The contract
The vporiadku public REST API: documents and their lifecycle, payments, clients, the item catalogue, expenses, received e-invoices, recurring schedules, issuer profiles, bank accounts and webhook endpoints of one workspace. Human-readable guide: https://vporiadku.sk/sk/vyvojari
Authentication: two credentials, held to the same scopes. An **API key** belongs to one workspace: send it as Authorization: Bearer fak_… or X-API-Key: fak_…. Keys are created in the app under Settings → API by the workspace owner or an admin, and need the Firma add-on module. The full key is shown once; only its SHA-256 is stored. A **partner app** serving many workspaces uses OAuth 2.0 instead and sends an access token as Authorization: Bearer vpa_…. Either acts as the owner of its workspace and never reaches another.
OAuth 2.0 for partner apps: register the app under Settings → API → Apps to get a client_id (vpc_…) and a client secret (vps_…, shown once). Send the customer to https://vporiadku.sk/oauth/authorize with response_type=code, your client_id, a registered redirect_uri (exact match, always required), the space-separated scope you need, a state, and PKCE: code_challenge with code_challenge_method=S256 (required). The customer signs in, picks the workspace and approves; the browser comes back with code and state, or with error=access_denied. Exchange the code within 10 minutes at POST https://api.vporiadku.sk/api/oauth/token (application/x-www-form-urlencoded: grant_type=authorization_code, code, redirect_uri, code_verifier; client authentication by HTTP Basic or client_id + client_secret). The answer carries access_token (valid 60 minutes), refresh_token, scope and the connected workspace_id. Refresh with grant_type=refresh_token: every refresh returns a new refresh token and spends the old one (valid 365 days from issue); presenting a spent one again more than 30 seconds later revokes the whole chain. Revoke a token at POST https://api.vporiadku.sk/api/oauth/revoke (RFC 7009); revoking the last refresh token disconnects the app from the workspace. Token endpoint errors follow RFC 6749 §5.2 ({ "error", "error_description" }). An expired access token answers 401 with WWW-Authenticate: Bearer error="invalid_token". Refresh and retry. The workspace sees the app under Settings → API → Connected apps and may disconnect it at any time; its tokens then stop working at once.
Scopes: every key carries the scopes it was created with, and every access token what the customer approved; an operation they do not cover answers 403 API_KEY_SCOPE_MISSING (for an access token also WWW-Authenticate: Bearer error="insufficient_scope"). Writing a resource implies reading it. Keys issued before scopes existed carry * (full access). The scopes:
invoices:read,invoices:writepayments:read,payments:writeclients:read,clients:writeitems:read,items:writeexpenses:read,expenses:writereceived_invoices:readrecurring_invoices:readcompany:readbank_accounts:readwebhooks:read,webhooks:write
Rate limits: 120 requests per 60 seconds per key (and per partner app in each workspace it is connected to) across all endpoints, in fixed windows. Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (seconds until the window refills); over the limit the answer is 429 RATE_LIMIT_EXCEEDED with Retry-After. 30 failed authentications per 60 seconds from one address block that address until the window ends; an expired access token is not counted as one.
Idempotency: send Idempotency-Key on a POST or PATCH to make it safe to retry. Keys are scoped to the API key, or to the partner app in the workspace (they survive a token refresh), and remembered for 24 hours. A repeat with the same method, path and body is answered with the stored response and Idempotent-Replayed: true, and runs nothing; the same key with a different request answers 409 IDEMPOTENCY_KEY_REUSED, and a repeat while the first is still running 409 IDEMPOTENCY_KEY_IN_USE. Only successful responses are stored, so a request that failed can be retried with the same key.
Pagination: lists take page (1-based) and limit (default 20, at most 100) and answer { data, total, page, limit }. The document list also filters and sorts (see listInvoices), including updatedSince for an incremental sync.
Errors: { "data": null, "meta": null, "error": { "code", "message", "details" } }. Switch on error.code; the message is English prose and may change. Unknown body fields are a 400, not silently dropped. Success bodies are the resource itself (or the page object), with no envelope.
Money is a decimal number in the document currency; dates are YYYY-MM-DD, timestamps ISO 8601 UTC; ids are UUIDs.
