Reference

EFRIX | URA Technical Brief

EFRIS Certified Integrator Accreditation Package

Prepared by: Xtellar Systems Co. Limited
Product: EFRIX – Electronic Fiscal Receipting Integration Exchange
Document Version: 1.0
Date: January 2026


Executive Summary

EFRIX is a certified middleware solution developed by Xtellar Systems Co. Limited that enables Ugandan businesses to achieve seamless compliance with URA's Electronic Fiscal Receipting and Invoicing Solution (EFRIS). EFRIX serves as a translation and security layer between client business systems (POS, ERP, custom applications) and URA's EFRIS infrastructure, handling all technical complexity of fiscalization while providing clients with a simple, RESTful API interface.

Key Capabilities:

  • Real-time invoice fiscalization via system-to-system integration
  • Support for all EFRIS document types (invoices, credit notes, debit notes)
  • Per-TIN certificate management and cryptographic operations
  • Automated retry logic with configurable failure handling
  • Comprehensive audit logging with 10-year retention
  • Sandbox environment for client integration testing

1. System Architecture

1.1 Architecture Overview

EFRIX Integration Architecture

EFRIX operates as a middleware layer with three primary zones:

ZoneComponentsResponsibility
Client ZonePOS, ERP, Custom Apps, E-commerceTransaction origination
EFRIX ZoneAPI Gateway, Validation, Transformation, Queue, Certificate Manager, Audit DBRequest processing, security, compliance
URA ZoneEFRIS ServerFiscalization, FDN generation, QR codes

1.2 Data Flow

1.3 Component Description

ComponentFunction
API GatewayAuthenticates API keys, enforces rate limits, routes requests
Invoice ServiceHandles invoice, receipt, credit note, and debit note processing
Goods & Stock ServiceManages product registration and stock movements with EFRIS
Customer ServiceTIN/BRN/NIN validation and customer data synchronization
Cryptography EnginePKI signing (RSA) and AES-256 encryption/decryption
Key ManagementAutomated daily key rotation via T104 interface
Job QueueQueues failed submissions for automatic retry
Audit LogsImmutable logs of all transactions for compliance

2. Supported Transaction Types

EFRIX supports the following fiscal document types as defined by URA EFRIS:

Transaction TypeEFRIS CodeDescriptionUse Case
Sales InvoiceT109Standard VAT invoiceB2B, B2G, B2C sales
Sales ReceiptT109POS receipts for walk-in customersRetail
Credit NoteT110Reversal/cancellationReturns, corrections
Debit NoteT111Additional chargesPrice adjustments
Goods RegistrationT130Product/service registrationInventory setup
Stock-InT131Inventory additions (purchase, import)Stock management
Stock AdjustmentT132Inventory correctionsStock reconciliation

Supported Payment Modes

  • Cash
  • Credit
  • Cheque
  • SWIFT Transfer
  • Mobile Money (MTN, Airtel)

Supported Currencies

UGX, USD, EUR, GBP, CNY (as per EFRIS specification)


3. Data Validation & Error Handling

3.1 Pre-submission Validation

EFRIX validates all requests before transmission to EFRIS:

Validation LayerChecks Performed
Schema ValidationJSON structure, required fields, data types
Business RulesTIN format (10 digits), tax rate accuracy (0%, 18%), currency codes
Referential IntegrityOriginal invoice reference for credit/debit notes
Duplicate DetectionIdempotency key verification

3.2 Failure Handling & Retry Logic

Retry Parameters:

ParameterValue
Initial Delay30 seconds
Retry Schedule30s → 2min → 5min → 15min → 1hr
Max Retries5 attempts
Dead LetterAlert client via webhook

3.3 Failure Categories

CategoryEFRIS CodesEFRIX Action
TransientNetwork timeout, 5xx errorsAuto-retry with backoff
Validation2001-2099 (data errors)Return to client for correction
Certificate100-102 (auth errors)Alert admin, pause TIN
Rate Limit429Queue and throttle

4. Security Architecture

4.1 Certificate Handling

EFRIX implements URA's required PKI infrastructure:

ComponentImplementation
Certificate StorageAES-256 encrypted vault, separate from application DB
Private Key ProtectionHardware Security Module (HSM) integration available
Thumbprint ManagementSHA-256 fingerprint verification on each request
Certificate RenewalAutomated alerts 30 days before expiry

4.2 Per-TIN Isolation

Each registered business (TIN) maintains complete isolation:

4.3 Data Protection

LayerProtection Mechanism
In TransitTLS 1.3 minimum, certificate pinning to EFRIS
At RestAES-256 encryption for all stored data
ApplicationInput sanitization, parameterized queries
Access ControlRole-based access, MFA for admin functions

