vporiadku API 1.3.0

OpenAPI 3.1: https://api.vporiadku.sk/api/v1/openapi.json · Guide: https://vporiadku.sk/sk/vyvojari · Base URL: https://api.vporiadku.sk/api/v1

The contract

The vporiadku public REST API: documents and their lifecycle, payments, clients, the item catalogue, expenses, received e-invoices, recurring schedules, issuer profiles, bank accounts and webhook endpoints of one workspace. Human-readable guide: https://vporiadku.sk/sk/vyvojari

Authentication: two credentials, held to the same scopes. An **API key** belongs to one workspace: send it as Authorization: Bearer fak_… or X-API-Key: fak_…. Keys are created in the app under Settings → API by the workspace owner or an admin, and need the Firma add-on module. The full key is shown once; only its SHA-256 is stored. A **partner app** serving many workspaces uses OAuth 2.0 instead and sends an access token as Authorization: Bearer vpa_…. Either acts as the owner of its workspace and never reaches another.

OAuth 2.0 for partner apps: register the app under Settings → API → Apps to get a client_id (vpc_…) and a client secret (vps_…, shown once). Send the customer to https://vporiadku.sk/oauth/authorize with response_type=code, your client_id, a registered redirect_uri (exact match, always required), the space-separated scope you need, a state, and PKCE: code_challenge with code_challenge_method=S256 (required). The customer signs in, picks the workspace and approves; the browser comes back with code and state, or with error=access_denied. Exchange the code within 10 minutes at POST https://api.vporiadku.sk/api/oauth/token (application/x-www-form-urlencoded: grant_type=authorization_code, code, redirect_uri, code_verifier; client authentication by HTTP Basic or client_id + client_secret). The answer carries access_token (valid 60 minutes), refresh_token, scope and the connected workspace_id. Refresh with grant_type=refresh_token: every refresh returns a new refresh token and spends the old one (valid 365 days from issue); presenting a spent one again more than 30 seconds later revokes the whole chain. Revoke a token at POST https://api.vporiadku.sk/api/oauth/revoke (RFC 7009); revoking the last refresh token disconnects the app from the workspace. Token endpoint errors follow RFC 6749 §5.2 ({ "error", "error_description" }). An expired access token answers 401 with WWW-Authenticate: Bearer error="invalid_token". Refresh and retry. The workspace sees the app under Settings → API → Connected apps and may disconnect it at any time; its tokens then stop working at once.

Scopes: every key carries the scopes it was created with, and every access token what the customer approved; an operation they do not cover answers 403 API_KEY_SCOPE_MISSING (for an access token also WWW-Authenticate: Bearer error="insufficient_scope"). Writing a resource implies reading it. Keys issued before scopes existed carry * (full access). The scopes:

Rate limits: 120 requests per 60 seconds per key (and per partner app in each workspace it is connected to) across all endpoints, in fixed windows. Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (seconds until the window refills); over the limit the answer is 429 RATE_LIMIT_EXCEEDED with Retry-After. 30 failed authentications per 60 seconds from one address block that address until the window ends; an expired access token is not counted as one.

Idempotency: send Idempotency-Key on a POST or PATCH to make it safe to retry. Keys are scoped to the API key, or to the partner app in the workspace (they survive a token refresh), and remembered for 24 hours. A repeat with the same method, path and body is answered with the stored response and Idempotent-Replayed: true, and runs nothing; the same key with a different request answers 409 IDEMPOTENCY_KEY_REUSED, and a repeat while the first is still running 409 IDEMPOTENCY_KEY_IN_USE. Only successful responses are stored, so a request that failed can be retried with the same key.

Pagination: lists take page (1-based) and limit (default 20, at most 100) and answer { data, total, page, limit }. The document list also filters and sorts (see listInvoices), including updatedSince for an incremental sync.

Errors: { "data": null, "meta": null, "error": { "code", "message", "details" } }. Switch on error.code; the message is English prose and may change. Unknown body fields are a 400, not silently dropped. Success bodies are the resource itself (or the page object), with no envelope.

Money is a decimal number in the document currency; dates are YYYY-MM-DD, timestamps ISO 8601 UTC; ids are UUIDs.

Webhooks: the webhooks section lists every event vporiadku can push. Endpoints are registered under Settings → API → Webhooks, or through /webhooks by an API key or a partner app with webhooks:write. Through the API an endpoint may carry only events whose data the credential can read:

ping is open to every credential; bank-feed, VAT-report, subscription and team events stay in the app.

meta

Checking a key.

GET /ping

Check a key or an access token: its workspace, plan and scopes #

Needs no scope, so any valid key can be tested with it.

Required scope: none (any valid key).

Responses

StatusMeaningBody
200The key works.application/json: Ping
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

invoices

Invoices and every other document type (proforma, advance, credit and debit note, quote, delivery note, orders, cancellation) and their lifecycle.

GET /invoices

List documents (invoices and every other document type) #

Every document type (invoices, proformas, credit notes, quotes, …), each with its lines, client and bank account. Filters combine: type, status, payment state (overdue tests the due date, not just the status), client, a date range on the issue, supply or due date (dateType), a named period, number range, tags, currency, free text over the number and the client name, and updatedSince for an incremental sync. Newest first by the filtered date unless sortBy says otherwise; ties are broken by creation time and id, so paging never repeats or skips a row.

Required scope: invoices:read.

Parameters

NameInTypeNotes
pagequeryinteger (≥ 1, default 1)
limitqueryinteger (≥ 1, ≤ 100, default 20)
sortByquerystring
number clientName issueDate dueDate validUntil totalGross updatedAt
sortDirectionquerystring
asc desc
documentTypequerystring
invoice proforma advance credit_note debit_note quote delivery_note order_received order_sent cancellation payment_tax_document
statusquerystring
draft issued sent pending partially_paid paid overdue cancelled accepted rejected expired confirmed delivered completed
searchquerystring (max length 100)
dateTypequerystring
issue delivery due
periodquerystring
this_month last_month this_quarter this_year last_year all custom
dateFromquerystring (date)
dateToquerystring (date)
clientIdquerystring (uuid)
paymentStatequerystring
unpaid partially_paid paid overdue not_yet_due
numberFromquerystring (max length 50)
numberToquerystring (max length 50)
tagsqueryarray of string
currencyquerystring
updatedSincequerystring (date-time)

Responses

StatusMeaningBody
200One page of documents.application/json: InvoiceList
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

POST /invoices

Create a document #

Totals sent by the client are accepted but ignored: the server always recomputes them. A document posted with a live status (e.g. issued) is issued in the same request. Leave invoiceNumber out to take the next number of the series. A foreign currency needs a plan that includes it; quotes, delivery notes and orders need the commercial-documents feature.

Required scope: invoices:write.

Parameters

NameInTypeNotes
Idempotency-Keyheaderstring (min length 1, max length 255)Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key.

Request body

CreateInvoice

Responses

StatusMeaningBody
201The created document.application/json: Invoice
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
409The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE).application/json: Error
422A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

GET /invoices/{id}

Get one document with its lines and client #

Required scope: invoices:read.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.

Responses

StatusMeaningBody
200The document.application/json: Invoice
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

PATCH /invoices/{id}

Update a document that is still editable #

An issued document is locked: only its lifecycle flags can still change, and a correction is a credit note. Send only the fields to change.

Required scope: invoices:write.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.
Idempotency-Keyheaderstring (min length 1, max length 255)Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key.

Request body

UpdateInvoice

Responses

StatusMeaningBody
200The updated document.application/json: Invoice
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
409The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE).application/json: Error
422A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

DELETE /invoices/{id}

Delete a draft that has no payments (it goes to the recycle bin) #

Only a draft with no payment recorded can be deleted; it goes to the recycle bin for 30 days. An issued document is voided with cancel.

