Krajowy system e-Faktur

      $filters = [
                    'subjectType' => 'Subject2',
                    'dateRange' => [
                        'dateType' => 'Issue',
                        'from' => '2025-01-01T00:00:00Z',
                        'to' => '2025-12-31T23:59:59Z',
                    ],
                    'ksefNumber' => '6821798692-20251008-010080460A4F-70',
                ];

{"success":true,"hasMore":false,"isTruncated":false,"continuationToken":null,"invoices":[]}

         //Inicjowanie nowej sesji (powstaje klient Http, i spinany jest z wygenerowanym klientem openapi)
         KsefSession.Initialize(KsefConfig.PfxPath, KsefConfig.PfxPassword, trustAllOnTE: true);
         KsefSession.SetAccessToken(contextToken, arn, util);  //contextToken = tokens.AccessToken.Token;

 var mfCert = new X509Certificate2(mfEncCertPath);// Gdzie mfEncCertPath jest certyfikatem sciągniętym z MF -> "/api/v2/security/public-key-certificates";

///// Generuje losowy klucz AES-256 i IV (16 B), a klucz szyfruje publicznym kluczem MF (RSA-OAEP/SHA-256).
/// Zwraca: zakodowany klucz (Base64), IV (Base64)
var (encKeyB64, ivB64) = EncryptionH.MakeSymmetricForOnlineSession(mfCert);


var req = new OpenOnlineSessionRequest
{
    FormCode = new FormCode
    {
        SystemCode = "FA (3)",
        SchemaVersion = "1-0E",
        Value = "FA"
    },
    Encryption = new EncryptionInfo
    {
        EncryptedSymmetricKey = encKeyB64,  
        InitializationVector = ivB64
    }
};
        //I wywołanie
        var resp = await KsefSession.Api.OnlineAsync(req, ct);

// po tym zwrotka -> 403 Forbidden,

        /// <summary>
        /// Otwarcie sesji interaktywnej
        /// </summary>
        /// <remarks>
        /// Otwiera sesję do wysyłki pojedynczych faktur. Należy przekazać schemat wysyłanych faktur oraz informacje o kluczu używanym do szyfrowania.
        /// <br/>
        /// <br/>&gt; Więcej informacji:
        /// <br/>&gt; - [Otwarcie sesji interaktywnej](https://github.com/CIRFMF/ksef-docs/blob/main/sesja-interaktywna.md#1-otwarcie-sesji)
        /// <br/>&gt; - [Klucz publiczny Ministersta Finansów](/docs/v2/index.html#tag/Certyfikaty-klucza-publicznego)
        /// <br/>
        /// <br/>Wymagane uprawnienia: `InvoiceWrite`, `PefInvoiceWrite`.
        /// </remarks>
        /// <returns>Created</returns>
        /// <exception cref="ApiException">A server side error occurred.</exception>
        public virtual async System.Threading.Tasks.Task<OpenOnlineSessionResponse> OnlineAsync(OpenOnlineSessionRequest body, System.Threading.CancellationToken cancellationToken)
        {
            var client_ = _httpClient;
            var disposeClient_ = false;
            try
            {
                using (var request_ = new System.Net.Http.HttpRequestMessage())
                {
                    var json_ = Newtonsoft.Json.JsonConvert.SerializeObject(body, JsonSerializerSettings);
                    var content_ = new System.Net.Http.StringContent(json_);
                    content_.Headers.ContentType = System.Net.Http.Headers.MediaTypeHeaderValue.Parse("application/json");
                    request_.Content = content_;
                    request_.Method = new System.Net.Http.HttpMethod("POST");
                    request_.Headers.Accept.Add(System.Net.Http.Headers.MediaTypeWithQualityHeaderValue.Parse("application/json"));

                    var urlBuilder_ = new System.Text.StringBuilder();
                    if (!string.IsNullOrEmpty(_baseUrl)) urlBuilder_.Append(_baseUrl);
                    // Operation Path: "api/v2/sessions/online"
                    urlBuilder_.Append("api/v2/sessions/online");

                    PrepareRequest(client_, request_, urlBuilder_);

                    var url_ = urlBuilder_.ToString();
                    request_.RequestUri = new System.Uri(url_, System.UriKind.RelativeOrAbsolute);

