> ## Documentation Index
> Fetch the complete documentation index at: https://developer.sandbox.co.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Generate certificates with a deductor token

> Authenticate a TRACES deductor, create a Form 131 or Form 133 certificate job, poll its status, and download PDF ZIP files with cURL.

Generate Form 131 TDS or Form 133 TCS certificates from TRACES with a deductor access token. You manage the deductor session and continue polling until the certificate job succeeds or fails.

## Before you start

* Obtain a Sandbox API key and access token using the [Quickstart guide](https://developer.sandbox.co.in/guides/get-started/quickstart.md).
* Keep the deductor's TAN and TRACES password ready.
* Confirm that TRACES has processed the relevant statement and made the certificates available for the requested period.

The example generates Form 131 certificates for `TY 2026-27`, `Q1`. Replace the sample TAN, period, and placeholders with your own values.

## Generate Form 131 certificates

### 1. Authenticate the deductor

Call [Authenticate a TRACES deductor](https://developer.sandbox.co.in/api-reference/tds/compliance/traces/endpoints/authenticate.md) with your Sandbox access token in the `Authorization` header.

> **Deductor authentication request**
>
> ```bash theme={null}
> curl --request POST \
> --url https://api.sandbox.co.in/tds/traces/deductors/authenticate \
> --header 'Authorization: {sandbox-access-token}' \
> --header 'Content-Type: application/json' \
> --header 'x-api-key: {sandbox-api-key}' \
> --data '{
> 	"@entity": "in.co.sandbox.tds.compliance.traces.authentication.request",
> 	"tan": "AHMA12345A",
> 	"password": "{traces-password}"
> }'
> ```

Save `data.access_token` as your deductor access token and `data.refresh_token` as your deductor refresh token. Use the deductor access token in the `Authorization` header for certificate requests.

### 2. Create the certificate job

Call [Create a certificate job with a deductor token](https://developer.sandbox.co.in/api-reference/tds/compliance/certificates/endpoints/submit_with_deductor_token.md) with `131` in the path. The token identifies the TAN. Send only `@entity`, `tax_year`, and `quarter` in the body.

> **Certificate job request**
>
> ```bash theme={null}
> curl --request POST \
> --url https://api.sandbox.co.in/tds/compliance/traces/deductor/certificates/131 \
> --header 'Authorization: {deductor-access-token}' \
> --header 'Content-Type: application/json' \
> --header 'x-api-key: {sandbox-api-key}' \
> --data '{
> 	"@entity": "in.co.sandbox.tds.compliance.certificate.job.request",
> 	"tax_year": "TY 2026-27",
> 	"quarter": "Q1"
> }'
> ```

Save `data.job_id` from the response. The job starts with `data.status` set to `in_progress`.

### 3. Check the certificate job status

Call [Get certificate job status with a deductor token](https://developer.sandbox.co.in/api-reference/tds/compliance/certificates/endpoints/poll_with_deductor_token.md) with the returned `job_id` and the same certificate type.

> **Certificate status request**
>
> ```bash theme={null}
> curl --request GET \
> --url 'https://api.sandbox.co.in/tds/compliance/traces/deductor/certificates/131/status?job_id={job_id}' \
> --header 'Authorization: {deductor-access-token}' \
> --header 'x-api-key: {sandbox-api-key}'
> ```

Continue polling while `data.status` is `in_progress`, including while TRACES prepares the certificate files. When `data.status` is `failed`, stop polling and read `data.message` for the reason. A failed job still returns HTTP `200`.

### 4. Download the certificate ZIP files

When `data.status` is `succeeded`, the response includes one or more signed URLs in `data.certificate_pdf_zip_urls`.

Response excerpt:

```json theme={null}
{
"data": {
	"job_id": "4d882797-f968-474e-b05b-85cb5eba3d9a",
	"status": "succeeded",
	"certificate_pdf_zip_urls": [
		"{certificate-pdf-zip-url}"
	]
}
}
```

Download each ZIP file, which contains certificate PDFs.

> **Certificate ZIP download request**
>
> ```bash theme={null}
> curl --request GET \
> --url '{certificate-pdf-zip-url}' \
> --output form-131-certificates.zip
> ```

## Generate Form 133 TCS certificates

Replace `131` with `133` in both the create and status URLs. Use the same request body fields and deductor authentication flow.

## Resume after token expiry

If a status request returns HTTP `403` because the deductor access token expired, call [Refresh a TRACES deductor session](https://developer.sandbox.co.in/api-reference/tds/compliance/traces/endpoints/refresh.md). Send the deductor refresh token in `Authorization`.

```bash theme={null}
curl --request POST \
	--url https://api.sandbox.co.in/tds/traces/deductors/refresh \
	--header 'Authorization: {deductor-refresh-token}' \
	--header 'x-api-key: {sandbox-api-key}'
```

Replace both saved deductor tokens with the returned `data.access_token` and `data.refresh_token`. Retry the status request with the new access token and the same `job_id`.

If the refresh token has expired or is rejected, authenticate the same deductor again. Resume polling the existing `job_id` with the new deductor access token.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.