Anaf v1 / SAF-T (D406)
Render PDF
A summary PDF of the D406 return, for an eyeball check before filing. The response is the document, not JSON.
POST
https://oneapi.ro/api/anaf/v1/saft/render
Request body
The request body is the whole document, sent raw (Content-Type: application/xml) — not an object with fields.
Monthly D406
A quarterly D406
An annual D406
Query parameters
This route accepts no query parameters.
How it behaves
- The document can also be sent as a file:
multipart/form-datawith thefisierfield (curl -F fisier=@document.xml), instead of the raw body. The file content becomes the request body, so the result is identical; options stay in the query string, and any other form field next tofisierreturns422 camp_necunoscut. - Takes a D406 and returns a readable summary PDF: the company, the period, the software and the per-section counts/totals. Local (dompdf), in-memory.
- The document is informative; it does not replace filing in SPV.
- Zero retention: the file received is not written and not logged.
What it is for
- A printable summary of a D406, for the file or a visual check.
Response structure
FieldTypeDescription
Response examples
body: @saft-d406.xml
POSThttps://oneapi.ro/api/anaf/v1/saft/render
The response is a binary document, not JSON: application/pdf, 26,2 KB in this example.
body: @saft-d406-trimestrial.xml
POSThttps://oneapi.ro/api/anaf/v1/saft/render
The response is a binary document, not JSON: application/pdf, 26,3 KB in this example.
body: @saft-d406-anual.xml
POSThttps://oneapi.ro/api/anaf/v1/saft/render
The response is a binary document, not JSON: application/pdf, 26,3 KB in this example.
Error codes
| Code | Slug | When it occurs |
|---|---|---|
| 401 | neautentificat | Token missing, invalid, expired or revoked. |
| 403 | feature_indisponibil | The current plan does not include the feature the route depends on. |
| 422 | xml_invalid | Invalid XML — it cannot be rendered. |
| 429 | cota_depasita | The plan's monthly quota has been exceeded (see Retry-After). |
Errors in the Anaf module use the same envelope as the rest of the platform, with two extra fields: {eroare: {cod, mesaj, camp, request_id}}. eroare.cod is stable and is what you branch on; on validation (422) the code is case-specific: xml_invalid, xml_nu_e_factura, unitate_necunoscuta, luna_invalida and so on. camp points at the offending field when one can be identified.
{
"eroare": {
"cod": "xml_invalid",
"mesaj": "Invalid XML — it cannot be rendered.",
"camp": null,
"request_id": "0199c1f0-6e1a-7c3d-9b2f-4a8e5d1c7b04"
}
}