5. Audit & Compliance Logs

5.1 Data Retention

Data ElementRetentionPurpose
Full request payload10 yearsDispute resolution, audit trail
Full response payload10 yearsFDN verification, compliance
FDN/Verification codes10 yearsQuick lookup, validation support
Error logs10 yearsTroubleshooting, pattern analysis
API access logs10 yearsSecurity audit, usage tracking
Certificate operations10 yearsKey management audit

5.2 Audit Log Schema

Each transaction log record follows this standardized schema:

{
  "transaction_id": "uuid",
  "timestamp": "ISO-8601",
  "tin": "1000000001",
  "document_type": "T109",
  "request_hash": "sha256",
  "response_hash": "sha256",
  "fdn": "EFRIS-123456789",
  "status": "SUCCESS|FAILED|PENDING",
  "error_code": null,
  "processing_time_ms": 234,
  "efris_response_time_ms": 189,
  "client_ip": "masked",
  "api_version": "v1"
}
FieldDescription
transaction_idUnique UUID for each transaction
timestampISO-8601 formatted timestamp (UTC)
tinClient taxpayer identification number
document_typeEFRIS transaction code (T109, T110, etc.)
request_hashSHA-256 hash of sanitized request payload
response_hashSHA-256 hash of EFRIS response
fdnFiscal Document Number assigned by EFRIS
statusTransaction outcome
error_codeURA error code if applicable
processing_time_msTotal EFRIX processing time
efris_response_time_msTime for EFRIS to respond
client_ipMasked client IP for privacy
api_versionAPI version used

5.3 URA Audit Support

EFRIX provides the following capabilities for URA audits:

Audit RequirementEFRIX Capability
Transaction LookupSearch by TIN, date range, FDN, or invoice number
Export FormatsJSON, CSV, PDF reports
Real-time AccessRead-only audit portal for authorized URA officers
Integrity VerificationSHA-256 hash chain for tamper detection
Compliance ReportsAutomated monthly summaries per TIN

6. EFRIX API Reference

6.1 Base URLs

EnvironmentURL
Productionhttps://gateway.tarifix.xtellar.app/efrix/v1
Sandboxhttps://gateway.tarifix.xtellar.app/efrix/v1/sandbox

6.2 Authentication

All requests require header authentication:

X-EFRIX-API-Key: efrix_live_xxxxx
X-EFRIX-API-Secret: sk_live_xxxxx

6.3 API Endpoints

EndpointMethodDescription
/invoicesPOSTSubmit sales invoice for fiscalization
/invoices/{id}GETRetrieve invoice by ID
/invoicesGETList invoices with filters
/invoices/{id}/voidPOSTVoid an invoice
/credit-notesPOSTSubmit credit note
/credit-notes/{fdn}GETRetrieve credit note by FDN
/debit-notesPOSTSubmit debit note
/debit-notes/{fdn}GETRetrieve debit note by FDN
/goodsPOSTRegister goods/services with EFRIS
/goodsGETList registered goods
/goods/{id}PUTUpdate goods details
/stock/inPOSTRecord stock increase
/stock/adjustPOSTAdjust stock levels
/taxpayer/infoGETFetch taxpayer details by TIN
/customers/{tin}GETLookup customer by TIN/BRN/NIN
/customersPOSTSave customer details
/exchange-rateGETGet current URA exchange rates
/reports/dailyGETDaily transaction summary
/reports/reconciliationGETEFRIS reconciliation report
/healthGETAPI health check
/webhooksPOSTConfigure callback notifications

6.4 Sample Request/Response

POST /invoices

// Request
{
  "invoice_number": "INV-2026-0001",
  "invoice_date": "2026-01-10",
  "buyer_tin": "1000000002",
  "buyer_name": "ABC Company Ltd",
  "currency": "UGX",
  "items": [
    {
      "description": "Professional Services",
      "quantity": 1,
      "unit_price": 1000000,
      "tax_rate": 18,
      "product_code": "99-001"
    }
  ],
  "payment_mode": "Credit",
  "idempotency_key": "unique-client-reference"
}

// Response
{
  "success": true,
  "data": {
    "fdn": "EFRIS-987654321",
    "verification_code": "ABCD1234",
    "qr_code": "base64-encoded-qr",
    "invoice_id": "URA-INV-123456",
    "fiscalized_at": "2026-01-10T14:30:00Z",
    "gross_amount": 1180000,
    "tax_amount": 180000,
    "net_amount": 1000000
  }
}

6.5 Response Codes

CodeMeaning
200Success
201Created successfully
400Validation error
401Authentication failed
403Insufficient permissions
429Rate limit exceeded
500Server error
502EFRIS temporarily unavailable