                    PrepareRequest(client_, request_, url_);

                    var response_ = await client_.SendAsync(request_, System.Net.Http.HttpCompletionOption.ResponseHeadersRead, cancellationToken).ConfigureAwait(false);
                    var disposeResponse_ = true;
                    try
                    {
                        var headers_ = new System.Collections.Generic.Dictionary<string, System.Collections.Generic.IEnumerable<string>>();
                        foreach (var item_ in response_.Headers)
                            headers_[item_.Key] = item_.Value;
                        if (response_.Content != null && response_.Content.Headers != null)
                        {
                            foreach (var item_ in response_.Content.Headers)
                                headers_[item_.Key] = item_.Value;
                        }

                        ProcessResponse(client_, response_);

                        var status_ = (int)response_.StatusCode;
                        if (status_ == 201)
                        {
                            var objectResponse_ = await ReadObjectResponseAsync<OpenOnlineSessionResponse>(response_, headers_, cancellationToken).ConfigureAwait(false);
                            if (objectResponse_.Object == null)
                            {
                                throw new ApiException("Response was null which was not expected.", status_, objectResponse_.Text, headers_, null);
                            }
                            return objectResponse_.Object;
                        }
                        else
                        if (status_ == 400)
                        {
                            var objectResponse_ = await ReadObjectResponseAsync<ExceptionResponse>(response_, headers_, cancellationToken).ConfigureAwait(false);
                            if (objectResponse_.Object == null)
                            {
                                throw new ApiException("Response was null which was not expected.", status_, objectResponse_.Text, headers_, null);
                            }
                            throw new ApiException<ExceptionResponse>("| ExceptionCode | ExceptionDescription | Details |\n|-|-|-|\n| 21405 | B\u0142\u0105d walidacji danych wej\u015bciowych. | {tre\u015b\u0107 b\u0142\u0119du z walidatora} |", status_, objectResponse_.Text, headers_, objectResponse_.Object, null);
                        }
                        else
                        if (status_ == 401)
                        {
                            string responseText_ = ( response_.Content == null ) ? string.Empty : await ReadAsStringAsync(response_.Content, cancellationToken).ConfigureAwait(false);
                            throw new ApiException("Unauthorized", status_, responseText_, headers_, null);
                        }
                        else
                        if (status_ == 403)
                        {
                            string responseText_ = ( response_.Content == null ) ? string.Empty : await ReadAsStringAsync(response_.Content, cancellationToken).ConfigureAwait(false);
                            throw new ApiException("Forbidden", status_, responseText_, headers_, null);
                        }
                        else
                        {
                            var responseData_ = response_.Content == null ? null : await ReadAsStringAsync(response_.Content, cancellationToken).ConfigureAwait(false);
                            throw new ApiException("The HTTP status code of the response was not expected (" + status_ + ").", status_, responseData_, headers_, null);
                        }
                    }
                    finally
                    {
                        if (disposeResponse_)
                            response_.Dispose();
                    }
                }
            }
            finally
            {
                if (disposeClient_)
                    client_.Dispose();
            }
        }

<?xml version="1.0" encoding="utf-8"?>
<Error><Code>AuthenticationFailed</Code><Message>Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.
RequestId:b3538f30-301e-0023-106c-38298d000000
Time:2025-10-08T15:56:44.3593182Z</Message></Error>

Debug	2025-10-08 12:33:14.822 <KSeF.Services.HttpRequestsObserver> after 18.270s:
	Sending HTTP request:
 	URL: https://ksef-test.mf.gov.pl/storage/09/20251008-sb-2437e09000-81339aaf3f-f3/batch-parts/part_1.zip.aes?skoid=0e92608a-831d-404b-9945-197ed82a5dbc&sktid=647754c7-3974-4442-a425-c61341b61c69&skt=2025-10-07T15%3A51%3A21Z&ske=2025-10-14T15%3A51%3A21Z&sks=b&skv=2025-01-05&sv=2025-01-05&st=2025-10-08T10%3A27%3A57Z&se=2025-10-08T11%3A02%3A57Z&sr=b&sp=w&sig=YQYkr1jH2n3XXuGFuNve%2B5Hve7Wu%2FcKpmPz2lLJK4h4%3D
	Method: PUT
	HTTP Headers:
	
	Data:	Content-Type: application/octet-stream
		x-ms-blob-type: BlockBlob
		Content-Length: 4112
		
		--- cannot log this kind of data  --- 


Debug	2025-10-08 12:33:15.489 <KSeF.Services.HttpRequestsObserver> after 667ms:
	Received HTTP response:	201 (Created)
	Data:	Content-Length: 0
		Content-MD5: X5GsfBv1aNCkYrHsVMmDQg==
		Last-Modified: Wed, 08 Oct 2025 10:33:16 GMT
		
