{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "fonoa", "name": "Fonoa", "vendor": "Fonoa Technologies Limited", "vendorUrl": "https://www.fonoa.com", "kind": "http-api", "category": "tax", "summary": "Fonoa is a hosted indirect tax platform for VAT, GST and sales tax. Its REST API validates tax identification numbers, calculates tax on a transaction and reports e-invoices to tax authorities, with a sandbox and a demo environment.", "url": "https://www.anchorterminal.com/tools/fonoa", "markdownUrl": "https://www.anchorterminal.com/tools/fonoa.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/fonoa.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/fonoa.json", "license": "Proprietary service. The API contract is not published. The public Terms of Service took effect on 14 May 2020 and name older seller sites", "transports": [ "http" ], "remoteUrl": "https://api.fonoa.com", "packages": [], "auth": "api-key", "authNotes": "Every request needs a subscription key in the `Ocp-Apim-Subscription-Key` header. Fonoa issues a primary and a secondary key once a client is onboarded, on request by email or through the sales form, with separate keys for the sandbox and production. No self-serve key page, scopes, read-only keys or expiry were found in the docs. Countries are enabled per tenant, and a call for a country that is not enabled returns `COUNTRIES_NOT_ALLOWED`. Webhooks are set up by asking a Fonoa contact.", "pricing": "paid", "pricingNotes": "No public prices. www.fonoa.com/pricing returns 404 and the site's buttons read \"Get in touch\". No free tier or self-serve trial was found. The sandbox has unlimited usage with fixed data and the demo environment has limited usage, and a key for either comes from Fonoa after contact (https://docs.fonoa.com/reference/environments, checked 2026-10-08).", "priceSummary": "Paid", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API docs, the OpenAPI definitions or the website (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://docs.fonoa.com", "llmsTxt": "https://docs.fonoa.com/llms.txt", "capabilities": [ "tax.calculate", "tax.transactions", "tax.invoicing" ], "tags": [ "hosted", "paid", "closed-source", "api-key", "openapi", "llms-txt", "sandbox", "webhooks", "sales-led", "status-page", "iso27001" ], "lastRelease": "2026-10-02", "graded": true, "anchor": { "graded": true, "score": 51.7, "grade": "D", "agentReady": false, "rank": 575, "ranked": true, "rankOf": 722, "categoryRank": 8, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 64, "maintenance": 49, "payments": 3, "reliability": 66, "schema": 68, "security": 47, "transparency": 48 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 66, "points": 13.2, "reason": "Graded on the public REST API with the hosted lines. status.fonoa.com runs on UptimeRobot with three monitors, E-Invoicing, Lookup and Tax, and 90 days of daily uptime (20). All three show 100 per cent over 90 days and the page's update feed lists nothing in the 30 days to 8 October 2026. The monitors are heartbeats and we read no incident reports older than that feed, so 27 of 30. No rate limit numbers found (0). E-invoicing and onboarding endpoints document a 429 that says to try again a bit later, with no `Retry-After`. Submissions are idempotent by `transaction_id` and the docs say replays are safe (9). No SLA found on the public pages (0). Lookup v2, Tax v2 and E-invoicing v1 carry no beta label, while Instant Lookup is still being rolled out by country (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 68, "points": 11.05, "reason": "Each reference page carries an OpenAPI 3.0 definition for its endpoint, readable in the Markdown twin. No single downloadable spec was found (20). docs.fonoa.com/llms.txt indexes every page as Markdown (10). Lookup descriptions state purpose and result states, and e-invoicing guides explain when to adjust, credit or cancel. The calculation endpoint's description covers only its two examples (13). The Lookup definitions carry 29 enums. The e-invoicing definitions carry none, with allowed values in prose and query parameters typed as plain strings (8). Request and response examples on every page read, a page on synchronous and asynchronous errors, and sandbox inputs that trigger each error. The calculation definition lists no 401 or 429 (12). Versions sit in the path, with Lookup v1 beside v2. No changelog was found and docs.fonoa.com/changelog returns 404 (5)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 64, "points": 10.4, "reason": "List endpoints take `limit`, default 25, with no field selection, and validation results are long (12). Cursor paging with `next_cursor`, 27 query parameters on the transaction list and 14 on the company list. Calculations have no list endpoint (17). 