Deprecated Endpoints

Since 2026-09-04 the TF Fiscal Open API exposes only the echo endpoint plus ten standard endpoints (see Retained endpoints). This page lists the nine endpoints retired on that date, what they return now, their replacements, and the request / response shape differences.

What happens after retirement

• Requests still go through the three-header signature check (token / timestamp / sign): a failed signature still returns 401. Only a correctly signed request receives 410 with the replacement hint, so unauthenticated probes learn nothing about the catalogue.
• The 410 is produced before the scope (subscription) check: a retired path is not in any application’s subscriptions, and a 403 “not subscribed” would leave you guessing whether to subscribe or to change the path.
• A 410 consumes no rate-limit token and belongs to no rate-limit group.
• The scopes of the retired endpoints have been removed from every application’s subscription.

message follows Language / Accept-Language (zh / en / pt / es); without a language header it defaults to Portuguese. Example (Portuguese):

{
  "success": false,
  "errorType": 1,
  "code": 10009034,
  "message": "Esta API foi descontinuada, utilize POST /openapi/v2/empresas/{empresaid}/nf-e"
}

Retired endpoints

Request / response shape differences

Issuance family (#1 – #5)

These five endpoints were never implemented (every call returned the 10009011 “not implemented” placeholder), so there is no live traffic to migrate. The differences are purely contractual:

Invoice verification (#6, #7)

Identity verification (#8, #9)

Only the path prefix changes; the path used in the signature changes with it, nothing else in the integration code needs to change.

Migration checklist

1. Replace both the request URL and the path used in the signature with the replacement path (path keeps the /openapi prefix, no host, no query string).
2. Verification and issuance family: rewrite response parsing for bare responses — stop reading from data; detect errors by HTTP status plus {code, message} / [{codigo, mensagem}]. Gateway (auth) errors remain in the platform envelope.
3. chave lookup becomes GET: sign the empty string as body; forceRevalidate is no longer available there.
4. Application subscriptions (scopes) were migrated by the platform; nothing to do on your side. If the console shows an application with no subscription at all, it only subscribed to retired endpoints — ask the platform to subscribe it to the standard ones.
5. On 410, fix the path according to the replacement named in message; do not retry.

Retained endpoints

The scope key is the lower-cased path (a {xx} segment matches any single non-empty segment).