Required scope: invoices:write.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.

Responses

StatusMeaningBody
204Deleted.—
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
409The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE).application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

GET /invoices/{id}/pdf

Download a document as the PDF its customer receives #

The same renderer the dashboard and the customer portal use: what you archive is what the customer received.

Required scope: invoices:read.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.

Responses

StatusMeaningBody
200The PDF.application/pdf: string (binary)
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error
503PDF_RENDERER_BUSY or SERVICE_UNAVAILABLE: retry with backoff.application/json: Error

GET /invoices/{id}/isdoc

Download a document as ISDOC 6.0.1 XML for accounting software #

ISDOC 6.0.1, the XML Czech and Slovak accounting software imports. Quotes, orders and delivery notes are not accounting documents and have no ISDOC form (409 DOCUMENT_NOT_EXPORTABLE). Needs the accounting-export feature of the plan, as the export in the dashboard does.

Required scope: invoices:read.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.

Responses

StatusMeaningBody
200The ISDOC XML.application/xml: string
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
409The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE).application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

GET /invoices/{id}/ubl

Download an issued invoice as Peppol BIS Billing 3.0 UBL XML #

The Peppol BIS Billing 3.0 (EN 16931) UBL 2.1 XML an e-invoice carries, after the same validation a send runs: a document that would be refused answers 422 with what is missing. Needs the e-Faktúra module.

Required scope: invoices:read.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.

Responses

StatusMeaningBody
200The UBL XML.application/xml: string
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
409The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE).application/json: Error
422A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

POST /invoices/{id}/issue

Issue a draft: fix its number and lock its content #

Keeps the number the draft was given from its series when it was created (or sets number when given), freezes the content and marks the document issued. Issuing an issued document changes nothing.

Required scope: invoices:write.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.
Idempotency-Keyheaderstring (min length 1, max length 255)Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key.

Request body (optional)

IssueInvoice

Responses

StatusMeaningBody
200The issued document.application/json: Invoice
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
409The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE).application/json: Error
422A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

POST /invoices/{id}/duplicate

Copy a document into a new draft with today's dates and the next number #

The copy is a new draft dated today (its due date and validity keep their distance from the issue date, a supply date becomes today), numbered from its series, with the client, lines, currency and texts of the original and a link back to it (sourceDocumentId). Payments do not carry over. A storno or a tax document of a payment cannot be copied (422). Counted against the plan like any new document.

Required scope: invoices:write.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.
Idempotency-Keyheaderstring (min length 1, max length 255)Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key.

Responses

StatusMeaningBody
201The new draft.application/json: Invoice
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
422A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

POST /invoices/{id}/send

E-mail an issued document to its client with the PDF attached #

E-mails the document to the client's address with the PDF attached, from the workspace's own SMTP when it has one. The client must have an e-mail address; a draft is refused.

Required scope: invoices:write.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.
Idempotency-Keyheaderstring (min length 1, max length 255)Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key.

Responses

StatusMeaningBody
200Sent or queued.application/json: SendResult
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
409The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE).application/json: Error
422A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

POST /invoices/{id}/reminder

E-mail a payment reminder for an unpaid document #

Only for a document that asks for payment and still has something outstanding.

Required scope: invoices:write.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.
Idempotency-Keyheaderstring (min length 1, max length 255)Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key.

Responses

StatusMeaningBody
200Sent or queued.application/json: SendResult
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
409The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE).application/json: Error
422A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

POST /invoices/{id}/credit-note

Issue a credit note (dobropis) against an invoice #

Without items the whole invoice is credited; with items only those lines, given with positive amounts (the server negates them). The credit note is linked back to the invoice and may not exceed what is left of it.

Required scope: invoices:write.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.
Idempotency-Keyheaderstring (min length 1, max length 255)Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key.

Request body (optional)

CreateCreditNote

Responses

StatusMeaningBody
201The credit note.application/json: Invoice
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
409The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE).application/json: Error
422A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

POST /invoices/{id}/cancel

Void an issued document with a cancellation (storno) document #

Raises a cancellation (storno) document against the issued document and marks it cancelled. Nothing is deleted.

Required scope: invoices:write.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.
Idempotency-Keyheaderstring (min length 1, max length 255)Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key.

Request body (optional)

CancelInvoice

Responses

StatusMeaningBody
201The cancellation document.application/json: Invoice
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
409The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE).application/json: Error
422A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

payments

Money received against documents.

GET /invoices/{id}/payments

List the payments recorded on a document #

Required scope: payments:read.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.
pagequeryinteger (≥ 1, ≤ 1000000)
limitqueryinteger (≥ 1, ≤ 100)

Responses

StatusMeaningBody
200One page of payments.application/json: PaymentList
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

POST /invoices/{id}/payments

Record a payment; once the document is covered it becomes paid #

Moves the document to partially paid or paid, raises the tax document of a payment on an advance invoice, fires payment.recorded and sends the thank-you e-mail when the workspace has it on. An amount over what is outstanding is refused unless allowOverpayment is true.

Required scope: payments:write.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.
Idempotency-Keyheaderstring (min length 1, max length 255)Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key.

Request body

CreatePayment

Responses

StatusMeaningBody
201The recorded payment.application/json: Payment
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
409The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE).application/json: Error
422A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

POST /invoices/{id}/mark-paid

Settle a document in full: record what is still outstanding as one payment #

Records what is still outstanding as one payment, like the dashboard's "mark as paid". With nothing outstanding only the status moves. A draft cannot be settled; an already paid document answers 409.

Required scope: payments:write.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.
Idempotency-Keyheaderstring (min length 1, max length 255)Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key.

Request body (optional)

MarkInvoicePaid

Responses

StatusMeaningBody
200The paid document.application/json: Invoice
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
409The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE).application/json: Error
422A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

DELETE /payments/{id}

Delete a recorded payment; the document status follows #

The document's status is recomputed from the payments that remain.

Required scope: payments:write.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.

Responses

StatusMeaningBody
204Deleted.—
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
409The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE).application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

clients

The client directory.

GET /clients

List clients #

Newest first unless sortBy says otherwise; ties are broken by id, so paging never repeats or skips a client. updatedSince returns only clients changed since then, for an incremental sync.

Required scope: clients:read.

Parameters

NameInTypeNotes
searchquerystring (max length 120)
pagequeryinteger (≥ 1, default 1)
limitqueryinteger (≥ 1, ≤ 100, default 20)
updatedSincequerystring (date-time)
sortByquerystring
name createdAt updatedAt
sortDirectionquerystring
asc desc

Responses

StatusMeaningBody
200One page of clients.application/json: ClientList
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

POST /clients

Create a client #

Refused with 409 CLIENT_DUPLICATE_SUSPECTED when the directory already holds a client that looks the same, unless allowDuplicate=true. The Start plan is limited to 5 clients (403 PLAN_LIMIT_REACHED).

Required scope: clients:write.

Parameters

NameInTypeNotes
allowDuplicatequerystring
true false
true saves past the duplicate warning.
Idempotency-Keyheaderstring (min length 1, max length 255)Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key.

Request body

CreateClient

Responses

StatusMeaningBody
201The created client.application/json: Client
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
409The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE).application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

GET /clients/{id}

Get one client #

Required scope: clients:read.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.

Responses

StatusMeaningBody
200The client.application/json: Client
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

PATCH /clients/{id}

Update a client #

Required scope: clients:write.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.
Idempotency-Keyheaderstring (min length 1, max length 255)Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key.