400 responses carry `code`, `message` and `type` with field-level messages, and later failures arrive on the transaction and by webhook. A missing key returns the plain text \"Unauthorized\" (15). E-invoicing is idempotent by `transaction_id`, a repeat inside one minute returns the same `operation_id`, and webhooks carry a `webhook_id`. Lookup and Tax have no idempotency key (15). A calculation needs few fields. Most work is asynchronous, webhooks are configured by Fonoa staff, and no official SDK was found on npm, PyPI or GitHub (5)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 47, "points": 8.23, "reason": "One subscription key in the `Ocp-Apim-Subscription-Key` header, issued by Fonoa as a primary and secondary pair, with no scopes or expiry found (20). Separate keys for sandbox and production, and countries enabled per tenant. No read-only key or approval step for cancellations and credits found (5). Returns business names, addresses and tax authority messages written by others, with no injection guidance found (3). A history endpoint lists every operation on a transaction, and the security page mentions a dashboard for user access. No log of API key use found (6). ISO/IEC 27001 badge, a vulnerability disclosure programme with an email address, and third-party penetration tests with reports under NDA. No security.txt or bug bounty, and the Vanta trust centre is drawn by script and was not read (13). Webhooks are signed with an OIDC token that includes a body checksum, noted without points." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 3, "points": 0.38, "reason": "No x402, MPP or L402 (0). No price is published. www.fonoa.com/pricing returns 404 and the site asks visitors to get in touch (0). No free tier or card-free trial found. A sandbox with unlimited usage and a demo environment exist, and a key for either comes from Fonoa after contact, scored as partial (3). Keys are issued by Fonoa staff, so an agent cannot get access on its own (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 49, "points": 4.29, "reason": "Closed service with no release tags. The newest reference pages we read, on document templates, were updated on 2 October 2026 per their `updatedAt` field (30). No dated changelog. Page timestamps show edits on 21 July, 29 July and 2 October 2026, and a product updates post covers July 2026 releases (8). Support through a Zendesk request form and a support email address, with no public changelog or community channel found (6). No official SDK, and no server in the official MCP registry (0). No packages to assess. The docs site is current (5)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 48, "points": 4.2, "note": "editorial 27, provenance 69", "reason": "Closed service. The only public terms took effect on 14 May 2020, name older seller sites and are governed by Croatian law. The contract for API customers is not published (8). The privacy notice says it does not cover data processed on behalf of customers, gives no retention periods and says data is stored primarily in the EEA. The 2020 terms say issued invoices are stored for up to 18 months. No public DPA found (10). No deprecation policy found. Lookup v1 is documented beside v2 with no end date (3). Storage primarily in the EEA is stated. No subprocessor list was found on the pages read, and the trust centre was not readable (6)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "List endpoints take `limit`, default 25, with no field selection, and validation results are long (12). Cursor paging with `next_cursor`, 27 query parameters on the transaction list and 14 on the company list. Calculations have no list endpoint (17). 