Italy FatturaPA Validator - SDI Preflight for FPA12, FPR12

Offline structural and deterministic content preflight for FatturaPA XML.

Validate FPA12, FPR12, and FSM10 invoices before submitting them to Italy's Sistema di Interscambio (SdI). Each evaluated document receives a structured result, bounded findings, SHA-256 evidence, and exact artifact versions.

ACCEPTED means the XML passed the bundled derived XSD and the implemented document-content checks. It is not an SdI acceptance, delivery, signature, identity, registry, legal, accounting, or tax-validity guarantee.

Run the live Actor

Supported routes

Format	Offline schema route	Content reference
FPA12	Derived ordinary compatibility schema 1.2.3	FatturaPA 1.4, SdI 1.8.4, controls 2.0
FPR12	Derived ordinary compatibility schema 1.2.3	AdE Allegato A 1.9.1
FSM10	Derived simplified compatibility schema 1.0.2	AdE Allegato A 1.9.1

The current B2G and B2B profiles used by this Actor are effective from 2026-05-15. No Agenzia delle Entrate or FatturaPA XSD, PDF, spreadsheet, example, or stylesheet downloaded from the official sites is bundled.

Quick start

The default input contains a fictional FPR12 invoice and is ready to run. API callers can send inline XML:

{
  "documents": [
    {
      "documentId": "supplier-invoice-1042",
      "fileName": "IT12345678903_001.xml",
      "xml": "<?xml version=\"1.0\" encoding=\"UTF-8\"?><p:FatturaElettronica xmlns:p=\"http://ivaservizi.agenziaentrate.gov.it/docs/xsd/fatture/v1.2\" versione=\"FPR12\">...</p:FatturaElettronica>"
    }
  ],
  "resultDetail": "FINDINGS",
  "maxFindingsPerDocument": 100,
  "storeXmlReport": false,
  "storeHtmlReport": false
}

Each documents item must contain exactly one source field: url, xml, or base64. Console file upload and customer key-value store records are also supported. URLs must use HTTPS.

The input and output schemas are agent-readable and work through the Apify API, MCP clients, webhooks, Make, n8n, and standard SDKs.

Result contract

One dataset item is returned for every submitted entry. A technically rejected invoice is a completed evaluation, not a processing failure.

Processing	Conformance	Meaning	Validation event charged
SUCCEEDED	ACCEPTED	Bundled XSD and implemented deterministic checks passed	Yes
SUCCEEDED	REJECTED	At least one bundled XSD or deterministic check failed	Yes
FAILED	NOT_EVALUATED	Input, format, ruleset, timeout, or budget prevented a decision	No

Every row also returns:

{
  "validationScope": "OFFLINE_PREFLIGHT",
  "externalStateStatus": "NOT_EVALUATED_EXTERNAL_STATE",
  "previewConformanceStatus": "NOT_EVALUATED",
  "versions": {
    "schemaSource": "OPEN_SOURCE_DERIVED",
    "officialArtifactsBundled": false,
    "ordinarySchema": {
      "version": "1.2.3",
      "sha256": "10709324b24a5b5ba284bbf595392286cc94446d8b69defb2afd3a4f24f8213a"
    },
    "simplifiedSchema": {
      "version": "1.0.2",
      "sha256": "698d4960a5e6121764e06157aef2593be5ea06fd4ab0938d52185643fcba4c29"
    },
    "activeRuleset": {
      "name": "FatturaPA offline profiles current from 2026-05-15",
      "effectiveAt": "2026-05-15"
    }
  }
}

previewConformanceStatus remains in the shared family output contract and is always NOT_EVALUATED for this product because there is no preview ruleset.

Real output examples

These compact records are taken from successful live run 95PRKHFR5WAZGlx7n, build 0.0.2, dataset VwGNYgKd34KDOfiEM. The run emitted two invoice-validated events for the evaluated documents and did not bill the unsupported document.

What is checked offline

• Secure XML parsing with DTDs, entities, and external resources blocked
• Root namespace, document type, format route, and derived XML Schema
• VAT rate and Natura relationships
• Withholding and pension contribution relationships
• Invoice and linked-document date consistency inside the XML
• Recipient-code length and root-format consistency
• Invoice-number content and discount or charge completeness
• Line total calculation, including sequential percentage adjustments
• VAT summary tax calculation with the documented cent tolerance
• Taxable summary calculation with the documented euro tolerance
• Line, pension, and summary VAT or Natura cross-field coverage
• Simplified-invoice EUR 400 limit with RF19, RF20, and correction exceptions
• Document-type relationships that can be proven from VAT IDs present in XML
• Duplicate date and invoice-number pairs inside a multi-body XML document

The implemented deterministic rule IDs are pinned in rules_manifest.json. The Actor does not claim to reproduce every SdI check.