Request body

UpdateClient

Responses

StatusMeaningBody
200The updated client.application/json: Client
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

DELETE /clients/{id}

Delete a client no document names (it goes to the recycle bin) #

A client named by any document cannot be deleted (409).

Required scope: clients:write.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.

Responses

StatusMeaningBody
204Deleted.—
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
409The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE).application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

items

The item and service catalogue (Profi).

GET /items

List catalogue items #

Needs the item catalogue feature of the Profi plan.

Required scope: items:read.

Parameters

NameInTypeNotes
searchquerystring (max length 200)
categoryquerystring (max length 100)
isActivequeryboolean
clientIdquerystring (uuid)
sortByquerystring
name sku catalogueNumber unitPrice category createdAt updatedAt margin
sortDirquerystring
ASC DESC
pagequeryinteger (≥ 1, ≤ 1000000)
limitqueryinteger (≥ 1, ≤ 100)

Responses

StatusMeaningBody
200One page of items.application/json: ItemList
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

POST /items

Create a catalogue item #

Required scope: items:write.

Parameters

NameInTypeNotes
Idempotency-Keyheaderstring (min length 1, max length 255)Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key.

Request body

CreateItem

Responses

StatusMeaningBody
201The created item.application/json: Item
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
409The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE).application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

GET /items/{id}

Get one catalogue item #

Required scope: items:read.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.

Responses

StatusMeaningBody
200The item.application/json: Item
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

PATCH /items/{id}

Update a catalogue item #

Required scope: items:write.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.
Idempotency-Keyheaderstring (min length 1, max length 255)Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key.

Request body

UpdateItem

Responses

StatusMeaningBody
200The updated item.application/json: Item
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
409The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE).application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

DELETE /items/{id}

Delete a catalogue item (it goes to the recycle bin) #

The item goes to the recycle bin for 30 days.

Required scope: items:write.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.

Responses

StatusMeaningBody
204Deleted.—
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

expenses

Received documents and other expenses (Profi).

GET /expenses

List expenses (received documents) #

Needs the expenses feature of the Profi plan.

Required scope: expenses:read.

Parameters

NameInTypeNotes
searchquerystring
supplierIdquerystring (uuid)
statusquerystring
draft pending partially_paid paid overdue cancelled
categoryquerystring
material goods services subcontractors rent energy telecom software marketing travel fuel vehicle office equipment education insurance bank_fees taxes_fees representation other
sourcequerystring
manual ocr peppol import
dateFromquerystring
dateToquerystring
updatedSincequerystring (date-time)
unpaidOnlyqueryboolean
needsReviewqueryboolean
sortByquerystring
issueDate dueDate totalGross supplierName createdAt
sortDirquerystring
ASC DESC
pagequeryinteger (≥ 1, ≤ 1000000)
limitqueryinteger (≥ 1, ≤ 100)

Responses

StatusMeaningBody
200One page of expenses.application/json: ExpenseList
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

POST /expenses

Book an expense #

A second document with the same supplier and number is refused (409) unless allowDuplicate=true.

Required scope: expenses:write.

Parameters

NameInTypeNotes
allowDuplicatequeryboolean (default false)true books past the duplicate guard.
Idempotency-Keyheaderstring (min length 1, max length 255)Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key.

Request body

CreateExpense

Responses

StatusMeaningBody
201The booked expense.application/json: Expense
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
409The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE).application/json: Error
422A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

GET /expenses/{id}

Get one expense #

Required scope: expenses:read.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.

Responses

StatusMeaningBody
200The expense.application/json: Expense
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

PATCH /expenses/{id}

Update an expense #

Required scope: expenses:write.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.
Idempotency-Keyheaderstring (min length 1, max length 255)Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key.

Request body

UpdateExpense

Responses

StatusMeaningBody
200The updated expense.application/json: Expense
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
409The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE).application/json: Error
422A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

DELETE /expenses/{id}

Delete an expense (it goes to the recycle bin) #

The expense goes to the recycle bin for 30 days.

Required scope: expenses:write.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.

Responses

StatusMeaningBody
204Deleted.—
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

received_invoices

The e-Faktúra inbox: e-invoices received over Peppol or uploaded, read-only.

GET /received-invoices

List received e-invoices (the e-Faktúra inbox) #

Reading does not mark a document read; only a person opening it in the dashboard does.

Required scope: received_invoices:read.

Parameters

NameInTypeNotes
statusquerystring
new read converted ignored
searchquerystring (max length 120)
pagequeryinteger (≥ 1, ≤ 1000000)
limitqueryinteger (≥ 1, ≤ 100)

Responses

StatusMeaningBody
200One page of received e-invoices.application/json: ReceivedInvoiceList
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

GET /received-invoices/{id}

Get one received e-invoice with its lines #

Required scope: received_invoices:read.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.

Responses

StatusMeaningBody
200The received e-invoice.application/json: ReceivedInvoiceDetail
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

GET /received-invoices/{id}/xml

Get the archived original UBL XML of a received e-invoice #

The legal document: the archived original, byte for byte, with its SHA-256.

Required scope: received_invoices:read.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.

Responses

StatusMeaningBody
200The original XML.application/json: ReceivedInvoiceXml
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

recurring_invoices

Recurring invoice schedules, read-only.

GET /recurring-invoices

List recurring invoice schedules #

Required scope: recurring_invoices:read.

Parameters

NameInTypeNotes
pagequeryinteger (≥ 1, ≤ 1000000)
limitqueryinteger (≥ 1, ≤ 100)

Responses

StatusMeaningBody
200One page of schedules.application/json: RecurringInvoiceList
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

GET /recurring-invoices/{id}

Get one schedule with its recent runs #

Required scope: recurring_invoices:read.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.

Responses

StatusMeaningBody
200The schedule with its recent runs.application/json: RecurringInvoice
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

companies

The issuer company profiles of the workspace, read-only.

GET /companies

List the issuer company profiles of the workspace #

Required scope: company:read.

Parameters

NameInTypeNotes
pagequeryinteger (≥ 1, ≤ 1000000)
limitqueryinteger (≥ 1, ≤ 100)

Responses

StatusMeaningBody
200One page of issuer profiles.application/json: CompanyList
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

bank_accounts

The bank accounts documents are paid into, read-only.

GET /bank-accounts

List the bank accounts the workspace is paid into #

Name one in bankAccountId when creating a document to have it paid into an account other than the primary one.

Required scope: bank_accounts:read.

Parameters

NameInTypeNotes
pagequeryinteger (≥ 1, ≤ 1000000)
limitqueryinteger (≥ 1, ≤ 100)

Responses

StatusMeaningBody
200One page of bank accounts.application/json: BankAccountList
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

GET /bank-accounts/{id}

Get one bank account #

Required scope: bank_accounts:read.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.

Responses

StatusMeaningBody
200The bank account.application/json: BankAccount
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

webhooks

Webhook endpoints the credential manages: a partner app registers its own in each workspace it is connected to.

GET /webhooks

List the webhook endpoints this credential manages #

A partner app sees the endpoints it registered in this workspace; an API key sees the workspace's own, including those registered in the app.

Required scope: webhooks:read.

Parameters

NameInTypeNotes
pagequeryinteger (≥ 1, ≤ 1000000)
limitqueryinteger (≥ 1, ≤ 100)

Responses

StatusMeaningBody
200One page of endpoints.application/json: WebhookList
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

POST /webhooks

Register a webhook endpoint; the answer carries its signing secret once #

Name the events explicitly. Each must be one whose data the credential may read (invoice.* needs invoices:read, expense.* expenses:read, and so on; account events such as bank feeds, VAT reports, the subscription and the team are kept off the API), or the answer is 403 WEBHOOK_EVENT_NOT_ALLOWED. The URL must be publicly reachable over https (422 WEBHOOK_URL_NOT_ALLOWED). A partner app may register 5 endpoints per workspace; they are deleted when the workspace disconnects the app. The answer carries the signing secret, once.