7. Demo & Sandbox Evidence

7.1 Sandbox Environment

EFRIX maintains a fully functional sandbox environment connected to URA's EFRIS test server:

ComponentSandbox Details
URLhttps://gateway.tarifix.xtellar.app/efrix/v1/sandbox
EFRIS Test Portalhttps://efristest.ura.go.ug
Test TINsProvided upon sandbox registration
Test CertificatesAuto-generated for sandbox accounts
Data ResetNightly reset of test data

7.2 Available Demo Evidence

Evidence TypeDescriptionFormat
ScreenshotsStep-by-step fiscalization flowPNG/PDF
API LogsSample successful transactionsJSON
Video WalkthroughIntegration demoMP4/Zoom
Postman CollectionPre-configured API test suiteJSON
Sample IntegrationReference implementation codeGitHub

7.3 Test Transaction Sample

{
  "request": {
    "buyer": {
      "tin": "1000000001",
      "legal_name": "Test Company Ltd"
    },
    "items": [
      {
        "description": "Test Product",
        "quantity": 1,
        "unit_price": 50000,
        "tax_rate": 18
      }
    ],
    "payment_mode": "CASH"
  },
  "response": {
    "success": true,
    "fiscal_document_number": "TEST-FDN-2026-001234",
    "qr_code": "https://efristest.ura.go.ug/verify/...",
    "antifake_code": "ABC123XYZ",
    "timestamp": "2026-01-10T12:00:00Z"
  }
}

7.4 Test Transaction Logs (Sandbox)

[2026-01-10 10:15:23] INFO  Request received: POST /invoices
[2026-01-10 10:15:23] INFO  TIN: 1000000001 | Invoice: TEST-001
[2026-01-10 10:15:23] INFO  Validation: PASSED
[2026-01-10 10:15:24] INFO  EFRIS submission initiated
[2026-01-10 10:15:24] INFO  EFRIS response: SUCCESS
[2026-01-10 10:15:24] INFO  FDN: EFRIS-TEST-123456789
[2026-01-10 10:15:24] INFO  Processing time: 856ms

8. Client Onboarding Checklist

For Commercial Deployment

#StepResponsibleDocuments Required
1Client signs EFRIX service agreementClientSigned contract
2Verify client VAT registration statusXtellarTIN certificate
3Client obtains EFRIS certificate from URAClientURA certificate (PFX)
4Create EFRIX tenant for client TINXtellar
5Upload certificate to EFRIX vaultClient/XtellarCertificate + passphrase
6Generate API credentialsXtellarAPI key issued
7Configure webhook endpointsClientCallback URLs
8Sandbox integration testingClientTest results
9UAT sign-offClientApproval form
10Production go-liveXtellarCutover confirmation
11Post-go-live monitoring (7 days)XtellarHealth report
12Handover to supportXtellarSupport contact info

Technical Prerequisites

  • Client system can make HTTPS REST API calls
  • Client can store and manage API tokens securely
  • Client can handle webhook callbacks (recommended)
  • Client has valid URA-issued EFRIS certificate
  • Client TIN is registered for system-to-system integration with URA

9. Appendices

A. EFRIS Interface Codes Supported

CodeInterfaceDescription
T104Key ExchangeDaily AES key rotation
T109Invoice UploadSales invoice fiscalization
T110Credit NoteCredit note submission
T111Debit NoteDebit note submission
T119Exchange RateCurrency rate lookup
T127Product QueryEFRIS product code search
T130Goods RegistrationProduct/service registration
T131Stock-InInventory additions
T132Stock AdjustmentInventory corrections

B. Error Code Reference

EFRIX CodeEFRIS CodeDescriptionResolution
E001Invalid request schemaCheck JSON format
E002Authentication failedVerify API token
E003Certificate not foundUpload TIN certificate
E100100AppID errorContact support
E101101RequestTime errorSync system clock
E20012001TIN format invalidVerify buyer TIN
E20202020Invoice already existsCheck idempotency key
E20752075Amount exceeds limitSplit into multiple invoices

C. Compliance Statement

EFRIX is developed and operated in accordance with:

  • URA EFRIS Interface User Requirements Specifications v1.5
  • Section 73A and 73B of the Tax Procedures Code Act 2014
  • Uganda Data Protection and Privacy Act 2019

10. Contact Information

Xtellar Systems Co. Limited
Kampala, Uganda


Document Classification: URA Confidential
Prepared by: Xtellar Systems Co. Limited
Revision: 1.0
Last Updated: January 2026

This document is submitted in support of Xtellar Systems' application for EFRIS Certified Integrator accreditation renewal with the Uganda Revenue Authority.

Previous
Pricing