Access Denied Error on Transmit Endpoint

worldwida

Dear Support,

Please help with this access rights error while accessing the transmit endpoint

{
"code": 403,
"data": null,
"message": "error has occurred",
"error": {
"id": "adcfda10-7afe-4000-8e1d-163adf838e49",
"handler": "entity_actions",
"public_message": "access denied. user does not have access to this resource"
}
}

worldwida

@SysAdmin we are still having this challenge. Kindly advise.

SysAdmin

worldwida This means that the business you are trying to transmit on their behalf does not belong to you.

Are you a certified Access Point Provider, or are you in the process of becoming certified?

worldwida

To clarify we are System integrators and we were informed in our demo session that we had to complete the last bit of the integration cycle which is the transmission. However, we've been trying to consume the transmission endpoint and we keep getting the above error. Kindly assist @SysAdmin

SysAdmin

Dear worldwida Team,

To complete the transmission process, please call the Search Entity endpoint to retrieve your test business details. Once the business is provisioned, you will be able to complete transmissions on its behalf. Kindly ensure that the test entity TIN is used for both the Accounting Supplier Party and Accounting Customer Party.

P.S.: Please always take a moment to search this community for previous responses on similar topics before creating a new post. This particular question has been addressed from different perspectives in earlier discussions.

worldwida

Can you advise on how the transmission bit is to be completed?

worldwida

This is critical for the taxpayer we're integrating for, all other requirements have been covered. They are currently using the default APP please advise on the best approach you input is very much appreciated @SysAdmin

worldwida

@SysAdmin we need your feedback on this, please.

zhift

We are in the same situation. All other steps are completed but the transmit step fails due to the same error {
"code": 403,
"data": null,
"message": "error has occurred",
"error": {
"id": "75059f02-fbd8-4ca5-a1e4-2f411aeaaf9e",
"handler": "entity_actions",
"public_message": "access denied. user does not have access to this resource"
}
}. We have connected through all 17 available APPs and the same error is returned.

SysAdmin

Dear zhift,

Please refer to the response in this thread.

worldwida

@SysAdmin we urgently need your revert on this!

worldwida

@SysAdmin Thank you for your feedback. When we call the search entity endpoint to retrieve the test business credentilas, this is what we get.

{
"code": 200,
"data": {
"items": null,
"page": {
"page": 1,
"size": 20,
"hasNextPage": false,
"hasPreviousPage": false,
"totalCount": 0
},
"attributes": null
}
}

It does not provide the test business details.

worldwida

@SysAdmin We have gone through the community and have not been able to get a resolution for this, if there is another thread that addresses this, kindly assist us with the link. Thank you.

SysAdmin

worldwida Please confirm that you are using the Access Point Provider's Keys for this call

zhift

@SysAdmin I think there's some clarity needed here. It appears, from what i am hearing, that the standard taxpayer credentials and the standard endpoint listed in the API Gateway tab in a taxpayer's account will not suffice to trigger the transmit process as this is part of fiscalization that can only be done by APPs. And the documentation itself lists those processes under APPs but does not say anything about what the SI would need to do to plug in to the transmit process via their chosen APP. Rather, SI's are frantically calling endpoints that should be for APP-level credentials and continue to hit the access denied error, and no one has provided clarity on how to move forward.

This is a huge gap in the documentation of this process and this needs to be clarified. Integrators need to know which endpoint to call to alert the APP to initiate transmission of their invoices since this cannot be done directly based on the series of posts about this issue.

SysAdmin

Dear zhift,

You are spot on with your points. The documentation clearly distinguishes between the roles of System Integrators (SIs) and Access Point Providers (APPs).

As we have emphasized in previous discussions within this community, the SI’s role is strictly tied to the taxpayer — they function as solution providers, which is why calls must be initiated using the taxpayer’s keys.

Kindly refer to earlier conversations in this community for more context on this subject.

babatopeajepe

Hey @SysAdmin “Do you mean the system integrator requires an access point provider to handle the transmission? Can you clarify this and share a link to where it is documented?

SysAdmin

babatopeajepe This is correct and have been previously established in this community.

MBSTester

Hi @SysAdmin

There is still no real response as to how to navigate the /invoice/transmit endpoint, it's a real issue now as we can only sign and can't transmit.

Please give a clear and detailed flow for how to use the /invoice/transmit endpoint.

All credentials available on the UI returns "public_message": "access denied. user does not have access to this resource"
Please note that the APP activated is the MBS Default, so i assume we should be able to as well use the /invoice/transmit

Kindly help.

SysAdmin

Dear MBSTester,

At the moment, transmission can only be done through an accredited Access Point Provider (APP). Therefore, even if you are currently on the default APP, you will not be able to transmit invoices.

Management is reviewing this limitation and will provide further updates in due course. In the meantime, you are advised to connect with one of our accredited Service Providers to proceed with transmission.

zhift

SysAdmin As we have emphasized in previous discussions within this community, the SI’s role is strictly tied to the taxpayer — they function as solution providers, which is why calls must be initiated using the taxpayer’s keys.

Thank you for your feedback but your response here doesn't specifically answer my questions. SI's assists the task payer to integrate with the MBS eInvoice platform and part of this process requires the taxpayer to validate, sign and transmit their invoices. The SI has assisted them to achieve the first two using their credentials but the third step is where the problem is.

What we need is direction to the taxpayer about how to get their invoices transmitted after validation and signing. This has nothing to do with the SI's because the taxpayer's credentials is what is being rejected here not that of the SI. The integration I am handling is taxpayer to mbs without any integrator in-between so the conversation about SI's access is not at play here.