The output conforms to EN 16931, the European norm the German mandate is based on. XRechnung documents follow the current KoSIT specification and are validated against the official KoSIT Schematron before you get them back; ZUGFeRD output is valid Factur-X with structural EN 16931 checks. Compliance of the content (correct VAT treatment, mandatory references for your buyer) still depends on the data you send — which is exactly what the validation report tells you about.

XRechnung is pure XML — required for invoicing German public authorities (B2G) and common in B2B. ZUGFeRD / Factur-X is a normal PDF with the same structured XML embedded, so humans and machines both read it. Both satisfy the mandate; many teams send ZUGFeRD to businesses and XRechnung to government. The API generates either from the same JSON.

No. Invoices are processed in memory and returned; nothing is persisted, and request bodies are excluded from our logs. EU-hosted infrastructure, GDPR-first — there is no retention setting to configure because there is nothing retained.

Yes — POST any XRechnung or UBL document to /v1/invoices/validate for authoritative KoSIT validation; CII (ZUGFeRD / Factur-X) documents are checked at the structural EN 16931 tier today. Either way you get a machine-readable report: every failed rule with its ID, severity, a plain-language message and a suggested fix. Validation is free within a generous fair-use allowance — five times your plan's monthly document quota — and never counts against your billable documents.

That's the core use case. One API key, and a free-form metadata object on every invoice for your own per-tenant correlation. The API responds synchronously — your users never see normbill, they just get compliant invoices out of your product. At platform volume, the Platform tier adds pay-by-invoice billing (SEPA, net-30), dedicated support and an EU data-residency guarantee.

The API generates Peppol BIS Billing 3.0 UBL today, so your documents are network-ready. Transmission over the Peppol network (via a certified access point) is on the roadmap — generation and validation come first, because that's the part every team needs on day one.

You get a 422 with line-level errors: the rule that fired, the path in your JSON that caused it, a plain-language message, and a suggested fix. The API never silently returns an invalid document.

Only successful documents count against your quota — failed attempts cost nothing, and validation has its own generous free allowance. From 80% usage every response carries an X-Quota-Warning header, so nothing surprises you. Beyond the allowance, requests return a clear 429 with an upgrade link — metered pay-per-invoice overage for paid plans is rolling out. sk_test_ keys are never billed.

Email support@normbill.com — for support, questions about the docs, or anything this FAQ doesn't cover. A practical getting-started guide lives in the public docs.