400 responses carry `code`, `message` and `type` with field-level messages, and later failures arrive on the transaction and by webhook. A missing key returns the plain text \"Unauthorized\" (15). E-invoicing is idempotent by `transaction_id`, a repeat inside one minute returns the same `operation_id`, and webhooks carry a `webhook_id`. Lookup and Tax have no idempotency key (15). A calculation needs few fields. Most work is asynchronous, webhooks are configured by Fonoa staff, and no official SDK was found on npm, PyPI or GitHub (5).", "maintenance": "Closed service with no release tags. The newest reference pages we read, on document templates, were updated on 2 October 2026 per their `updatedAt` field (30). No dated changelog. Page timestamps show edits on 21 July, 29 July and 2 October 2026, and a product updates post covers July 2026 releases (8). Support through a Zendesk request form and a support email address, with no public changelog or community channel found (6). No official SDK, and no server in the official MCP registry (0). No packages to assess. The docs site is current (5).", "payments": "No x402, MPP or L402 (0). No price is published. www.fonoa.com/pricing returns 404 and the site asks visitors to get in touch (0). No free tier or card-free trial found. A sandbox with unlimited usage and a demo environment exist, and a key for either comes from Fonoa after contact, scored as partial (3). Keys are issued by Fonoa staff, so an agent cannot get access on its own (0).", "reliability": "Graded on the public REST API with the hosted lines. status.fonoa.com runs on UptimeRobot with three monitors, E-Invoicing, Lookup and Tax, and 90 days of daily uptime (20). All three show 100 per cent over 90 days and the page's update feed lists nothing in the 30 days to 8 October 2026. The monitors are heartbeats and we read no incident reports older than that feed, so 27 of 30. No rate limit numbers found (0). E-invoicing and onboarding endpoints document a 429 that says to try again a bit later, with no `Retry-After`. Submissions are idempotent by `transaction_id` and the docs say replays are safe (9). No SLA found on the public pages (0). Lookup v2, Tax v2 and E-invoicing v1 carry no beta label, while Instant Lookup is still being rolled out by country (10).", "schema": "Each reference page carries an OpenAPI 3.0 definition for its endpoint, readable in the Markdown twin. No single downloadable spec was found (20). docs.fonoa.com/llms.txt indexes every page as Markdown (10). Lookup descriptions state purpose and result states, and e-invoicing guides explain when to adjust, credit or cancel. The calculation endpoint's description covers only its two examples (13). The Lookup definitions carry 29 enums. The e-invoicing definitions carry none, with allowed values in prose and query parameters typed as plain strings (8). Request and response examples on every page read, a page on synchronous and asynchronous errors, and sandbox inputs that trigger each error. The calculation definition lists no 401 or 429 (12). Versions sit in the path, with Lookup v1 beside v2. No changelog was found and docs.fonoa.com/changelog returns 404 (5).", "security": "One subscription key in the `Ocp-Apim-Subscription-Key` header, issued by Fonoa as a primary and secondary pair, with no scopes or expiry found (20). Separate keys for sandbox and production, and countries enabled per tenant. No read-only key or approval step for cancellations and credits found (5). Returns business names, addresses and tax authority messages written by others, with no injection guidance found (3). A history endpoint lists every operation on a transaction, and the security page mentions a dashboard for user access. No log of API key use found (6). ISO/IEC 27001 badge, a vulnerability disclosure programme with an email address, and third-party penetration tests with reports under NDA. No security.txt or bug bounty, and the Vanta trust centre is drawn by script and was not read (13). Webhooks are signed with an OIDC token that includes a body checksum, noted without points.", "transparency": "Closed service. The only public terms took effect on 14 May 2020, name older seller sites and are governed by Croatian law. The contract for API customers is not published (8). The privacy notice says it does not cover data processed on behalf of customers, gives no retention periods and says data is stored primarily in the EEA. The 2020 terms say issued invoices are stored for up to 18 months. No public DPA found (10). No deprecation policy found. Lookup v1 is documented beside v2 with no end date (3). Storage primarily in the EEA is stated. No subprocessor list was found on the pages read, and the trust centre was not readable (6)." }, "sources": [ { "what": "docs index for agents", "url": "https://docs.fonoa.com/llms.txt", "seen": "2026-10-08" }, { "what": "environments and how keys are obtained", "url": "https://docs.fonoa.com/reference/environments.md", "seen": "2026-10-08" }, { "what": "authentication", "url": "https://docs.fonoa.com/reference/authentication.md", "seen": "2026-10-08" }, { "what": "sandbox