Webhooks: the webhooks section lists every event vporiadku can push. Endpoints are registered under Settings → API → Webhooks, or through /webhooks by an API key or a partner app with webhooks:write. Through the API an endpoint may carry only events whose data the credential can read:
invoices:read:invoice.created,invoice.updated,invoice.sent,invoice.viewed,invoice.paid,invoice.overdue,invoice.cancelled,credit_note.created,quote.created,quote.accepted,quote.rejected,quote.expired,delivery_note.created,order.created,einvoice.sent,einvoice.delivered,einvoice.failedpayments:read:payment.recorded,payment.matchedclients:read:client.createditems:read:item.createdexpenses:read:expense.created,expense.updated,expense.paid,supplier.createdreceived_invoices:read:einvoice.receivedrecurring_invoices:read:recurring_invoice.generated,recurring_invoice.failed
ping is open to every credential; bank-feed, VAT-report, subscription and team events stay in the app.
meta
Checking a key.
GET /ping
Check a key or an access token: its workspace, plan and scopes #
Needs no scope, so any valid key can be tested with it.
Required scope: none (any valid key).
Responses
| Status | Meaning | Body |
|---|---|---|
200 | The key works. | application/json: Ping |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
invoices
Invoices and every other document type (proforma, advance, credit and debit note, quote, delivery note, orders, cancellation) and their lifecycle.
GET /invoices
List documents (invoices and every other document type) #
Every document type (invoices, proformas, credit notes, quotes, …), each with its lines, client and bank account. Filters combine: type, status, payment state (overdue tests the due date, not just the status), client, a date range on the issue, supply or due date (dateType), a named period, number range, tags, currency, free text over the number and the client name, and updatedSince for an incremental sync. Newest first by the filtered date unless sortBy says otherwise; ties are broken by creation time and id, so paging never repeats or skips a row.
Required scope: invoices:read.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
page | query | integer (≥ 1, default 1) | |
limit | query | integer (≥ 1, ≤ 100, default 20) | |
sortBy | query | stringnumber clientName issueDate dueDate validUntil totalGross updatedAt | |
sortDirection | query | stringasc desc | |
documentType | query | stringinvoice proforma advance credit_note debit_note quote delivery_note order_received order_sent cancellation payment_tax_document | |
status | query | stringdraft issued sent pending partially_paid paid overdue cancelled accepted rejected expired confirmed delivered completed | |
search | query | string (max length 100) | |
dateType | query | stringissue delivery due | |
period | query | stringthis_month last_month this_quarter this_year last_year all custom | |
dateFrom | query | string (date) | |
dateTo | query | string (date) | |
clientId | query | string (uuid) | |
paymentState | query | stringunpaid partially_paid paid overdue not_yet_due | |
numberFrom | query | string (max length 50) | |
numberTo | query | string (max length 50) | |
tags | query | array of string | |
currency | query | string | |
updatedSince | query | string (date-time) |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | One page of documents. | application/json: InvoiceList |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
POST /invoices
Create a document #
Totals sent by the client are accepted but ignored: the server always recomputes them. A document posted with a live status (e.g. issued) is issued in the same request. Leave invoiceNumber out to take the next number of the series. A foreign currency needs a plan that includes it; quotes, delivery notes and orders need the commercial-documents feature.
Required scope: invoices:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
Idempotency-Key | header | string (min length 1, max length 255) | Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key. |
Request body
Responses
| Status | Meaning | Body |
|---|---|---|
201 | The created document. | application/json: Invoice |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
409 | The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE). | application/json: Error |
422 | A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
GET /invoices/{id}
Get one document with its lines and client #
Required scope: invoices:read.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | The document. | application/json: Invoice |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
PATCH /invoices/{id}
Update a document that is still editable #
An issued document is locked: only its lifecycle flags can still change, and a correction is a credit note. Send only the fields to change.
Required scope: invoices:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Idempotency-Key | header | string (min length 1, max length 255) | Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key. |
Request body
Responses
| Status | Meaning | Body |
|---|---|---|
200 | The updated document. | application/json: Invoice |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
409 | The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE). | application/json: Error |
422 | A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
DELETE /invoices/{id}
Delete a draft that has no payments (it goes to the recycle bin) #
Only a draft with no payment recorded can be deleted; it goes to the recycle bin for 30 days. An issued document is voided with cancel.
