Public API Terms
These Public API Terms supplement the FatturaSmart Terms and Conditions for the businesses for which Public API keys are generated, and prevail over them as regards the Public API. Anything not provided for here is governed by the Terms and Conditions and the DPA in force. If the User has signed a specific contract with Fraway S.r.l. for the use of the APIs, that contract prevails for the matters it governs.
1. Nature of the Public API
The Public API is a programming interface that lets software chosen by the User (for example its own management system, an e-commerce site or an ERP) use some functions of the Service for the business the key is associated with: read the invoices issued and received by the business and their status, the available numbering series and VAT rates, and create electronic invoices to customers other than public administrations, which the Service numbers, transmits to the SDI and records in the account like invoices created in the app. The available functions, data formats, error codes and technical limits are described in the technical documentation published by Fraway S.r.l. and reachable from the Profile › API keys page (the "Documentation").
The customer of the invoice is identified either by referring to an existing client record or by its details. In the latter case the invoice carries the details given in the request. If the client records already hold a client with the same VAT number or, failing that, the same tax code (codice fiscale), the invoice is linked to that client and takes from it only the VAT number, tax code, recipient code and certified email address (PEC) that the request leaves out (a detail the request marks as absent does not appear on the invoice); otherwise the Service adds the customer to the client records. Existing client records are not changed.
The Public API is an optional feature of the Service that the User may activate within the meaning of section 1.1 of the Terms and Conditions: its operation, like that of every other component of the Service, is governed by the Terms and Conditions.
2. Keys and environments
Keys are generated and revoked by the owner of the business under Profile › API keys. At the owner's request, Fraway S.r.l. support may revoke a key. Each key is associated with a single business and only allows operations on that business's data.
Live keys operate on the real data of the account and transmit invoices to the SDI; they are available to businesses on a plan that includes the Public API. Sandbox keys operate on a test environment that records no data in the account and transmits nothing to the SDI.
The full key is shown only once, when it is created. Fraway S.r.l. keeps only a cryptographic fingerprint of the key and its first characters, which serve to identify it and do not allow it to be reconstructed; Fraway S.r.l. therefore cannot retrieve the key or show it again. Revoking a key takes effect from the next request.
3. Safekeeping of keys
A key is a credential for accessing the Service within the meaning of section 4.2 of the Terms and Conditions: whoever holds it can read the business's data and create invoices and transmit them to the SDI in the name of the business. The Service cannot tell who sends a request: every request authenticated with an active key is executed for the business the key is associated with, until the key is revoked.
The User must keep keys secure: it must not put them in code that runs in the browser or in apps distributed to third parties, or in repositories accessible to third parties, and must share them only with those who need them for the integration. If the User suspects that a key has been exposed or used by others, it must revoke the key at once under Profile › API keys and inform Fraway S.r.l. at info@fatturasmart.com, which will help the User reconstruct the key's use from the request log (clause 10).
4. Issuing and transmission to the SDI
With a live key, a request to create an invoice that the Service accepts results in the number being assigned and the invoice being issued and transmitted to the SDI, without further confirmation in the app. An invoice that has been transmitted and not rejected by the SDI cannot be deleted or changed: corrections are made with a credit note or the other procedures provided by law (section 10.2 of the Terms and Conditions).
Before each request the User must check the invoice data in its own software (customer, lines, amounts, VAT rates and nature codes, dates, numbering and payment method). The Service's checks concern the format and technical consistency of the data, not their correctness for tax or accounting purposes. To develop and test the integration the User must use sandbox keys.
The Public API response reports the outcome known at the time of the request: a positive outcome means that the invoice has been transmitted to the SDI, not that it has been delivered to the customer. If the transmission is refused at the time of the request, by the Service's checks or during sending, the invoice is not recorded and the response states the reason. If the transmission does not complete because of a temporary problem, the invoice stays in the account awaiting sending and the Service retries the transmission. If the transmission is refused later, or the SDI rejects the invoice with a rejection notice, the invoice stays in the account with the corresponding status and the User must correct it and transmit it again in the app within the time limits set by the applicable rules. The final outcome is the one notified by the SDI, which the User can check with the Public API or in the app. Every creation request must carry an idempotency key, which prevents duplicate invoices when the same request is repeated, as described in the Documentation.
5. The User's software and providers
The software that calls the Public API, developed by the User or supplied by third parties (for example the vendor of the management system or an integrator), is not part of the Service. If the User entrusts the integration or a key to a provider, the provider acts on behalf and under the responsibility of the User, like the collaborators of section 8-ter of the Terms and Conditions. Fraway S.r.l. is not a party to the relationship between the User and the provider. The User's software and the provider that runs it receive the data returned by the Public API on behalf of the User, who remains the controller and governs the relationship with the provider; they are not sub-processors of Fraway S.r.l. under the DPA.
