EFRIS integration that already knows where the spec is wrong.

A Python client for Uganda Revenue Authority's EFRIS, covering all ~70 interfaces — invoicing, credit notes, goods, stock, fuel/EDC. You get the source.

Pricing & licensing Read the error-code reference

Transcribing the spec is the easy part

Turning URA's PDF into seventy endpoint methods is a weekend of tedium, and any competent developer — or a decent coding model — can do it. That is not what this is.

A faithful implementation of the documentation does not work. The specification is wrong in specific places, and the service tells you so only with a number. These are the places:

• The cipher is AES-128-ECB — the one mode every security guide says never to use. A careful implementer reaches for CBC and loses days to invalid signature.
• Signing is SHA1, not SHA256.
• The signature covers the transmitted ciphertext, not the plaintext JSON.
• The key field in the handshake response is spelled passowrdDes, and the key it carries is base64-encoded twice.
• summary.taxAmount must include excise while summary.grossAmount must exclude it — two rules pulling in opposite directions, and each has its own error number.
• URA documents T119 as encrypted. The live service accepts it unencrypted.

Every one of those cost real time to find, against a sandbox that answers with a bare code. They are documented in full in the error reference, and already handled in the code.

What using it looks like

from efris import EfrisClient, EfrisConfig

client = EfrisClient(EfrisConfig(
    tin="1000000000",
    cert_path="/secure/certs/1000000000.pfx",
    cert_password=os.environ["EFRIS_CERT_PASSWORD"],
    test_mode=True,
))

client.get_server_time()          # proves connectivity before crypto
result = client.upload_invoice(document)   # T109 — fiscalised

The T104 handshake, session-key caching, encryption and response decoding happen underneath. Failures raise with URA's own code, so you branch on the number instead of parsing prose:

try:
    client.upload_invoice(document)
except EfrisError as exc:
    if exc.code == "2253":     # duplicate seller reference
        ...

Built for multi-tenant use

Nothing is global. A client is bound to one configuration and holds its own session key, so an ERP serving many taxpayers keeps one client per tenant and they never share cryptographic state. Credentials come from wherever you keep them — a database row, a secrets manager, per-tenant files.

registry.for_tenant("acme").upload_invoice(document)

Pricing

Most Ugandan businesses pay around 1,000,000 UGX per year for EFRIS API access, regardless of provider. This is the buy-instead-of-rent option: you get the source, and you stop renewing.

Payable in USD or UGX. UGX figures are indicative and settled at the rate on the invoice date. Integration support and done-for-you setup are quoted separately.

Get in touch

Licensing questions, a demo against the sandbox, or help with an integration that is already stuck:

[email protected]

Independent software. Not affiliated with, endorsed by, or operated by the Uganda Revenue Authority. "EFRIS" refers to URA's system, which this library integrates with.