Required scope: webhooks:write.

Parameters

NameInTypeNotes
Idempotency-Keyheaderstring (min length 1, max length 255)Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key.

Request body

CreateWebhook

Responses

StatusMeaningBody
201The endpoint and its secret.application/json: WebhookWithSecret
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
409The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE).application/json: Error
422A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

GET /webhooks/{id}

Get one webhook endpoint #

Required scope: webhooks:read.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.

Responses

StatusMeaningBody
200The endpoint.application/json: Webhook
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

PATCH /webhooks/{id}

Change the URL, events, label or state of a webhook endpoint #

What the endpoint receives after the change must lie within the credential's scopes, including events it was already subscribed to. isActive: true resumes an endpoint that was switched off after repeated failures.

Required scope: webhooks:write.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.
Idempotency-Keyheaderstring (min length 1, max length 255)Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key.

Request body

UpdateWebhook

Responses

StatusMeaningBody
200The updated endpoint.application/json: Webhook
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
422A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

DELETE /webhooks/{id}

Delete a webhook endpoint #

Deliveries still waiting for a retry are closed off; the delivery log is kept.

Required scope: webhooks:write.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.

Responses

StatusMeaningBody
204Deleted.—
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

POST /webhooks/{id}/rotate-secret

Replace the signing secret of a webhook endpoint #

The old secret stops signing at once; deliveries from now on use the new one.

Required scope: webhooks:write.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.
Idempotency-Keyheaderstring (min length 1, max length 255)Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key.

Responses

StatusMeaningBody
200The endpoint and its new secret.application/json: WebhookWithSecret
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

POST /webhooks/{id}/test

Send a signed ping event to a webhook endpoint and report the result #

Sends a signed ping event to this endpoint now and reports how it answered.

Required scope: webhooks:write.

Parameters

NameInTypeNotes
id requiredpathstring (uuid)UUID of the resource. A malformed one answers 400.
Idempotency-Keyheaderstring (min length 1, max length 255)Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key.

Responses

StatusMeaningBody
200The test delivery.application/json: WebhookTestResult
400The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID.application/json: Error
401UNAUTHORIZED: the key is missing, unknown or revoked.application/json: Error
403API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it).application/json: Error
404Not in this workspace. An id of another workspace is indistinguishable from one that does not exist.application/json: Error
429RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds.application/json: Error
500INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect.application/json: Error

Webhooks

Events vporiadku sends to the endpoints a workspace registers under Settings → API → Webhooks. Each request carries the WebhookEnvelope and is signed with the endpoint's secret.

EventGroupWhen
invoice.createdinvoiceAn invoice was created.
invoice.updatedinvoiceAn invoice was modified.
invoice.sentinvoiceAn invoice was e-mailed to the customer.
invoice.viewedinvoiceThe customer opened the public link of an invoice.
invoice.paidinvoiceAn invoice became fully settled.
invoice.overdueinvoiceAn invoice passed its due date unpaid.
invoice.cancelledinvoiceAn issued invoice was voided by a storno document.
credit_note.createddocumentA credit note was issued against an invoice.
quote.createddocumentA quote was created.
quote.accepteddocumentA quote was marked accepted by the customer.
quote.rejecteddocumentA quote was marked rejected.
quote.expireddocumentA quote passed its validity date without an answer.
delivery_note.createddocumentA delivery note was created.
order.createddocumentAn order confirmation was created.
payment.recordedpaymentA settlement was recorded against an invoice.
payment.matchedpaymentA bank statement entry was allocated to a document.
expense.createdexpenseA received document was booked.
expense.updatedexpenseA received document was modified.
expense.paidexpenseA received document became fully settled.
client.createdcontactA customer record was created.
supplier.createdcontactA supplier record was created.
item.createdcatalogueA catalogue item was created.
einvoice.senteinvoiceA document was handed to the Peppol Access Point.
einvoice.deliveredeinvoiceThe Access Point confirmed delivery to the recipient.
einvoice.failedeinvoiceA transmission was rejected or failed validation.
einvoice.receivedeinvoiceAn inbound e-invoice arrived in the workspace inbox.
bank_statement.importedbankingA bank statement was imported and reconciled.
bank_feed.syncedbankingAn automatic bank feed imported transactions and reconciled them.
bank_feed.consent_expiringbankingA PSD2 bank consent is close to expiry, or has expired, and needs re-authorisation.
recurring_invoice.generatedrecurringA recurring schedule issued a document.
recurring_invoice.failedrecurringA recurring schedule failed to issue a document.
vat_report.generatedvatA VAT return or control statement was generated.
subscription.updatedbillingThe workspace's own vporiadku subscription changed.
team.member_joinedteamAn invited user activated their workspace membership.
pingsystemTest event, sent only by the "send test event" button.

Schemas

Error

Every error response has this shape.

FieldTypeNotes
data requirednull
meta requirednull
error requiredobject

Ping

FieldTypeNotes
ok requiredbooleanAlways true.
plan requiredstringStored plan of the workspace: free, pro or the grandfathered firma.
authTypestring
api_key oauth_app
What authenticated the request.
keyPrefix requiredstringThe first characters of the API key or the access token.
scopes requiredarray of stringScopes of the credential; ["*"] on a key issued before scopes existed (full access).
workspaceobjectThe workspace the credential acts in.
appobject | nullnull for an API key.
environment requiredstring
live sandbox
sandbox for a sandbox key (fak_test_…) or the token of a sandbox app, live otherwise.
sandboxobject | nullnull outside a sandbox.

SendResult

FieldTypeNotes
queued requiredbooleantrue when the mail provider was unavailable and the message waits in the retry queue; the document already counts as sent.

InvoiceLine

One line of a document. Amounts are decimal numbers in the document currency.

FieldTypeNotes
id requiredstring (uuid)
name requiredstring
description requiredstring | null
quantity requirednumber
unit requiredstring
unitPrice requirednumberUnit price before the line discount, in the document currency.
vatRate requirednumberVAT rate in percent; 0 is legitimate (reverse charge, export, non-payer).
discountPercent requirednumber
totalNet requirednumber
totalVat requirednumber
totalGross requirednumber

ClientSummary

The client a document names.

FieldTypeNotes
id requiredstring (uuid)
name requiredstring
email requiredstring | null
ico requiredstring | nullIČO: Slovak company registration number.
dic requiredstring | nullDIČ: tax identification number.
icDph requiredstring | nullIČ DPH: EU VAT identification number.

Invoice

A document: an invoice or any other document type. Lists carry the same shape.