6. Use for the business's own documents
Each key serves to issue and manage the documents of the business it is associated with, which is their issuer. The Service governed by these Terms also includes an integration that the business entrusts to its own provider (clause 5), even where the same provider assists several businesses, each with its own account and its own keys. The Service governed by these Public API Terms does not include, on the other hand, the offering to third parties, by the User, of a service for issuing or transmitting tax documents based on the Public API, for example as a software house, reseller or invoicing service provider that opens or manages its own clients' accounts: such a service is governed by a specific contract with Fraway S.r.l.
7. Usage limits
Requests are subject to the rate and size limits set out in the Documentation; requests over the limits are refused with the corresponding error code and may be repeated after the interval indicated. Fraway S.r.l. may raise the limits at any time; lowering them follows clause 8. It is forbidden to use the Public API to access data of businesses other than the key's, to circumvent the limits or security measures of the Service, to run load or security tests not agreed with Fraway S.r.l., or to issue documents that do not correspond to actual transactions (sections 8.2, 8.3 and 8.4 of the Terms and Conditions).
8. Public API versions
The Public API is versioned: the version appears in the request address
(for example /api/public/v1). In the version in use Fraway
S.r.l. may add functions, optional fields and error codes; for this
reason the User's integration must ignore fields it does not recognise,
as indicated in the Documentation.
Changes that require the integration to be adapted (for example the removal of a function or field, a change of format or a reduction of the limits of clause 7) are introduced only with a new version, announced to the email address of the owner of the business and in the Documentation. The previous version remains available at least until the end of the licence period current on the date of the announcement and in any case for at least 6 months from the announcement.
Adjustments required by law, by orders of the authorities or by changes to the technical specifications of electronic invoicing and the SDI, and those needed to fix a security vulnerability, apply to the version in use as well from the date they are due and are communicated as soon as possible.
9. Suspension, revocation and termination
If a key turns out to be publicly exposed or is used anomalously, in a way that puts the business, the Service or other Users at risk, Fraway S.r.l. may deactivate it to protect the User, informing the User without delay; the User can generate a new key straight away. Fraway S.r.l. suspends access to the Public API when required by law or by orders of the authorities, informing the User where permitted. Section 14 of the Terms and Conditions remains applicable.
Live keys work as long as the business has an active licence on a plan that includes the Public API, or a grant from Fraway S.r.l. that is still running: when the licence or grant expires or ends, live keys no longer give access, while invoices already issued remain in the account. The User may revoke its keys at any time.
10. Request log
For the security of the Service, support and abuse prevention, the Service records for each request the key identifier and the business, the method and path, the outcome and any error code, the duration, the date, the request identifier, any idempotency key, and the IP address and user agent of the caller; unauthenticated requests are recorded without key or business. The log does not contain the content of requests and responses, and entries are deleted automatically after 90 days. At the written request of the owner of the business, Fraway S.r.l. provides the extract of the log relating to the business. For creation requests with a live key, the Service keeps a fingerprint of the request and the response for at least 24 hours and no more than 48 hours, to return the same response if the request is repeated with the same idempotency key.
Invoices and client records created or read through the Public API are treated like any other account data, under the Terms and Conditions and the DPA; requests sent with a key of the business constitute documented instructions of the User within the meaning of section 4.1 of the DPA.
11. Changes to these Public API Terms
Fraway S.r.l. communicates changes to these Public API Terms to the email address of the owner of the business at least 15 days before the date from which it proposes them, and submits them for acceptance on the API keys page. The new version applies from acceptance: until then existing keys continue to operate under the terms already accepted, while creating new keys requires acceptance of the new version. Adjustments required by law or by orders of the authorities apply from their entry into force.
12. Language
These Public API Terms are drawn up in Italian and in English; in case of discrepancy the Italian version prevails.
Acceptance
These Public API Terms are accepted by the owner of the business, on behalf of the business, before the first key is created, with a single acceptance checkbox, not pre-ticked, in an authenticated session of the Service; by accepting, the owner declares that they are authorised to bind the business. The Service records the identity of the User, the business, the date and the version of the text accepted. After every change, all previous versions remain published in an archive reachable from this page. For businesses that already have keys on the date of publication, these Public API Terms are proposed on the API keys page and apply from acceptance: until then the use of existing keys remains governed by the Terms and Conditions and, if signed, by the specific contract for the use of the APIs, and creating new keys requires acceptance. Data processing is described in the Privacy Policy (section 6-quater) and in the DPA.
Version: 2026-11
Last updated: 5 November 2026
