Skip to content

Authorisation certificates and sub-user certificate error messages

In order to access online services from ROS, a ROS Digital Certificate is required. This certificate needs to be uploaded to SimplePay so that Revenue Payroll Notifications (RPNs) can be requested from ROS, and payroll information can be submitted directly to ROS through SimplePay.

A sub-user certificate is a term given to a user who needs access to an Authorisation Certificate in order to perform certain payroll actions but should be allowed to view only specific information.

Certificate permission issues

If there is an issue with sub-user certificates and their permissions on a ROS Authorisation Certificate, an admin user needs to have filing permissions on the certificate in order to correct the issue. These permissions give the sub-user certificate the same permissions as the admin-user certificate.

When the user has the correct permissions, they should be able to:

  1. Look up RPNs.
  2. Request RPNs.
  3. Submit Payroll and Check Payroll Submissions/Runs.
  4. Look up Returns Reconciliations and Statement of Account.
  5. Have permission to View/Accept Returns and Submit Payments.

For more information on the sub-user permissions, see the guide from Revenue here.

Permission error messages

Auth status: “Failure” Invalid format Employer Registration Number

  • Check that the correct registration number is captured on SimplePay, by going to Settings > Employer Filing Details.
  • Remove and upload the certificate again.
  • To remove the certificate, click Edit on the current certificate, uncheck the box in the Linked column next to the company's name, and Save.
  • Click on the Profile Icon ( ) > ROS Auth Cert > Add New Certificate.

Auth Status: Failure (Error 1016: Cert not active)

This error message will occur in two instances:

  1. The password of the ROS Digital Certificate was changed after it was added to SimplePay.
  2. The ROS Digital Certificate has expired.

You will need to download an updated/new certificate from ROS, and add it to SimplePay. More information can be found on the following help page:

Auth Status: Failure (Error 1011: Cert does not have appropriate permissions)

  • You will first need to update your permissions in ROS as the certificate might require more permissions.
  • Obtain a new certificate from ROS, and upload it to SimplePay once again.

Auth Status: Failure (No error message)

  • If the certificate fails and there’s no error message, please ensure that your Registered number and Tax Advisory Identity Number (TAIN) (if applicable) are correct.
  • If you’ve uploaded the certificate with “Payroll (with ERR)” as the permissions, and the certificate fails with no error message, please download the certificate again from ROS after ERR has been enabled for 48 hours. Note that, before you upload and link the new certificate, you should mark the previous certificate as inactive, or delete it.

Linking error messages

You might get some errors that are not related to permissions or sub-users but are, instead, related to the linking of certificates.

Unauthorised request: Invalid ROS Digital Certificate provided (code 1014)

This means that the certificate is outdated or invalid. If you upload and link a valid certificate, you should be able to submit successfully.

This means there is an issue either with the company not being linked to your TAIN, or the captured Registered Number not matching the certificate. You should check that the correct employer registration number is captured on SimplePay under Settings > Employer Filing Details.

The registration number is typically 7 digits and 2 letters (e.g. 1234567AB).

Registration number

The registration number referred to above is your PAYE registration number, and it does not have "IE" at the beginning (unlike the VAT number).

Employer Registration Number not found (code 1003)

This message appears if the wrong employer registration number is entered in the company details. To resolve this, check that your employer registration number is correct on ROS, and amend the Registered Number on SimplePay if necessary. Then, re-upload and link the certificate.