FieldTypeNotes
id requiredstring (uuid)
invoiceNumber requiredstringDocument number; assigned from the series when the document is issued.
documentType requiredstring
invoice proforma advance credit_note debit_note quote delivery_note order_received order_sent cancellation payment_tax_document
status requiredstring
draft issued sent pending partially_paid paid overdue cancelled accepted rejected expired confirmed delivered completed
issueDate requiredstring (date)
dueDate requiredstring (date)
supplyDatestring | null (date)Date of supply (tax point).
currency requiredstring
EUR USD GBP CHF JPY CAD AUD CZK PLN HUF RON BGN SEK DKK NOK ISK HRK CNY KRW INR IDR THB VND PHP MYR SGD HKD TWD NZD AED SAR ILS TRY ZAR EGP NGN KES BRL MXN ARS CLP COP PEN UAH GEL KZT RSD BAM MKD ALL MDL
ISO 4217 currency code.
exchangeRatenumber | nullRate to EUR for a foreign-currency document.
totalNet requirednumber
totalVat requirednumber
totalGross requirednumber
amountDue requirednumberWhat the customer is asked to pay: gross less advance deduction and retainer.
variableSymbolstring | null
paymentMethodstring | null
documentLanguagestring | null
sk uk en cs de ru null
Language the document is printed and e-mailed in. A document created without one takes its client's documentLanguage, else Slovak.
clientIdstring | null (uuid)
clientClientSummaryThe client, when the document names one.
companyIdstring | null (uuid)Issuer company profile.
relatedInvoiceIdstring | null (uuid)The document a credit note, debit note or cancellation corrects.
isLockedbooleantrue once issued: the content is frozen.
issuedAtstring | null (date-time)
isSentboolean
sentAtstring | null (date-time)
cancelledAtstring | null (date-time)
tagsarray | null
itemsarray of InvoiceLineThe lines, on the detail and on every list page.
createdAtstring (date-time)
updatedAtstring (date-time)

Payment

FieldTypeNotes
id requiredstring (uuid)
invoiceId requiredstring (uuid)
amount requirednumberAmount received, in the document currency.
paymentDate requiredstring (date)
paymentMethod requiredstring
cash bank_transfer card paypal other
note requiredstring | null
isRoundingAdjustment requiredbooleantrue on a halierové vyrovnanie the server booked to settle a few cents of difference.
createdAt requiredstring (date-time)

Client

FieldTypeNotes
id requiredstring (uuid)
name requiredstring
emailstring | null
icostring | nullIČO: Slovak company registration number.
dicstring | nullDIČ: tax identification number.
icDphstring | nullIČ DPH: EU VAT identification number.
contactPersonstring | null
phonestring | null
ibanstring | null
addressJsonPostalAddress | null
postalAddressJsonPostalAddress | null
documentLanguagestring | null
sk uk en cs de ru null
Language a new document for this client is printed and e-mailed in when it names no documentLanguage of its own. null is the default, Slovak.
createdAtstring (date-time)
updatedAtstring (date-time)

PostalAddress

A postal address. Every field is optional.

FieldTypeNotes
streetstring
citystring
zipstring
countrystringISO 3166-1 alpha-2 country code or a country name.

Item

A catalogue item or service.

FieldTypeNotes
id requiredstring (uuid)
skustring | null
name requiredstring
descriptionstring | null
unit requiredstring
unitPrice requirednumberDefault unit price without VAT.
vatRate requirednumber
currency requiredstring
EUR USD GBP CHF JPY CAD AUD CZK PLN HUF RON BGN SEK DKK NOK ISK HRK CNY KRW INR IDR THB VND PHP MYR SGD HKD TWD NZD AED SAR ILS TRY ZAR EGP NGN KES BRL MXN ARS CLP COP PEN UAH GEL KZT RSD BAM MKD ALL MDL
ISO 4217 currency code.
categorystring | null
isActive requiredboolean
purchasePricenumber | null
barcodestring | null
clientPricenumber | nullThe negotiated price of the client named by clientId on the list, else null.
effectiveUnitPricenumberclientPrice when there is one, else unitPrice.
usageCountinteger
createdAtstring (date-time)
updatedAtstring (date-time)

Expense

A received document (expense).

FieldTypeNotes
id requiredstring (uuid)
supplierIdstring | null (uuid)
supplierName requiredstring
supplierIcostring | null
documentNumber requiredstringThe supplier's document number.
variableSymbolstring | null
issueDate requiredstring (date)
deliveryDatestring | null (date)
dueDatestring | null (date)
status requiredstring
categorystring
sourcestringHow the document entered the system.
currency requiredstring
EUR USD GBP CHF JPY CAD AUD CZK PLN HUF RON BGN SEK DKK NOK ISK HRK CNY KRW INR IDR THB VND PHP MYR SGD HKD TWD NZD AED SAR ILS TRY ZAR EGP NGN KES BRL MXN ARS CLP COP PEN UAH GEL KZT RSD BAM MKD ALL MDL
ISO 4217 currency code.
totalNetnumber
totalVatnumber
totalGross requirednumber
amountPaidnumber
amountDuenumber
vatDeductibleboolean
deductibleVatnumber
notestring | null
receivedEInvoiceIdstring | null (uuid)The received e-invoice the expense was converted from.
createdAtstring (date-time)
updatedAtstring (date-time)

ReceivedInvoice

A received e-invoice as the inbox lists it.

FieldTypeNotes
id requiredstring (uuid)
status requiredstring
new read converted ignored
sourcestringHow it arrived: Peppol or a manual upload.
documentTypeCodestring | nullUNCL1001 code, e.g. 380 for an invoice.
isCreditNoteboolean
documentNumberstring | null
issueDatestring | null (date)
dueDatestring | null (date)
currency requiredstring
senderNamestring | null
senderVatIdstring | null
totalNetnumber
totalVatnumber
totalGross requirednumber
payableAmountnumber
hasParseErrorsboolean
convertedExpenseIdstring | null (uuid)
receivedAt requiredstring (date-time)

ReceivedInvoiceDetail

A received e-invoice with its parties, lines and VAT breakdown. Carries every field of ReceivedInvoice too.

FieldTypeNotes
id requiredstring (uuid)
status requiredstring
documentNumberstring | null
issueDatestring | null (date)
currencystring
totalGrossnumber
senderUblParty | null
recipientUblParty | null
paymentIbanstring | null
paymentReferencestring | null
taxSubtotals requiredarray of UblTaxSubtotal
lines requiredarray of UblLine
parseErrorsarray of string
rawXmlSha256stringSHA-256 of the archived original.
retentionUntilstring | null (date)The archive keeps the original until this date.

UblParty

FieldTypeNotes
namestring | null
registrationNamestring | null
endpointIdstring | nullPeppol participant id.
endpointSchemestring | null
vatIdstring | null
companyIdstring | null
streetstring | null
citystring | null
zipstring | null
countryCodestring | null
emailstring | null

UblLine

FieldTypeNotes
lineNumber requiredinteger
name requiredstring
description requiredstring | null
quantity requirednumber
unitCode requiredstringUN/ECE Recommendation 20 unit code.
unitPrice requirednumber
netAmount requirednumber
vatRate requirednumber
vatCategory requiredstring | null

UblTaxSubtotal

FieldTypeNotes
taxableAmount requirednumber
taxAmount requirednumber
percent requirednumber
category requiredstring | null

ReceivedInvoiceXml

FieldTypeNotes
xml requiredstringThe original UBL document, byte for byte.
fileName requiredstring
sha256 requiredstring

RecurringInvoice

A recurring invoice schedule.

FieldTypeNotes
id requiredstring (uuid)
invoiceId requiredstring (uuid)The template document every run copies.
namestring | null
frequency requiredstring
nextRunDate requiredstring (date)
lastRunDatestring | null (date)
endDatestring | null (date)
maxOccurrencesinteger | null
occurrencesCountinteger
autoIssuebooleanWhether a generated document is issued, not left as a draft.
isActive requiredboolean
lastRunStatusstring | null
runsarray of RecurringInvoiceRunThe most recent runs; on the detail only.
createdAtstring (date-time)
updatedAtstring (date-time)

RecurringInvoiceRun

FieldTypeNotes
id requiredstring (uuid)
runDate requiredstring (date)
status requiredstring
triggerstring
generatedInvoiceIdstring | null (uuid)
generatedInvoiceNumberstring | null
errorMessagestring | null
createdAtstring (date-time)

Company

An issuer company profile.

