Skip to main content
Version: 4.42

How to submit tax reporting data to AEAT with curl using Redtrust certificates

Overview​

This guide explains how to send VAT (IVA) information and invoice records to the Spanish Tax Agency (AEAT) using curl, from both Windows and Linux environments. It focuses on the two main reporting mechanisms currently in use in Spain:

  • Suministro Inmediato de Información (SII): For near-real-time VAT ledger reporting.
  • Veri*Factu: For transmitting verifiable invoice records generated by compliant invoicing systems.

The examples assume that you already have the certificate available in Redtrust and that you understand which system (SII, Veri*Factu, or both) applies to your scenario. This guide assumes familiarity with HTTPS, certificates, and basic command-line usage.

Background​

Spain is implementing real-time or near-real-time tax reporting mechanisms to improve the traceability of economic transactions and reduce tax fraud. As part of this effort, AEAT provides web services that accept structured data over secure HTTPS connections.

Two complementary mechanisms are relevant in this context:

  • SII requires certain taxpayers to submit VAT ledger entries derived from issued and received invoices within short deadlines. The data represents accounting and tax information, not the invoice document itself.
  • Veri*Factu regulates how invoices are generated and recorded by invoicing systems, and allows (or requires, depending on the setup) the transmission of invoice records to AEAT at the time of issuance.

From a technical perspective, both systems rely on authenticated HTTP requests, and use mutual TLS (client authentication with an X.509 certificate), structured XML payloads (depending on the service) and dedicated AEAT endpoints.

Because AEAT exposes these services over standard web protocols, you can interact with them using a generic tool such as curl. This guide focuses on SII requests; Veri*Factu examples follow the same pattern.

Before you start​

  • Redtrust agent for Windows
  • curl and Schannel

Step 1: Check the prerequisites​

In order for curl to use the certificate storage on Windows, curl has to use Schannel.

Execute the command to check that it is installed.

curl -V

The response has to include Schannel.

curl 8.9.1 (Windows) libcurl/8.9.1 Schannel zlib/1.3 WinIDN
Release-Date: 2024-07-31
Protocols: dict file ftp ftps http https imap imaps ipfs ipns mqtt pop3 pop3s smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS HSTS HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM SPNEGO SSL SSPI threadsafe Unicode UnixSockets

Step 2: Identify the certificate​

You can find the thumbprint in the Certificates of the admin console.

info

You can also list the certificates from the PowerShell CLI. To do that, you need to have the Windows agent installed and the user logged in.

Get-ChildItem Cert:\CurrentUser\My

Step 3 (Linux only): Let curl reach the PKCS#11 token​

The agent installer registers the Redtrust PKCS#11 module in p11-kit, so you don't need to declare the library path in openssl.cnf or in any other application. You only need to install the component OpenSSL uses to reach p11-kit, which depends on the curl version you checked in step 1.

  • curl versions earlier than 8.12: Install the OpenSSL PKCS#11 engine.
  • curl 8.12 or later: Install the OpenSSL 3 PKCS#11 provider.

Ubuntu 22.04 and 24.04 ship curl versions earlier than 8.12, so the engine is the applicable method on those distributions.

To install the engine, run:

sudo apt install -y libengine-pkcs11-openssl

To install the provider, run:

sudo apt install -y pkcs11-provider

In both cases the component discovers the Redtrust module through p11-kit by default, so there's nothing else to configure.

OpenSSL engines are deprecated as of OpenSSL 3 and the provider is their official replacement. Even so, curl doesn't support pkcs11: URIs through providers until version 8.12, so the engine is still required on earlier versions.

Step 4: Send the SII information with curl​

Once you have identified the certificate (D8B6D009411BC734AC9F12858C46EC63C73D959D in this example), you can use the following command to send the information. Replace FILE_PATH with the path to the XML file you want to send.

curl --connect-timeout 60 -m 60 -s -S -L --header "Content-Type: text/xml;charset=UTF-8" --cert "CurrentUser\My\D8B6D009411BC734AC9F12858C46EC63C73D959D"  --data-binary "@FILE_PATH\invoice.xml" "https://prewww1.aeat.es/wlpl/SSII-FACT/ws/fe/SiiFactFEV1SOAP"
note

Note that this example uses the AEAT pre-production URL. For production, keep the same path and switch to the production host (https://www1.agenciatributaria.gob.es). For the full list of production endpoints (and the corresponding WSDLs), see the official AEAT web service WSDL page.

This command uses the certificate for authentication, and the corresponding operation is logged as an event in Redtrust.

Summary​

You've submitted tax reporting data to AEAT with curl, authenticating the connection with a certificate that stays in Redtrust. On Windows, curl takes the certificate from the system store through Schannel. On Linux it takes it from the agent's PKCS#11 token through p11-kit, using either the OpenSSL engine or the provider depending on your curl version. In both cases the private key never leaves Redtrust, and every use is logged as an event.

Next steps​

Was this page helpful?