environment", "url": "https://docs.fonoa.com/reference/sandbox-environment.md", "seen": "2026-10-08" }, { "what": "Lookup sandbox test inputs", "url": "https://docs.fonoa.com/reference/lookup-sandbox-environment.md", "seen": "2026-10-08" }, { "what": "webhooks", "url": "https://docs.fonoa.com/reference/webhooks.md", "seen": "2026-10-08" }, { "what": "errors and warnings", "url": "https://docs.fonoa.com/reference/errors-warnings-and-how-to-handle-them.md", "seen": "2026-10-08" }, { "what": "request a validation, Lookup v2", "url": "https://docs.fonoa.com/reference/requestavalidationv2-1.md", "seen": "2026-10-08" }, { "what": "Instant Lookup", "url": "https://docs.fonoa.com/reference/instant-lookup.md", "seen": "2026-10-08" }, { "what": "request a calculation, guide", "url": "https://docs.fonoa.com/reference/request-a-calculation.md", "seen": "2026-10-08" }, { "what": "request a calculation, reference", "url": "https://docs.fonoa.com/reference/requestataxrate-1.md", "seen": "2026-10-08" }, { "what": "commit a calculation", "url": "https://docs.fonoa.com/reference/commit-a-calculation.md", "seen": "2026-10-08" }, { "what": "submit a transaction, idempotency", "url": "https://docs.fonoa.com/reference/submit-a-transaction.md", "seen": "2026-10-08" }, { "what": "submit a transaction, reference", "url": "https://docs.fonoa.com/reference/post_v1-transactions.md", "seen": "2026-10-08" }, { "what": "list transactions", "url": "https://docs.fonoa.com/reference/get_v1-transactions.md", "seen": "2026-10-08" }, { "what": "list companies", "url": "https://docs.fonoa.com/reference/get_onboarding-v2-companies.md", "seen": "2026-10-08" }, { "what": "document templates, updated 2 October 2026", "url": "https://docs.fonoa.com/reference/custom-document-templates.md", "seen": "2026-10-08" }, { "what": "changelog address, 404", "url": "https://docs.fonoa.com/changelog", "seen": "2026-10-08" }, { "what": "status page", "url": "https://status.fonoa.com", "seen": "2026-10-08" }, { "what": "status page monitor feed, loaded by the page", "url": "https://status.fonoa.com/api/getMonitorList/MlENlTxjln", "seen": "2026-10-08" }, { "what": "status page update feed, loaded by the page", "url": "https://status.fonoa.com/api/getEventFeed/MlENlTxjln", "seen": "2026-10-08" }, { "what": "security page", "url": "https://www.fonoa.com/resources/security", "seen": "2026-10-08" }, { "what": "trust centre, not readable", "url": "https://trust.fonoa.com/", "seen": "2026-10-08" }, { "what": "terms of service, 14 May 2020", "url": "https://www.fonoa.com/legal/terms-of-service", "seen": "2026-10-08" }, { "what": "privacy notice", "url": "https://www.fonoa.com/legal/privacy-notice", "seen": "2026-10-08" }, { "what": "website llms.txt", "url": "https://www.fonoa.com/llms.txt", "seen": "2026-10-08" }, { "what": "Agents product page", "url": "https://www.fonoa.com/platform/agents", "seen": "2026-10-08" }, { "what": "pricing address, 404", "url": "https://www.fonoa.com/pricing", "seen": "2026-10-08" }, { "what": "product updates post", "url": "https://www.fonoa.com/resources/blog/fonoa-product-updates-august-2026", "seen": "2026-10-08" }, { "what": "security.txt, 404", "url": "https://www.fonoa.com/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "unauthenticated API response", "url": "https://api.fonoa.com/lookup/v2/single-validations/00000000-0000-0000-0000-000000000000", "seen": "2026-10-08" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0.1/servers?search=fonoa", "seen": "2026-10-08" }, { "what": "npm search", "url": "https://registry.npmjs.org/-/v1/search?text=fonoa\u0026size=10", "seen": "2026-10-08" }, { "what": "domain registration", "url": "https://rdap.verisign.com/com/v1/domain/fonoa.com", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: the Vanta trust centre at trust.fonoa.com, which is drawn by script. Certifications beyond the ISO/IEC 27001 badge, the subprocessor list and any DPA may be there", "unchecked: status history older than the 30 days the page's update feed returned", "unchecked: reference pages we did not fetch. 