FieldTypeNotes
id requiredstring (uuid)
name requiredstring
icostring | null
dicstring | null
icDphstring | null
addressJsonPostalAddress | null
taxPayerTypestring | nullVAT registration status of the issuer.
emailstring | null
phonestring | null
webstring | null
isActive requiredbooleanThe profile a document is issued under when it names no companyId.
createdAtstring (date-time)
updatedAtstring (date-time)

BankAccount

A bank account of the workspace.

FieldTypeNotes
id requiredstring (uuid)
iban requiredstringIBAN, as printed on documents.
swiftstring | nullBIC / SWIFT code.
bankNamestring | null
bankCodestring | nullSlovak four-digit bank code.
currency requiredstring
EUR USD GBP CHF JPY CAD AUD CZK PLN HUF RON BGN SEK DKK NOK ISK HRK CNY KRW INR IDR THB VND PHP MYR SGD HKD TWD NZD AED SAR ILS TRY ZAR EGP NGN KES BRL MXN ARS CLP COP PEN UAH GEL KZT RSD BAM MKD ALL MDL
ISO 4217 currency code.
isPrimary requiredbooleanThe account a document is paid to when it names no bankAccountId.
isForeignbooleanAn account held outside Slovakia.
autoPaymentMatchingbooleanImported statements of this account are matched to documents automatically.

Webhook

A webhook endpoint. Never carries its secret.

FieldTypeNotes
id requiredstring (uuid)
url requiredstring (uri)Where the events are POSTed.
descriptionstring | null
events requiredarray of stringEvents it receives.
isActive requiredbooleanfalse while paused, by hand or automatically.
consecutiveFailuresintegerTerminal failures since the last 2xx.
disabledAtstring | null (date-time)
disabledReasonstring | nullWhy it was switched off.
lastSuccessAtstring | null (date-time)
lastFailureAtstring | null (date-time)
createdAtstring (date-time)

WebhookWithSecret

A webhook endpoint with its signing secret.

FieldTypeNotes
id requiredstring (uuid)
url requiredstring (uri)Where the events are POSTed.
descriptionstring | null
events requiredarray of stringEvents it receives.
isActive requiredbooleanfalse while paused, by hand or automatically.
consecutiveFailuresintegerTerminal failures since the last 2xx.
disabledAtstring | null (date-time)
disabledReasonstring | nullWhy it was switched off.
lastSuccessAtstring | null (date-time)
lastFailureAtstring | null (date-time)
createdAtstring (date-time)
secret requiredstringSigning secret, whsec_…, answered only here and on rotation. Verify x-vporiadku-signature with it.

WebhookDelivery

One delivery of one event to one endpoint.

FieldTypeNotes
id requiredstring (uuid)
event requiredstring
status requiredstring
pending delivered failed dead_lettered
Lifecycle of the delivery.
attemptsinteger
responseStatusinteger | nullWhat the endpoint answered.
durationMsinteger | null
lastAttemptAtstring | null (date-time)
createdAtstring (date-time)

WebhookTestResult

FieldTypeNotes
dispatched requiredbooleantrue when the ping was sent.
deliveries requiredarray of WebhookDeliveryThe delivery of the ping, with how the endpoint answered.

InvoiceList

One page of documents.

FieldTypeNotes
data requiredarray of Invoice
total requiredintegerItems matching the request, across all pages.
page requiredintegerThe 1-based page this response holds.
limit requiredintegerThe page size the server applied.

PaymentList

One page of payments.

FieldTypeNotes
data requiredarray of Payment
total requiredintegerItems matching the request, across all pages.
page requiredintegerThe 1-based page this response holds.
limit requiredintegerThe page size the server applied.

ClientList

One page of clients.

FieldTypeNotes
data requiredarray of Client
total requiredintegerItems matching the request, across all pages.
page requiredintegerThe 1-based page this response holds.
limit requiredintegerThe page size the server applied.

ItemList

One page of catalogue items.

FieldTypeNotes
data requiredarray of Item
total requiredintegerItems matching the request, across all pages.
page requiredintegerThe 1-based page this response holds.
limit requiredintegerThe page size the server applied.

ExpenseList

One page of expenses.

FieldTypeNotes
data requiredarray of Expense
total requiredintegerItems matching the request, across all pages.
page requiredintegerThe 1-based page this response holds.
limit requiredintegerThe page size the server applied.

ReceivedInvoiceList

One page of received e-invoices.

FieldTypeNotes
data requiredarray of ReceivedInvoice
total requiredintegerItems matching the request, across all pages.
page requiredintegerThe 1-based page this response holds.
limit requiredintegerThe page size the server applied.

RecurringInvoiceList

One page of schedules.

FieldTypeNotes
data requiredarray of RecurringInvoice
total requiredintegerItems matching the request, across all pages.
page requiredintegerThe 1-based page this response holds.
limit requiredintegerThe page size the server applied.

CompanyList

One page of issuer profiles.

FieldTypeNotes
data requiredarray of Company
total requiredintegerItems matching the request, across all pages.
page requiredintegerThe 1-based page this response holds.
limit requiredintegerThe page size the server applied.

BankAccountList

One page of bank accounts.

FieldTypeNotes
data requiredarray of BankAccount
total requiredintegerItems matching the request, across all pages.
page requiredintegerThe 1-based page this response holds.
limit requiredintegerThe page size the server applied.

WebhookList

One page of webhook endpoints.

FieldTypeNotes
data requiredarray of Webhook
total requiredintegerItems matching the request, across all pages.
page requiredintegerThe 1-based page this response holds.
limit requiredintegerThe page size the server applied.

WebhookEnvelope

Every delivery has this envelope; only data differs per event.

FieldTypeNotes
id requiredstringUnique per event occurrence; stable across retries.
event requiredstringCatalogue name, e.g. invoice.paid.
apiVersion requiredstringVersion of the envelope.
schemaVersion requiredintegerVersion of this event's data. Branch on this.
occurredAt requiredstring (date-time)When the business fact happened.
createdAtstring (date-time)Deprecated alias of occurredAt.
workspaceId requiredstring (uuid)
idempotencyKey requiredstringStable key of the business fact; deduplicate on it.
attempt requiredinteger1 on the first try, incrementing on each retry.
data requiredobjectEvent payload. Never contains a secret.

CreateInvoice

FieldTypeNotes
companyIdstring (uuid)
clientIdstring (uuid)
invoiceNumberstring (max length 50)
documentTypestring
invoice proforma advance credit_note debit_note quote delivery_note order_received order_sent cancellation payment_tax_document
issueDate requiredstring (date)
dueDate requiredstring (date)
supplyDatestring (date)
statusstring
draft issued sent pending partially_paid paid overdue cancelled accepted rejected expired confirmed delivered completed
totalNetnumber
totalVatnumber
totalGrossnumber
amountDuenumber
currencystring
EUR USD GBP CHF JPY CAD AUD CZK PLN HUF RON BGN SEK DKK NOK ISK HRK CNY KRW INR IDR THB VND PHP MYR SGD HKD TWD NZD AED SAR ILS TRY ZAR EGP NGN KES BRL MXN ARS CLP COP PEN UAH GEL KZT RSD BAM MKD ALL MDL
paymentTermsstring
paymentMethodstring
notestring
descriptionstring
orderNumberstring
contractNumberstring
openingTextstring
closingTextstring
internalNotestring
variableSymbolstring
dueDaysnumber (≥ 0, ≤ 3650)
exchangeRatenumber (≥ 0.0001, ≤ 999999.9999)At most 6 decimal places.
requiredVatTextstring
documentLanguagestring
sk uk en cs de ru
bankAccountIdstring (uuid)
itemsarray of InvoiceLineInput
tagsarray of string
hasRetainerboolean
retainerAmountnumber (≥ 0, ≤ 9999999999)At most 2 decimal places.
hasDocumentDiscountboolean
documentDiscountPercentnumber (≥ 0, ≤ 100)At most 2 decimal places.
hasAdvanceDeductionboolean
advanceDeductionAmountnumber (≥ 0, ≤ 9999999999)At most 2 decimal places.
showStampSignatureboolean
contactPersonNamestring
contactPersonEmailstring
contactPersonPhonestring
relatedInvoiceIdstring (uuid)