What is not evaluated

The following checks require live external state and return NOT_EVALUATED_EXTERNAL_STATE:

• Submission history and duplicate file-name history
• Tax, VAT, fiscal-code, and Gruppo IVA registries, including error 00327
• IPA and recipient-code directories
• Declaration-of-intent status, including error 00477
• Certificate chain, expiry, trust, and revocation
• Channel authorization, routing, delivery, and actual SdI acceptance

When the buyer supplies only a fiscal code, comparisons that require resolving its VAT identifier are not guessed.

The Actor also does not validate signed .p7m containers, ZIP packages, cryptographic authenticity, UBL, CII, or PDF invoices.

Pricing

• invoice-validated: $0.004 for each invoice producing ACCEPTED or REJECTED
• NOT_EVALUATED processing failures do not trigger the validation event
• The Actor runtime refuses pay-per-event execution if the configured invoice-validated price differs from $0.004
• Apify platform start charges may still apply separately

Optional reports

Both report settings are off by default:

• storeXmlReport: normalized XML findings report
• storeHtmlReport: human-readable findings report

Returned keys appear in the row's reports object. Reports can contain invoice values and follow the retention settings of the customer's Apify account.

Security and limits

• Validation runs locally inside the Actor container
• No invoice is sent to a third-party validation API
• Raw invoice XML is not copied to dataset rows or logs
• HTTPS downloads block private, local, reserved, and cloud metadata targets
• Redirects and response sizes are bounded
• Each XML document is limited to 5 MiB
• A run accepts up to 100 invoice entries and 100 MiB total input
• Finding count, text fields, and total findings payload are bounded
• The container runs as the non-root myuser account

Validation findings and optional reports can contain invoice values. Treat them as sensitive business data.

Pinned artifact chain

Artifact	Source chain	Bundled SHA-256
Ordinary derived schema 1.2.3	phax/ph-fatturapa 3.1.0, commit c5fc3a97208bf22e50949b09dd9bd396cb18cc9f	10709324b24a5b5ba284bbf595392286cc94446d8b69defb2afd3a4f24f8213a
Simplified derived schema 1.0.2	invopop/gobl.fatturapa v0.69.0, commit 23b1ae16f7e5a243fa11f77e937912d0814db9e9	698d4960a5e6121764e06157aef2593be5ea06fd4ab0938d52185643fcba4c29
XMLDSig schema	W3C licensed schema	35cf8197da812c85e40d57891b35c94187569ed474a2dac813ce5090dafcd35c

The two baseline projects declare Apache License 2.0. Their license texts, the derived-schema notice, and the W3C notice are retained in the image. Docker verifies every bundled artifact against ARTIFACTS_SHA256SUMS.

This is an engineering license assessment, not legal advice. Upstream provenance risk is not zero because the open-source baselines are based on Italian public specifications. See THIRD_PARTY_NOTICES.md for the exact source, commit, archive, baseline, derived, and license hashes.

Release gates

The offline release suite includes authored fixtures for:

• Accepted FPA12, FPR12, and FSM10 routes
• Rejected FPR12 VAT and taxable-summary arithmetic
• Rejected FSM10 total-limit handling
• Unsupported UBL producing NOT_EVALUATED
• External-state status on every evaluated row
• Artifact hashes, manifest routes, metadata, and exact pricing guard
• DTD rejection, output truncation, URL safety, and non-root execution from the shared family core

Official examples are not redistributed.

References

• FatturaPA format documentation
• FatturaPA SdI documentation
• Agenzia delle Entrate technical specification 1.9.1 page
• phax/ph-fatturapa
• invopop/gobl.fatturapa
• THIRD_PARTY_NOTICES.md

This Actor is also exposed to AI agents through Apify's MCP server (mcp.apify.com): an agent can discover it by search and run it with the same pay-per-event billing, with no separate integration.

E-invoice validator family

Same engine, same output contract, one validator per market: XRechnung & ZUGFeRD (Germany) | Peppol BIS Billing | Poland KSeF FA(3) | France E-Invoice