/charges, VAT breakdowns, exclusive/inclusive totals, prepayments, payable rounding and payable amount. The pinned official rules and tolerances are used unchanged.
5. Only in +AFK-1.0:
   • AFK-LINE-01: line net equals round(quantity × net PriceAmount / BaseQuantity + line charges − line allowances, 2). BaseQuantity defaults to 1. CreditNote uses CreditedQuantity. Price-level discounts are already reflected in net PriceAmount and are not subtracted twice.
   • AFK-BASE-01: price BaseQuantity greater than zero.
   • AFK-CURRENCY-01: monetary currency matches DocumentCurrencyCode, except a separate declared TaxCurrencyCode tax total.
   • AFK decimal calculations use exact decimal arithmetic and XPath-style rounding, half ties toward positive infinity. Exact cent equality for line totals is a selected AFK rule, not a Peppol tolerance claim.

For common total rules, expected_value and actual_value contain amounts. For other profile rules expected_value contains the official assertion expression; actual_value may be null where no single scalar is unambiguous. XSD-prefixed findings contain native schema diagnostics. A clean XSD-only report means only schema validity.

Outputs

Dataset: one row per returned finding; zero-finding documents get a CHECK-PASSED informational row.

Field	Meaning
document_id	SHA-256-derived document identifier
invoice_number	UBL cbc:ID when safely parsed
validation_layer	xml, security, xsd, profile, arithmetic, configuration, technical or summary
rule_id	XSD diagnostic, official EN rule or AFK-prefixed rule
severity	error, warning or info
field_path	XML/XPath location
message	Explanation
expected_value / actual_value	Amounts/assertion evidence where available; otherwise null
schema_version / ruleset_version	Exact selected versions

Run storage:

• REPORT: complete JSON report and layer status.
• FINDINGS: JSON array.
• FINDINGS-CSV: CSV with stable headers; spreadsheet formula prefixes neutralized with a leading apostrophe. JSON preserves original scalar values.
• SUMMARY: counts, truncation, completion, scope and billing policy.
• DELIVERY-STATE: billing/delivery state; charged is 1/0, or null for an uncertain billing response.
• SOURCE-DISTRIBUTION: source ZIP with program, original rule sources, schemas, licenses and build files.

A technical/retrieval/resource failure has completed=false, billable=false and an explicit failed run. A malformed, XSD-invalid, profile-invalid or security-rejected document can still receive a completed technical report and is chargeable.

Price

$0.015 per completed document validation — $15 per 1,000. Only document-validated, count 1 per completed report. Invalid completed reports have the same price. Findings are not billed individually. No start fee, automatic Dataset-row fee or separately passed-through platform usage fee.

Technical failures, unreachable uploads, unsupported options and resource-limit failures do not trigger a validation charge. REPORT, JSON, CSV, SUMMARY and Dataset delivery are stored before charging. Same-run retries/resurrections do not attempt another charge or append duplicate rows. Uncertain charge responses are never retried on resurrection, favoring underbilling. A deliberately started independent run is a new validation request even for the same XML; there is no cross-run free document cache.

Apify account subscriptions/credits and taxes follow Apify terms. Live Store pricing is authoritative.

Security, privacy and limits

• XML: 2 MiB, 64 element levels, 30,000 elements.
• Worker: 30 seconds wall, 20 seconds CPU, 384 MiB resident-memory guard; 64 file descriptors. Actor: 512 MiB container and 120-second default timeout.
• Uploads: 5-second socket timeout and 20-second loop deadline; no redirects/decompression.
• DTDs/external entities disabled and rejected. XInclude and processing instructions rejected. Saxon external protocols and extension functions disabled. Only trusted packaged XSD/XSLT execute.
• Original invoice contents are not logged or copied into report files. Reports necessarily contain invoice ID and diagnostic field values. Apify input/upload and report storage follow your account's access/retention settings. Delete confidential records when no longer needed.
• No OCR/PDF extraction, attachment malware scan, signature/certificate checks, economic-transaction verification, or invoice-network submission.

Sources, licenses and reproducibility

Verified 2026-11-06. No schema/rule download at validation time. Individual SHA-256 hashes in vendor/manifest.json.

• OASIS UBL 2.1 final. Original notices retained in unchanged schemas and bundled specification HTML.
• EN16931 1.3.17 release, EUPL-1.2. Original Schematron, code lists, XSLT and 18 in-limit examples included unchanged. The original 19-document corpus also includes one 3.2 MiB example, correctly rejected by the 2 MiB resource guard and retained in local test evidence. Archive SHA-256: bf02a0e3f6cbe692a4a28e70be7bdcaded5612b4169b543e13d6cb4f33c29e92.
• Program: EUPL-1.2, see LICENSE. Original components retain their notices. Complete source available from Actor source and each run's SOURCE-DISTRIBUTION.
• lxml 6.1.3 (BSD-3-Clause plus libxml/libxslt notices); SaxonC-HE 13.1.1 (MPL-2.0, no commercial key for HE); Apify Python SDK 4.2.1 (Apache-2.0). Locked dependencies and upstream links in docs/SOURCES.json.
• Apify pay-per-event documentation.

Tests and local reproduction

Official OASIS Invoice/CreditNote examples; official EN Invoice/CreditNote/discount-price documents; controlled missing field, totals, allowance/charge, VAT, currency, quantity and base-quantity errors; prepayment/rounding; negative-line profile distinction; truncation; malformed/UTF-16 DTD, entity, XInclude, namespace spoof, size/depth limits; real worker timeout/RSS limits; upload restrictions; invalid-report billing, free technical/storage failures and replay/ambiguous-charge handling.

Create a Python environment, install requirements-lock.txt, and run python -m pytest -q. These tests assess this packaged release, not every jurisdiction's legal requirements.