Document verification
Posted sales invoices, credit and debit notes, receipts, payment vouchers, quotations, sales orders, delivery notes and purchase orders carry a QR code when printed. The QR opens a public page, /verify/<code>, that anyone can use to check the document is genuine. This QR is separate from any legal e-invoice QR required by a tax authority, which is printed as that authority specifies.
What does the public verification page show?
Only the document type and number, the issuing company's name, the date, the total and currency (the company can hide the total), whether the document is still valid or was cancelled, reversed or replaced, and whether its stored details still match their fingerprint. It never shows line items, the customer, or any other private data.
Can someone guess a verification code?
No. A code is 32 characters long (192 bits), derived from a server secret, and only a hash of it is stored. Wrong, unknown and malformed codes all get the same "not found" answer, and checks are limited per network address.
What happens when a document is cancelled or reversed?
Its code is revoked in the same database transaction, so the public page shows "Cancelled" or "Reversed" from that moment. An owner, CFO or accountant can also revoke a code with a reason.
What does "matches the issuer's records" mean?
Each code's public details and a digest of the whole document are hashed when the code is issued, and every code is linked to the previous one in a chain per company. The page recomputes the hash and checks the link to the previous code.
Does a reprint get a new code?
No. A reprint shows the same code, so copies already sent stay valid.
API
GET /api/public/verify/{code} returns the same facts as JSON. Company settings: GET and PUT /api/verify-settings (owner or CFO). Revoke: POST /api/verify/documents/{doc_id}/revoke.