Every IRBM MyInvois endpoint implemented, tested against sandbox and production. All 5 document types. X.509 digital signature. Ready to connect your service to the Malaysian e-Invoice network.
Building a Malaysia e-Invoice integration means covering all IRBM API endpoints — not just document submission. Below is the complete API surface, every one personally implemented and production-tested.
/api/v1.0/documentsubmissions
/api/v1.0/documentsubmissions/{uid}
/api/v1.0/documents/{uid}/details
/api/v1.0/documents/state/{uid}/state
/api/v1.0/documents/state/{uid}/state
/api/v1.0/documents/search
/api/v1.0/taxpayer/validate/{tin}
OAuth 2.0 client credentials token flow
What this means for service providers: If you are building a middleware, ERP connector, or SaaS platform that needs to connect businesses to IRBM's MyInvois, this API layer is complete. Document submission, real-time status polling, rejection detection, cancellation flows, TIN validation, and OAuth token management — all endpoints implemented, tested in sandbox and production, and ready to integrate into your product.
All three phases of Malaysia's mandatory e-invoicing rollout are now active. If your business is not yet compliant, every transaction without a validated IRBM e-invoice is a potential penalty.
Large corporations — the first wave. Mandatory API or MyInvois Portal submission required. LHDN validation and UUID assignment live since August 2024.
Mid-size businesses including manufacturers, distributors, and service firms above RM25M. Mandatory since 1 July 2025. API integration is the standard path for this group.
All Malaysian businesses regardless of turnover must comply as of 1 January 2026. No exemptions remain. If you are not yet connected, every invoice issued without IRBM validation is non-compliant.
Under the Income Tax Act 1967, failure to issue a valid e-invoice carries a penalty of RM200 to RM1,000 per invoice. Repeated or wilful non-compliance can result in fines of up to RM20,000, imprisonment, or both. All deadlines have passed — penalties are now in effect across all business sizes.
IRBM mandates five distinct e-invoice document types. Every type has its own use case, mandatory fields, and issuance party. The complete API integration covers all five.
Standard commercial invoice for any taxable supply of goods or services — B2B and B2C.
Issued to reduce the value of a previously validated invoice — returns, discounts, downward corrections.
Issued to increase the value of a previously validated invoice — additional charges, upward adjustments.
Issued when a settled invoice is subsequently refunded. Distinct from Credit Note in that payment has already occurred.
Buyer issues invoice on behalf of supplier — for agents, dealers, distributors, foreign suppliers, and other IRBM-defined categories.
Every validated e-invoice passes through this five-stage flow. Understanding each step — especially the 72-hour window — is critical to building a correct integration.
Invoice generated with all mandatory IRBM fields: Supplier TIN, Buyer TIN, MSIC code, SST registration, and line-item tax codes. UBL 2.1 XML mapped from internal ERP data structures.
Document signed with X.509 digital certificate. Submission via LHDN API (programmatic — recommended for volume) or MyInvois Portal (manual — for small volumes). Phase 2 and Phase 3 businesses use API integration.
LHDN validates schema, TIN references, tax calculations, and MSIC codes in real time. On success: UUID and QR code assigned. LHDN timestamp starts the 72-hour window.
From LHDN validation timestamp: Buyer may reject (wrong amounts, wrong party); Supplier may cancel. After 72 hours, neither action is possible — invoice is confirmed. Your ERP must monitor and surface alerts.
If not rejected or cancelled, invoice is confirmed. Both parties retain the document — including UUID and QR code — for IRBM's archival period. QR links to LHDN's verification portal.
Every item below reflects work personally built, tested, and deployed in production environments — not knowledge drawn from documentation alone.
Certificate embedded into the submission payload prior to LHDN API call. Covers certificate provisioning, signing algorithm, and signature validation handling.
Submit, get status, get details, cancel, reject, search, validate TIN, and OAuth authentication — all implemented and tested against LHDN sandbox and production.
Internal ERP invoice data mapped to the IRBM UBL 2.1 schema. Covers namespace handling, extension schema compliance, and all mandatory and conditional field population.
MSIC lookup table integrated with product/service catalogue. Automated assignment at line-item level based on product classification rules.
Buyer rejection reflected back into ERP in near real-time. Supplier cancellation with 72-hour enforcement and ERP status synchronisation.
UUID and QR code stored against each invoice record. QR verification link embedded in customer-facing PDF. Archival retention policy implemented.
Complete middleware or SDK layer connecting your service to MyInvois. All 8 endpoints covered: submission, validation, status polling, UUID/QR retrieval, rejection, cancellation, TIN validation, and OAuth.
Connect SAP, Oracle, Xero, SQL Accounting, or custom systems to the e-invoice pipeline. No disruption to existing finance workflows. Covers all 5 IRBM document types.
A structured review of your current invoicing stack, data quality, and team readiness — delivered as a ranked action list with timeline estimates.
Finance and IT team handoff — SOPs covering daily submission, error handling, rejection response, and MyInvois portal navigation. Includes advisory support.
Coverage of all five IRBM document types — including the commonly missed Self-Billed Invoice (buyer-issued) flows for agents, dealers, distributors, and foreign suppliers.
Whether you are building a middleware, connecting an ERP, or assessing your compliance posture — first consultation is complimentary. All three phases are now live.
hello@peppwise.com