33 of the 64 pages in llms.txt were read, so the newest `updatedAt` date may be later than 2 October 2026", "No terms URL is recorded in provenance. Fonoa publishes no service agreement or API terms for fonoa.com customers, only the 2020 Terms of Service for older seller sites", "The privacy notice recorded says it does not apply to customer data Fonoa processes as a processor", "Whether rate limits exist per key. The docs define a 429 and give no numbers", "Whether the Agents product and its MCP access are available to any customer today. The site labels Agents \"Coming soon\"", "Whether the Returns product has an API. No Returns endpoints appear in the docs, so tax.filing is not claimed", "lastRelease is the newest `updatedAt` date on the reference pages read, since Fonoa publishes no API changelog", "The batch lead was right on the vendor, URL, docs and interface. It did not say that sandbox and production keys are issued only by Fonoa staff" ] }, "negative": 0, "verdict": "The API reference is served as Markdown with an OpenAPI definition on each endpoint page, and e-invoicing submissions are idempotent by `transaction_id`. API keys are issued by Fonoa staff after contact, no price, rate limit or changelog is published, and the only public terms date from May 2020 and cover older seller sites.", "bestFor": "An agent working for a company that already has a Fonoa contract and needs tax ID validation, VAT or GST calculation, or e-invoice reporting across many countries through one API.", "strengths": [ "Every reference page is served as Markdown with its OpenAPI 3.0 definition inline, indexed by docs.fonoa.com/llms.txt", "E-invoicing submissions are idempotent by `transaction_id`, and the docs say a transaction can be replayed any number of times", "The sandbox at sandbox.fonoa.com returns fixed outcomes for documented test inputs, including errors, delays and HTTP 500", "Webhooks carry a signed OIDC token with a SHA-256 checksum of the body, valid for one hour", "status.fonoa.com shows 100 per cent over 90 days for its E-Invoicing, Lookup and Tax monitors on 8 October 2026" ], "weaknesses": [ "No self-serve signup. Sandbox, demo and production keys are issued by Fonoa after contact by email or the sales form", "No pricing page. www.fonoa.com/pricing returns 404 and the site's buttons read \"Get in touch\"", "No rate limit numbers found. The 429 response says \"Try again a bit later\" with no `Retry-After` documented", "No changelog, deprecation policy, official SDK or MCP server found. docs.fonoa.com/changelog returns 404", "The only public terms took effect on 14 May 2020 and cover older seller sites. They bar benchmarking and automated access without written permission" ], "agentNotes": [ "Send the key in the `Ocp-Apim-Subscription-Key` header. Use the sandbox key at https://sandbox.fonoa.com and the production key at https://api.fonoa.com", "Treat validations and e-invoicing submissions as asynchronous. POST, then poll the GET endpoint or wait for the webhook, and avoid tight polling", "Reuse the same `transaction_id` on a retry of `/v1/transactions`. A transaction already processed is not processed again", "Commit a calculation with POST `/tax/v2/calculations/\u003cuuid\u003e/commit` only when the sale is final. The commit adds it to revenue tracking", "Ask the Fonoa contact to configure webhooks. There is no API for it, and always fetch `resource_url` as given in the webhook" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 51.7 } ], "editorialScores": { "ergonomics": 64, "maintenance": 49, "payments": 3, "reliability": 66, "schema": 68, "security": 47, "transparency": 27 }, "provenanceScore": 69 }, "connect": { "http": "curl --location 'https://sandbox.fonoa.com/lookup/v2/single-validations' \\\n--header 'Content-Type: application/json' \\\n--header 'Ocp-Apim-Subscription-Key: \u003cyour-sandbox-API-key\u003e' \\\n--data '{\n \"country_iso_code\": \"pl\",\n \"tax_identification_number\": \"2000\"\n}'" }, "letme": { "capability": "https://letme.dev/tax.calculate", "tool": "https://letme.dev/fonoa" }, "notable": [ "The API has three product areas, Lookup for tax ID validation (`/lookup/v2`, `/instant-lookup/v1`), Tax for calculation (`/tax/v2/calculations`) and E-invoicing (`/v1/transactions`, `/onboarding/v2`) (https://docs.fonoa.com/llms.txt)", "Three environments are documented, sandbox.fonoa.com with fixed data and unlimited usage, api-demo.fonoa.com with limited usage, and api.fonoa.com for production (https://docs.fonoa.com/reference/environments)", "Fonoa says the Transactions API is idempotent and that a `transaction_id` is processed once only, so a client can replay a submission safely (https://docs.fonoa.com/reference/submit-a-transaction)", "The website lists Agents as \"Coming soon\" and says AI tools will call it through MCP. No MCP endpoint or MCP documentation was found, and the