InvoiceLineInput

FieldTypeNotes
name requiredstring (min length 1, max length 255)
descriptionstring (max length 2000)
quantity requirednumber (≥ -9999999999, ≤ 9999999999)At most 4 decimal places.
unitstring (max length 20)
unitPrice requirednumber (≥ -9999999999, ≤ 9999999999)At most 4 decimal places.
vatRatenumber (≥ 0, ≤ 100)At most 2 decimal places.
discountPercentnumber (≥ 0, ≤ 100)At most 2 decimal places.
totalNetnumber
totalVatnumber
totalGrossnumber

UpdateInvoice

FieldTypeNotes
companyIdstring (uuid)
clientIdstring (uuid)
invoiceNumberstring (max length 50)
documentTypestring
invoice proforma advance credit_note debit_note quote delivery_note order_received order_sent cancellation payment_tax_document
issueDatestring (date)
dueDatestring (date)
supplyDatestring (date)
statusstring
draft issued sent pending partially_paid paid overdue cancelled accepted rejected expired confirmed delivered completed
totalNetnumber
totalVatnumber
totalGrossnumber
amountDuenumber
currencystring
EUR USD GBP CHF JPY CAD AUD CZK PLN HUF RON BGN SEK DKK NOK ISK HRK CNY KRW INR IDR THB VND PHP MYR SGD HKD TWD NZD AED SAR ILS TRY ZAR EGP NGN KES BRL MXN ARS CLP COP PEN UAH GEL KZT RSD BAM MKD ALL MDL
paymentTermsstring
paymentMethodstring
notestring
itemsarray of InvoiceLineInput
descriptionstring
orderNumberstring
contractNumberstring
openingTextstring
closingTextstring
internalNotestring
variableSymbolstring
dueDaysnumber (≥ 0, ≤ 3650)
exchangeRatenumber (≥ 0.0001, ≤ 999999.9999)At most 6 decimal places.
requiredVatTextstring
documentLanguagestring
sk uk en cs de ru
bankAccountIdstring (uuid)
tagsarray of string
hasRetainerboolean
retainerAmountnumber (≥ 0, ≤ 9999999999)At most 2 decimal places.
hasDocumentDiscountboolean
documentDiscountPercentnumber (≥ 0, ≤ 100)At most 2 decimal places.
hasAdvanceDeductionboolean
advanceDeductionAmountnumber (≥ 0, ≤ 9999999999)At most 2 decimal places.
showStampSignatureboolean
contactPersonNamestring
contactPersonEmailstring
contactPersonPhonestring
relatedInvoiceIdstring (uuid)
validUntilstringISO 8601 date, e.g. 2026-10-12.
isLockedboolean
isSentboolean
sentAtstringISO 8601 date, e.g. 2026-10-12.

IssueInvoice

FieldTypeNotes
numberstring (max length 50)
issueDatestringISO 8601 date, e.g. 2026-10-12.

CreateCreditNote

FieldTypeNotes
reasonstring (max length 500)
issueDatestringISO 8601 date, e.g. 2026-10-12.
itemsarray of CreditNoteLineInput

CreditNoteLineInput

FieldTypeNotes
name requiredstring (min length 1, max length 255)
descriptionstring (max length 2000)
quantity requirednumber (≥ -9999999999, ≤ 9999999999)At most 4 decimal places.
unitstring (max length 20)
unitPrice requirednumber (≥ -9999999999, ≤ 9999999999)At most 4 decimal places.
vatRatenumber (≥ 0, ≤ 100)At most 2 decimal places.
discountPercentnumber (≥ 0, ≤ 100)At most 2 decimal places.
totalNetnumber
totalVatnumber
totalGrossnumber

CancelInvoice

FieldTypeNotes
reasonstring (max length 500)
issueDatestringISO 8601 date, e.g. 2026-10-12.

CreatePayment

FieldTypeNotes
amount requirednumber (≥ 0.01, ≤ 9999999999)
paymentDate requiredstring (date)
paymentMethodstring
cash bank_transfer card paypal other
notestring (max length 500)
allowOverpaymentboolean

MarkInvoicePaid

FieldTypeNotes
paymentDatestring (date)
paymentMethodstring
cash bank_transfer card paypal other

CreateClient

FieldTypeNotes
name requiredstring (min length 1, max length 200)
emailstring (email)
contactPersonstring (max length 200)
cashAccountingModestring
inherit enabled disabled
documentLanguagestring
sk uk en cs de ru
phonestring (max length 40)
ibanstring (max length 34)
icostring (max length 32)
dicstring (max length 32)
icDphstring (max length 32)
addressJsonPostalAddressInput
postalAddressJsonPostalAddressInput
contactsarray of ClientContactInput

PostalAddressInput

FieldTypeNotes
streetstring (max length 200)
citystring (max length 200)
zipstring (max length 200)
countrystring (max length 200)

ClientContactInput

FieldTypeNotes
type requiredstring
email phone mobile fax other
value requiredstring (min length 1, max length 200)
labelstring (max length 80)
isPrimaryboolean

UpdateClient

FieldTypeNotes
namestring (min length 1, max length 200)
emailstring (email)
contactPersonstring (max length 200)
cashAccountingModestring
inherit enabled disabled
documentLanguagestring
sk uk en cs de ru
phonestring (max length 40)
ibanstring (max length 34)
icostring (max length 32)
dicstring (max length 32)
icDphstring (max length 32)
addressJsonPostalAddressInput
postalAddressJsonPostalAddressInput
contactsarray of ClientContactInput

CreateItem

FieldTypeNotes
skustring (max length 64)
catalogueNumberstring (max length 64)
name requiredstring (min length 1, max length 200)
descriptionstring (max length 2000)
unitstring (max length 20)
unitPricenumber (≥ 0, ≤ 99999999)At most 2 decimal places.
vatRatenumber (≥ 0, ≤ 100)At most 2 decimal places.
currencystring
EUR USD GBP CHF JPY CAD AUD CZK PLN HUF RON BGN SEK DKK NOK ISK HRK CNY KRW INR IDR THB VND PHP MYR SGD HKD TWD NZD AED SAR ILS TRY ZAR EGP NGN KES BRL MXN ARS CLP COP PEN UAH GEL KZT RSD BAM MKD ALL MDL
categorystring (max length 100)
isActiveboolean
purchasePricenumber (≥ 0, ≤ 99999999)At most 2 decimal places.
stockQuantitynumber (≥ -99999999, ≤ 99999999)At most 3 decimal places.
tracksStockboolean
lowStockThresholdnumber (≥ 0, ≤ 99999999)At most 3 decimal places.
defaultWarehouseIdstring (uuid)
barcodestring (max length 64)
sellInMultiplesOfnumber (≥ 0, ≤ 1000000)At most 4 decimal places.

