Domain and client management
All of these routes are served by Fatoora Cloud (https://business.fatoora.tn), authenticated with your own user/partner session — not the end client's.
Domains
| Method | Path | Role |
|---|---|---|
| GET | /api/partner/signer/domains | List whitelisted domains |
| POST | /api/partner/signer/domains | Add a domain (403 DOMAIN_LIMIT_REACHED, 409 DOMAIN_ALREADY_EXISTS) |
| DELETE | /api/partner/signer/domains/:domain | Remove a domain (404 DOMAIN_NOT_FOUND) |
domain must be a bare hostname (no scheme), 3 to 253 characters, lowercased on save. Subdomains of a whitelisted domain also match (app.yourapp.example.com matches yourapp.example.com).
Pre-registered clients
| Method | Path | Role |
|---|---|---|
| GET | /api/partner/signer/clients?search=&active=true | List, filterable |
| POST | /api/partner/signer/clients | Pre-register (or reactivate) one client (403 CLIENT_LIMIT_REACHED) |
| POST | /api/partner/signer/clients/bulk | Pre-register up to 200 clients at once |
| PATCH | /api/partner/signer/clients/:id | Toggle isActive |
| DELETE | /api/partner/signer/clients/:id | Remove a pre-registered client |
POST on an existing taxId reactivates it rather than erroring, and doesn't count against the limit for genuinely-new tax IDs.
Also manageable from the dashboard
Fatoora dashboard → Partner → Signer → Domains / Clients offers the same management without going through the API.
What partner signer applications cannot do
- No catalog visibility — never listed in the public partner catalog.
- No client-facing OTP consent — you pre-register unilaterally; this is a trust model, not a technical restriction.
- No REST invoice submission through this bridge — the web-bridge signs (and optionally files) XML you already built; it has no endpoint to create/manage invoices like Partner API does. If you also need that, register with
partnerType: "both". - The client's PIN and TTN credentials are never accessible to you — entered directly in the browser, encrypted in-memory for the session.
- No network isolation guarantee — the agent isn't hard-restricted to
127.0.0.1at the socket level; don't represent it as network-isolated to your own clients.
Next step: Reference, errors and downloads.