official MCP registry has no Fonoa server (https://www.fonoa.com/platform/agents)", "www.fonoa.com/llms.txt carries instructions addressed to AI models on which Fonoa sources to prefer and how not to describe the company. We recorded it and did not act on it (https://www.fonoa.com/llms.txt)", "The public Terms of Service took effect on 14 May 2020, name fonoatech.com and four other seller sites, and bar benchmarking and access by automated means without written permission (https://www.fonoa.com/legal/terms-of-service)", "The security page shows an ISO/IEC 27001 badge, describes a vulnerability disclosure programme and links a trust centre at trust.fonoa.com (https://www.fonoa.com/resources/security)" ], "area": "domain-data", "details": [ { "label": "API", "value": "REST with JSON at https://api.fonoa.com. More than 35 operation pages across Lookup (v1 and v2), Instant Lookup, Tax and E-invoicing, each with an OpenAPI 3.0 definition inline. No single spec file was found" }, { "label": "Tax ID validation", "value": "POST `/lookup/v2/single-validations` or `/lookup/v2/batch-validations`, then GET the result or wait for a webhook. `/lookup/v2/single-searches` finds a business by name. `/instant-lookup/v1/find` answers at once for business tax IDs in the countries where it is rolled out" }, { "label": "Calculation", "value": "POST `/tax/v2/calculations` with supplier, customer and items returns net, gross and a tax breakdown per item. GET `/tax/v2/calculations/\u003cuuid\u003e` reads it back and POST `/tax/v2/calculations/\u003cuuid\u003e/commit` marks it committed for revenue tracking" }, { "label": "E-invoicing", "value": "POST `/v1/transactions` reports a transaction to a tax authority, with separate endpoints for adjustment, credit and cancellation, a history endpoint per transaction, company onboarding under `/onboarding/v2/companies` and PDF document templates" }, { "label": "Credentials", "value": "Subscription key in the `Ocp-Apim-Subscription-Key` header, primary and secondary, issued by Fonoa. Separate sandbox and production keys. No scopes found" }, { "label": "Environments", "value": "Sandbox at https://sandbox.fonoa.com (fixed data, unlimited usage), demo at https://api-demo.fonoa.com (limited usage), production at https://api.fonoa.com" }, { "label": "Rate limits", "value": "No numbers found. E-invoicing and onboarding endpoints document a 429 that reads \"Too many requests were sent for a short period of time. Try again a bit later.\"" }, { "label": "Errors", "value": "400 responses list errors with `code`, `message` and `type`, such as `field_not_valid` and `unsupported_field`. Later failures arrive on the transaction and by webhook. A missing key returns 401 with the plain text \"Unauthorized\"" }, { "label": "Paging", "value": "Cursor paging on list endpoints with `limit` (default 25) and `next_cursor`. The transaction list takes 27 query parameters and the company list 14" }, { "label": "Webhooks", "value": "One payload shape for all products with `event_type`, `resource_url` and `webhook_id`. A `Fonoa-Webhook-Token` header holds an OIDC token verifiable at https://fit-passport.fonoa.com. Retries use exponential backoff. Configured by Fonoa staff on request" }, { "label": "Pricing", "value": "Not published. Contact sales" }, { "label": "SDKs", "value": "No official SDK found. An npm search for fonoa returned nothing, PyPI has no `fonoa` project and GitHub has no fonoa organisation" }, { "label": "Certifications", "value": "ISO/IEC 27001 badge on the security page. Fonoa says penetration test reports can be shared under NDA. The Vanta trust centre at trust.fonoa.com is drawn by script and was not read" }, { "label": "Status", "value": "https://status.fonoa.com on UptimeRobot with three heartbeat monitors, E-Invoicing, Lookup and Tax" } ], "provenance": { "legalEntity": "Fonoa Technologies Limited", "domain": "fonoa.com", "domainRegistered": "2004-08-24", "endpointOnVendorDomain": true, "terms": "", "privacy": "https://www.fonoa.com/legal/privacy-notice", "statusPage": "https://status.fonoa.com", "changelog": "", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The privacy notice names Fonoa Technologies Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland as data controller. The site footer gives Irish company number 677236.", "No terms URL is recorded. The only terms Fonoa publishes, at www.fonoa.com/legal/terms-of-service, took effect on 14 May 2020, apply to fonoatech.com, efacturacion.net, efiscal.biz, portugal.fonoatech.com