UpdateItem

FieldTypeNotes
skustring (max length 64)
catalogueNumberstring (max length 64)
namestring (min length 1, max length 200)
descriptionstring (max length 2000)
unitstring (max length 20)
unitPricenumber (≥ 0, ≤ 99999999)At most 2 decimal places.
vatRatenumber (≥ 0, ≤ 100)At most 2 decimal places.
currencystring
EUR USD GBP CHF JPY CAD AUD CZK PLN HUF RON BGN SEK DKK NOK ISK HRK CNY KRW INR IDR THB VND PHP MYR SGD HKD TWD NZD AED SAR ILS TRY ZAR EGP NGN KES BRL MXN ARS CLP COP PEN UAH GEL KZT RSD BAM MKD ALL MDL
categorystring (max length 100)
isActiveboolean
purchasePricenumber (≥ 0, ≤ 99999999)At most 2 decimal places.
stockQuantitynumber (≥ -99999999, ≤ 99999999)At most 3 decimal places.
tracksStockboolean
lowStockThresholdnumber (≥ 0, ≤ 99999999)At most 3 decimal places.
defaultWarehouseIdstring (uuid)
barcodestring (max length 64)
sellInMultiplesOfnumber (≥ 0, ≤ 1000000)At most 4 decimal places.

CreateExpense

FieldTypeNotes
supplierIdstring (uuid)
supplierNamestring (max length 200)
supplierIcostring
supplierIcDphstring (max length 20)
documentNumber requiredstring (min length 1, max length 60)
variableSymbolstring (max length 20)
constantSymbolstring (max length 10)
specificSymbolstring (max length 20)
issueDate requiredstringISO 8601 date, e.g. 2026-10-12.
deliveryDatestringISO 8601 date, e.g. 2026-10-12.
dueDatestringISO 8601 date, e.g. 2026-10-12.
receivedDatestringISO 8601 date, e.g. 2026-10-12.
statusstring
draft pending partially_paid paid overdue cancelled
categorystring
material goods services subcontractors rent energy telecom software marketing travel fuel vehicle office equipment education insurance bank_fees taxes_fees representation other
currencystring
EUR USD GBP CHF JPY CAD AUD CZK PLN HUF RON BGN SEK DKK NOK ISK HRK CNY KRW INR IDR THB VND PHP MYR SGD HKD TWD NZD AED SAR ILS TRY ZAR EGP NGN KES BRL MXN ARS CLP COP PEN UAH GEL KZT RSD BAM MKD ALL MDL
exchangeRatenumber (≥ 0.0001, ≤ 999999.9999)At most 6 decimal places.
itemsarray of ExpenseLineInput
totalNetnumber (≥ -100000000, ≤ 100000000)At most 2 decimal places.
totalVatnumber (≥ -100000000, ≤ 100000000)At most 2 decimal places.
totalGrossnumber (≥ -100000000, ≤ 100000000)At most 2 decimal places.
vatBreakdownarray of ExpenseVatBreakdownInput
vatDeductibleboolean
vatDeductionPercentnumber (≥ 0, ≤ 100)At most 2 decimal places.
kvSectionstring
B1 B2 B3 none
correctionTypestring
credit_note debit_note
correctedExpenseIdstring (uuid)
correctedDocumentNumberstring (max length 60)
taxDeductibleboolean
paymentMethodstring
cash bank_transfer card paypal other
notestring (max length 4000)
internalNotestring (max length 4000)
attachmentUrlstring (max length 500)
attachmentNamestring (max length 255)
attachmentMimeTypestring (max length 120)

ExpenseLineInput

FieldTypeNotes
name requiredstring (min length 1, max length 300)
descriptionstring (max length 2000)
quantitynumber (≥ -1000000, ≤ 1000000)At most 3 decimal places.
unitstring (max length 20)
unitPricenumber (≥ -100000000, ≤ 100000000)At most 2 decimal places.
vatRatenumber (≥ 0, ≤ 100)At most 2 decimal places.
discountPercentnumber (≥ 0, ≤ 100)At most 2 decimal places.
vatAmountOverridenumber (≥ -100000000, ≤ 100000000)At most 2 decimal places.

ExpenseVatBreakdownInput

FieldTypeNotes
rate requirednumber (≥ 0, ≤ 100)At most 2 decimal places.
base requirednumber (≥ -100000000, ≤ 100000000)At most 2 decimal places.
vat requirednumber (≥ -100000000, ≤ 100000000)At most 2 decimal places.

UpdateExpense

FieldTypeNotes
needsReviewboolean
supplierIdstring (uuid)
supplierNamestring (max length 200)
supplierIcostring
supplierIcDphstring (max length 20)
documentNumberstring (min length 1, max length 60)
variableSymbolstring (max length 20)
constantSymbolstring (max length 10)
specificSymbolstring (max length 20)
issueDatestringISO 8601 date, e.g. 2026-10-12.
deliveryDatestringISO 8601 date, e.g. 2026-10-12.
dueDatestringISO 8601 date, e.g. 2026-10-12.
receivedDatestringISO 8601 date, e.g. 2026-10-12.
statusstring
draft pending partially_paid paid overdue cancelled
categorystring
material goods services subcontractors rent energy telecom software marketing travel fuel vehicle office equipment education insurance bank_fees taxes_fees representation other
currencystring
EUR USD GBP CHF JPY CAD AUD CZK PLN HUF RON BGN SEK DKK NOK ISK HRK CNY KRW INR IDR THB VND PHP MYR SGD HKD TWD NZD AED SAR ILS TRY ZAR EGP NGN KES BRL MXN ARS CLP COP PEN UAH GEL KZT RSD BAM MKD ALL MDL
exchangeRatenumber (≥ 0.0001, ≤ 999999.9999)At most 6 decimal places.
itemsarray of ExpenseLineInput
totalNetnumber (≥ -100000000, ≤ 100000000)At most 2 decimal places.
totalVatnumber (≥ -100000000, ≤ 100000000)At most 2 decimal places.
totalGrossnumber (≥ -100000000, ≤ 100000000)At most 2 decimal places.
vatBreakdownarray of ExpenseVatBreakdownInput
vatDeductibleboolean
vatDeductionPercentnumber (≥ 0, ≤ 100)At most 2 decimal places.
kvSectionstring
B1 B2 B3 none
correctionTypestring
credit_note debit_note
correctedExpenseIdstring (uuid)
correctedDocumentNumberstring (max length 60)
taxDeductibleboolean
paymentMethodstring
cash bank_transfer card paypal other
notestring (max length 4000)
internalNotestring (max length 4000)
attachmentUrlstring (max length 500)
attachmentNamestring (max length 255)
attachmentMimeTypestring (max length 120)

CreateWebhook

FieldTypeNotes
url requiredstring (uri, max length 2048)
descriptionstring (max length 120)
events requiredarray of string
invoice.created invoice.updated invoice.sent invoice.viewed invoice.paid invoice.overdue invoice.cancelled credit_note.created quote.created quote.accepted quote.rejected quote.expired delivery_note.created order.created payment.recorded payment.matched expense.created expense.updated expense.paid client.created supplier.created item.created einvoice.sent einvoice.delivered einvoice.failed einvoice.received bank_statement.imported bank_feed.synced bank_feed.consent_expiring recurring_invoice.generated recurring_invoice.failed vat_report.generated subscription.updated team.member_joined ping
isActiveboolean

UpdateWebhook

FieldTypeNotes
urlstring (uri, max length 2048)
descriptionstring (max length 120)
eventsarray of string
invoice.created invoice.updated invoice.sent invoice.viewed invoice.paid invoice.overdue invoice.cancelled credit_note.created quote.created quote.accepted quote.rejected quote.expired delivery_note.created order.created payment.recorded payment.matched expense.created expense.updated expense.paid client.created supplier.created item.created einvoice.sent einvoice.delivered einvoice.failed einvoice.received bank_statement.imported bank_feed.synced bank_feed.consent_expiring recurring_invoice.generated recurring_invoice.failed vat_report.generated subscription.updated team.member_joined ping
isActiveboolean