		--- cannot log this kind of data  --- 

	HTTP response headers:
	Date: Wed, 08 Oct 2025 10:33:16 GMT
	Connection: keep-alive
	ETag: "0x8DE06561796A95B"
	x-ms-request-id: 64592f99-101e-0012-283e-38eeb6000000
	x-ms-version: 2025-01-05
	x-ms-content-crc64: B3mtI3vqjfI=
	x-ms-request-server-encrypted: true
	x-azure-ref: 20251008T103316Z-186c9596587mhd28hC1CAIcuwc000000031g000000005qrx
	X-Cache: CONFIG_NOCACHE
	Set-Cookie: visid_incap_3145183=OJ0SL21lSiqAPebJ9vZiC+s95mgAAAAAQUIPAAAAAABhJnTMJQErMkn/diK4maG5; expires=Wed, 07 Oct 2026 23:07:08 GMT; HttpOnly; path=/; Domain=.mf.gov.pl, nlbi_3145183=Cqapd3WKn0NWYseDrQ6yoAAAAAC5w1+tJheo9hWYg2MkUtJt; HttpOnly; path=/; Domain=.mf.gov.pl, incap_ses_520_3145183=2xY6KRteq2Wz1KMRZGk3B+s95mgAAAAA08q1aA/nILOvIXaYTQKHVQ==; path=/; Domain=.mf.gov.pl
	X-CDN: Imperva
	X-Iinfo: 11-91081098-91081099 NNNN CT(67 156 0) RT(1759919596037 15) q(0 0 2 0) r(6 6) U6

 private function getRsa(): RSA\PublicKey
    {
  //  'public_key_path' => env('KSEF_PUBLIC_KEY_PATH', storage_path('app/ksef/ksef_public.pem')), <- klucz pem z ministerstwa cyfryzacji(ważny do 2027-09-29T06:03:18Z).
    $pemPath = config('ksef.public_key_path'); 
    $pem = @file_get_contents($pemPath);
    
    if ($pem === false) {
     throw new \RuntimeException("Nie mogę odczytać pliku klucza publicznego KSeF: {$pemPath}");
    }
    
    return PublicKeyLoader::load($pem)
      ->withPadding(RSA::ENCRYPTION_OAEP)
       ->withHash('sha256')
      ->withMGFHash('sha256');
}

....(część kodu odpowiadająca za tworzenie wsadu)...
$sessionUrl = $this->http->url($company->env, '/api/v2/sessions/online');

$aesKey = random_bytes(32); // AES-256
 $iv     = random_bytes(16); // 16B

 $encKey = $this->getRsa()->encrypt($aesKey); // RSA-OAEP SHA-256

 $enc = [
   'payload' => [
      'encryptedSymmetricKey' => base64_encode($encKey),
      'initializationVector'  => base64_encode($iv),
   ],
   'raw' => compact('aesKey', 'iv'), // RAW bytes
];

$res = Http::acceptJson()
   ->withToken($company->access_token)
   ->asJson()
   ->post($sessionUrl, [
       "formCode" => [
         "systemCode"=> "FA (3)",
         "schemaVersion"=> "1-0E",
         "value"=>"FA"
       ],
     "encryption" => $enc['payload'],
 ])
->throw()
 ->json();
//normalnie otrzymuję referenceNumber
 $reference = $res['referenceNumber'] ?? null;


//odpowiedź z serwera: 415 Błąd odszyfrowania dostarczonego klucza
 $test = $this->http->url(
          $company->env,
          "/api/v2/sessions/{$session->reference_number}"
 );

  "exception" => array:3 [▼
    "exceptionDetailList" => array:1 [▼
      0 => array:2 [▼
        "exceptionCode" => 500
        "exceptionDescription" => "Wystąpił nieoczekiwany błąd."
      ]
    ]
    "serviceCode" => "00-7f49b3a8e8a75f097fab1b47fdb87d4d-fb91b80a0091d9f8-00"
    "timestamp" => "2025-10-09T10:22:59.7109009Z"
  ]
]

"encryption" => array:2 [▼
    "encryptedSymmetricKey" => "tbZ/Wj8QH2aFa0X1J6qI42EIm5RgatEpfoVgs3rQ4/M="
    "initializationVector" => "4N0xmgO+R3X6rM3b8aILgw=="
  ]
  "subjectType" => "Subject1"
  "dateRange" => array:3 [▼
    "dateType" => "Issue"
    "from" => "2025-10-01T00:00:00Z"
    "to" => "2025-12-31T23:59:59Z"
  ]
  "formType" => "FA"