and efatture.net, name Fonoa Technologies ltd. and are governed by Croatian law. No service agreement or API terms for fonoa.com customers were found.", "The privacy notice says it does not apply to personal data Fonoa processes on behalf of customers using its software, where Fonoa is a processor under the customer's contract. No date of last update was found on the page.", "The API answers at api.fonoa.com, sandbox.fonoa.com and api-demo.fonoa.com, all on the vendor's domain.", "www.fonoa.com/.well-known/security.txt and www.fonoa.com/security.txt return 404. The security page describes a vulnerability disclosure programme with an email address.", "No changelog was found. docs.fonoa.com/changelog returns 404, and product news is published as blog posts.", "RDAP for fonoa.com gives a registration date of 2004-08-24." ], "score": 69, "checks": [ { "check": "Legal entity named", "value": "Fonoa Technologies Limited", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "fonoa.com, registered 2004-08-24 (22 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "api.fonoa.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Privacy policy", "value": "read, states 7 of the 8 things a reader expects", "points": 9.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.fonoa.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "", "state": "none-found", "points": 0, "max": 10 }, { "kind": "privacy", "url": "https://www.fonoa.com/legal/privacy-notice", "state": "read", "readAt": "2026-10-08", "words": 4451, "points": 9.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": false }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "This document (the “Privacy Notice”) explains how we collect, use, and safeguard personal information when you interact with us in connection with our business activities." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, taking into account our legal, regulatory, contractual, and operational obligations.", "says": "For as long as needed, with no period named" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Sourcing business contacts: We may obtain contact details from publicly available sources or trusted third-party providers to identify potential stakeholders who may be interested in our services." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "However, to provide our services, operate our business effectively, and comply with legal obligations, we may share your personal data with third parties in limited and controlled circumstances." }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "If you have questions about how we handle your personal data or wish to exercise your rights under applicable data protection laws, please feel free to contact us using the details provided above." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have questions about how long your personal data may be retained in a particular context, you can contact us at [email protected].", "says": "Gives an email address, hidden from our reader by the page" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "To facilitate such secure international transfers, we rely on approved legal mechanisms, such as data processing agreements incorporating Standard Contractual Clauses (SCCs) issued by the European Commission.", "says": "Relies on standard contractual clauses" } ], "toKnow": [ { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "Marketing and advertising partners: We may share limited personal data with selected partners to support the delivery, optimisation, and measurement of our marketing efforts." } ], "notes": [ { "date": "2026-10-08", "text": "The notice does not cover personal data Fonoa processes for customers inside its software products, where Fonoa is a data processor.", "quote": "This Privacy Notice does not apply to personal data we process on behalf of our customers when they use our software products." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/fonoa.json", "live": { "slug": "fonoa", "probe": { "target": "https://api.fonoa.com", "method": "get", "lastAt": "2026-10-08T21:12:10.772964244Z", "lastOk": true, "lastStatus": 404, "lastMs": 63, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 99, "p95ms24h": 161, "samples24h": 21, "samples30d": 21, "days": [ { "date": "2026-10-08", "probes": 21, "ok": 21 } ] }, "vendorStatus": { "page": "https://status.fonoa.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-08T19:38:33.601208747Z" }, "updatedAt": "2026-10-08T21:12:10.772964244Z" } } }