Manual
eInvoice Validator for KoSIT (app)Install, work, configure
invoiceTools / Manuals / eInvoice Validator for KoSIT (app)

eInvoice Validator for KoSIT (app) – Manual

Applies to version 2.0.0. As of 28.10.2026.

1 · Overview

The app eInvoice Validator for KoSIT is a page that runs in the browser without installation. You drop an e-invoice on the page, the KoSIT validator checks it, and the validation report appears below. For every finding the report names the field of the invoice and explains the rule in plain language.

The app contains no validator. It sends the invoice to the source of its check. That is the Validator Bridge, a free program that runs the KoSIT validator on your computer or on a server and offers it over HTTP, a website with the plugin eInvoice Validator for KoSIT, or a website with the eInvoice API such as einvoicetools.de. All three offer the same addresses. The source sends the report back, and the app shows it. Without a source the app checks nothing; no other validator stands in.

Caution: The invoice goes to the source set in the settings of the app, and nowhere else. As delivered, that is the bridge on the same computer (http://127.0.0.1:8090).

What the app does:

  • It takes XML invoices and ZUGFeRD and Factur-X PDFs by drag and drop, by file selection or from the clipboard.
  • It shows the report of the KoSIT validator with verdict, findings, field names, explanations and the content of the invoice.
  • It offers the unchanged report as report.xml for download.
  • It speaks German, English and French.
  • It comes as a folder and also as one single file.

What the app does not do:

  • Without a source that is entered and reachable it checks nothing. The page then says that no source is entered or that the service could not be reached.
  • It installs neither the bridge nor the validator.

Requirements:

WhatRequirement
Browsera current Chrome, Edge, Firefox or Safari with JavaScript switched on
Sourcea Validator Bridge from version 1.1.0 with KoSIT loaded, a website with the plugin eInvoice Validator for KoSIT from version 2.0.0, or a website with the eInvoice API from version 2.0.0 that has such a bridge connected
Javaon the computer that runs the bridge, version 11 or later

2 · Setting up the app

As a folder

The folder brings the fonts, the design and the rule catalogue along. As delivered, it loads nothing from a website.

As a single file

The single file carries English and the design Kit H. It loads further languages, the rule catalogues, the fonts and this manual from the website named under site in its settings. It sends nothing from the invoice there.

In a website

The folder examples holds the page embed-one-file-iframe.html. It shows how the single file appears in a frame on a page of your website, without a scroll bar of its own and with the background of your page.

3 · Setting up the Validator Bridge

The bridge has a manual of its own (README.md in its package). For this app three points matter.

How you open the appWhat allowed.origins must contain
through http://localhost or http://127.0.0.1nothing, a bridge in local mode always allows these pages
through the address of a websitethe address of the website with https:// and without a trailing slash, for example https://example.com
with a double click from your own computernull

Important: A page opened with a double click from the disk reports the origin null to the browser. The bridge refuses such a request as long as null is not in allowed.origins. The page then reports that the bridge could not be reached, because the browser does not tell it the reason. Enter null only on a computer you work on yourself: every file you open there may then call the bridge.

Instead of a bridge: a website

A website on which the plugin eInvoice Validator for KoSIT runs with a working KoSIT offers the same check. Enter its address with /wp-json/einvoice/v1 at the end as url under sources.kosit, for example https://example.com/wp-json/einvoice/v1. The website checks for every visitor within the daily limit its plugin sets for guests; a role set to 0 in the table "Daily uploads per role" has no access.

If a website offers the eInvoice API, for example einvoicetools.de, enter its address with /wp-json/einvoice-api/v1 at the end as url and your API key of that website as key. So that the browser may read the answer, the eInvoice API must list the page of the app among its allowed origins.

Important: A website never accepts a page opened from the disk without a key, and an eInvoice API never accepts it at all. Open the app through an address such as http://localhost/… for that, or use a Validator Bridge with null in allowed.origins.

4 · Checking an invoice

Many invoices at once: the batch check

Above the drop area there are two tabs, Single check and Batch check. The batch check is for everyone who checks more than one invoice: the company that wants the incoming invoices of a month at a glance, and the small business that goes through its month folder once.

A PDF without an embedded invoice, such as a scanned invoice, appears as no e-invoice in the overview, so that it is clear it was not checked. A batch takes at most 500 files.

When the validation service asks for a pause because too many checks came in a short time, the batch check waits the time it names and then goes on; the line above the bar says how long. When the quota of the day is used up, the batch stops, and the remaining invoices appear as not checked.

In the eInvoice Viewer

The app brings the button Validate with KoSIT for the app "eInvoice Viewer for PEPPOL & EN16931" from version 3.0.0. The viewer sends the invoice it shows to the source entered for KoSIT in its own settings, and the report appears in the viewer in a tab of its own, "KoSIT Validator".

The viewer in a folder loads nothing from the internet. Its report therefore shows the messages of the validator without the plain-language explanations; this app has the full view with explanations.

5 · Settings

All settings stand in the file config.js in the folder of the app; for the single file they stand in the block at the very top of the file.

SettingMeaning
sources.kosit.urlthe address of the source: a Validator Bridge, a website with the validator plugin ( address ending in /wp-json/einvoice/v1 ) or a website with the eInvoice API ( address ending in /wp-json/einvoice-api/v1 ). As delivered http://127.0.0.1:8090, the bridge on this computer. Empty means: no source, the page checks nothing.
sources.kosit.keyfor a bridge on a server one of the keys in api.keys of its settings, for an eInvoice API your API key of that website. A website with the validator plugin needs no key.
langempty for the language of the browser, otherwise de, en or fr.
designKitthe design: h, a or s.
site, siteNamethe website the page names and from which the single file loads its data.
limittrue asks the daily limit of the website before every check.

Caution: The key in sources.kosit.key is not secret in the browser. Everyone who opens the page can read it. It only keeps casual misuse away; a bridge on the internet also needs allowed.origins and a rate limit in the web server.

6 · What happens to the invoice

  • The invoice goes as a file to the source at sources.kosit.url. It checks the invoice and forgets it afterwards.
  • The page reads and explains the report in the browser.
  • The app sends the invoice nowhere else. The single file loads languages and rule catalogues from the website at site, but sends nothing from the invoice there.

7 · Troubleshooting

What the page reportsWhat to do
The validation service at … could not be reached.Check sources.kosit.url. A bridge must be running and allow the page in allowed.origins; an eInvoice API must list the page among its allowed origins (chapter 3).
The validation service answered with status 401.The key in sources.kosit.key is missing or wrong, or a page opened from the disk asked a website without a key.
The validation service answered with status 403.The eInvoice API has switched this check off, or the website gives guests no access.
The validation service answered with status 429.The daily limit of the website is used up. The message names it; the counter starts again at midnight.
No source for this check is entered.Enter an address under sources.kosit.url in config.js (chapter 5).
The validation service answered with status 503.KoSIT is not available in the source: not loaded in the bridge, no bridge connected to the eInvoice API, or the website has no working validator plugin. Check the path in its settings file and /info.
This PDF carries no invoice XML.The PDF is no ZUGFeRD or Factur-X invoice.
The rule catalogue could not be loaded.The report is complete, only without explanations. The single file needs a connection to the website at site for them.