United Kingdom: Making Tax Digital - supplemented fraud prevention headers setup in Dynamics AX 2012 R3

Applies to: Dynamics


On July 13,2017, the Financial Secretary to the Treasury and Paymaster General in theUnited Kingdom announced that Making Tax Digital (MTD) for value-added tax(VAT) will take effect on April 1, 2019.

To support the MTD for VAT requirements on Dynamics AX 2012 R3 thehotfix was released: KB 4488588.

Additionally,HM Revenue and Customs (HMRC) introduced compulsory to supply headerinformation for VAT API from April 2019 to prevent fraud. For more information,see Fraud prevention.

To preventfraud, APIs of the HMRC provide HTTP headers that must be used to pass auditdata. Support of fraud prevention headers which can be automatically defined bythe system was released in KB 4505299.


As it is explainedin the KB 4505299, for DynamicsAX 2012 R3 fraud prevention headers for “DESKTOP_APP_VIA_SERVER” connection method are implemented.Following headers system (KB 4505299) can define automatically:

HTTP header



An identifier unique to an originating device.


A key-value data structure containing the user identifiers.


The local time-zone of the originating device.


Information related to the originating device’s screens. The fields include:

  • width is the reported width of the screen, in pixels
  • height is the reported height of the screen, in pixels
  • scaling-factor is the reported scaling factor of the screen.
  • color-depth is the color depth of the screen, in bits.


The number of pixels of the window on the originating device in which the user initiated (directly or indirectly) the API call to HMRC.


An attempt to identify the operating system family, version, device manufacturer and model of the originating device.


A key-value data structure of software versions involved in handling a request.


The list of MAC addresses available on the originating device.

Thefollowing headers are required for “DESKTOP_APP_VIA_SERVER” connection method but system cannotdefine them automatically:

HTTP header



The public IP address (IPv4 or IPv6) from which the originating device makes the request.


The public TCP port that the originating device uses when initiating the request.


A list of all local IP addresses (IPv4 and IPv6) available to the originating device.


A key-value data structure of hashed license keys relating to the vendor software initiating the API request on the originating device.


The public IP address of the servers to which the originating device sent their requests.


A list that details hops over the internet between services that terminate TLS.

This hotfixprovides changes in the “Web service parameters” form for system adminto set up fraud prevention headers which cannot be defined by the system automatically.


When youactivate (KB 4505299) transmission of fraud prevention headers duringinteroperating with API of the HMRC, your requests to HMRC will starttransmitting with fraud prevention headers which can be defined automatically.

If youdecide to transmit additionally fraud prevention parameters which cannot bedefined automatically, open “Web service parameters” form and select “Fraudprevention” tab:


Click “Populate”button to automatically add the fraud prevention headers currently requested byHMRC for “DESKTOP_APP_VIA_SERVER” connection method which cannot be defined automatically:


Specifyvalues in the “Value” column for those headers which you want to be sentto HMRC as part of Https requests to VAT API.

You candelete from this list or leave empty values for those headers which you don’twant to send to HMRC as part of Https requests to VAT API.

You can addmanually a header and a value for it to send it to HMRC as part of Https requeststo VAT API.

If “Sandboxbase URL” field on “General” tab is filled in with address of a sandboxweb application, you can validate them with “Test Fraud Prevention HeadersAPI” provided by HMRC: https://developer.service.hmrc.gov.uk/api-documentation/docs/api/service/txm-fph-validator-api/1.0.

Click “Validate”button, to review collected headers’ values:


Validationendpoint path” field contains predefined value: “/test/fraud-prevention-headers/validate”.This is address of “Test Fraud Prevention Headers API” for sandbox webapplications. It is not recommended to change this value unless HMRC would changethis address and officially announced the new one. Click “OK” button to addressyour fraud prevent headers to “Test Fraud Prevention Headers API” forvalidation. “Test Fraud Prevention Headers API” will send response in JSONformat informing results of the validation.

When “Includefraud prevention parameters" parameter is marked on “General”tab, dialog-box with automatically defined and supplementary defined by systemadmin fraud prevention parameters will be shown.

It is recommended to address API requests to HMRC with complete scope offraud prevention headers.

Hotfix information

A supported hotfix is available from Microsoft. There is a "Hotfix download available" section at the top of this Knowledge Base article. If you are encountering an issue downloading, installing this hotfix, or have other technical support questions, contact your partner or, if enrolled in a support plan directly with Microsoft, you can contact technical support for Microsoft Dynamics and create a new support request. To do this, visit the following Microsoft website:


You can also contact technical support for Microsoft Dynamics by phone using these links for country specific phone numbers. To do this, visit one of the following Microsoft websites:
In special cases, charges that are ordinarily incurred for support calls may be canceled if a Technical Support Professional for Microsoft Dynamics and related products determines that a specific update will resolve your problem. The usual support costs will apply to any additional support questions and issues that do not qualify for the specific update in question.

How to obtain the Microsoft Dynamics AX updates files

This update is available for manual download and installation from the Microsoft Download Center.


You must have one of the following products installed to apply this hotfix:

  • Microsoft Dynamics AX 2012 R3

Restart requirement

You must restart the Application Object Server (AOS) service after you apply the hotfix.