Required scope: invoices:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Responses
| Status | Meaning | Body |
|---|---|---|
204 | Deleted. | — |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
409 | The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE). | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
GET /invoices/{id}/pdf
Download a document as the PDF its customer receives #
The same renderer the dashboard and the customer portal use: what you archive is what the customer received.
Required scope: invoices:read.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | The PDF. | application/pdf: string (binary) |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
503 | PDF_RENDERER_BUSY or SERVICE_UNAVAILABLE: retry with backoff. | application/json: Error |
GET /invoices/{id}/isdoc
Download a document as ISDOC 6.0.1 XML for accounting software #
ISDOC 6.0.1, the XML Czech and Slovak accounting software imports. Quotes, orders and delivery notes are not accounting documents and have no ISDOC form (409 DOCUMENT_NOT_EXPORTABLE). Needs the accounting-export feature of the plan, as the export in the dashboard does.
Required scope: invoices:read.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | The ISDOC XML. | application/xml: string |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
409 | The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE). | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
GET /invoices/{id}/ubl
Download an issued invoice as Peppol BIS Billing 3.0 UBL XML #
The Peppol BIS Billing 3.0 (EN 16931) UBL 2.1 XML an e-invoice carries, after the same validation a send runs: a document that would be refused answers 422 with what is missing. Needs the e-Faktúra module.
Required scope: invoices:read.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | The UBL XML. | application/xml: string |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
409 | The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE). | application/json: Error |
422 | A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
POST /invoices/{id}/issue
Issue a draft: fix its number and lock its content #
Keeps the number the draft was given from its series when it was created (or sets number when given), freezes the content and marks the document issued. Issuing an issued document changes nothing.
Required scope: invoices:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Idempotency-Key | header | string (min length 1, max length 255) | Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key. |
Request body (optional)
Responses
| Status | Meaning | Body |
|---|---|---|
200 | The issued document. | application/json: Invoice |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
409 | The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE). | application/json: Error |
422 | A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
POST /invoices/{id}/duplicate
Copy a document into a new draft with today's dates and the next number #
The copy is a new draft dated today (its due date and validity keep their distance from the issue date, a supply date becomes today), numbered from its series, with the client, lines, currency and texts of the original and a link back to it (sourceDocumentId). Payments do not carry over. A storno or a tax document of a payment cannot be copied (422). Counted against the plan like any new document.
Required scope: invoices:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Idempotency-Key | header | string (min length 1, max length 255) | Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key. |
Responses
| Status | Meaning | Body |
|---|---|---|
201 | The new draft. | application/json: Invoice |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
422 | A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
POST /invoices/{id}/send
E-mail an issued document to its client with the PDF attached #
E-mails the document to the client's address with the PDF attached, from the workspace's own SMTP when it has one. The client must have an e-mail address; a draft is refused.
Required scope: invoices:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Idempotency-Key | header | string (min length 1, max length 255) | Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key. |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | Sent or queued. | application/json: SendResult |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
409 | The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE). | application/json: Error |
422 | A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
POST /invoices/{id}/reminder
E-mail a payment reminder for an unpaid document #
Only for a document that asks for payment and still has something outstanding.
Required scope: invoices:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Idempotency-Key | header | string (min length 1, max length 255) | Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key. |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | Sent or queued. | application/json: SendResult |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
409 | The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE). | application/json: Error |
422 | A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
POST /invoices/{id}/credit-note
Issue a credit note (dobropis) against an invoice #
Without items the whole invoice is credited; with items only those lines, given with positive amounts (the server negates them). The credit note is linked back to the invoice and may not exceed what is left of it.
Required scope: invoices:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Idempotency-Key | header | string (min length 1, max length 255) | Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key. |
Request body (optional)
Responses
| Status | Meaning | Body |
|---|---|---|
201 | The credit note. | application/json: Invoice |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
409 | The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE). | application/json: Error |
422 | A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
POST /invoices/{id}/cancel
Void an issued document with a cancellation (storno) document #
Raises a cancellation (storno) document against the issued document and marks it cancelled. Nothing is deleted.
Required scope: invoices:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Idempotency-Key | header | string (min length 1, max length 255) | Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key. |
Request body (optional)
Responses
| Status | Meaning | Body |
|---|---|---|
201 | The cancellation document. | application/json: Invoice |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
409 | The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE). | application/json: Error |
422 | A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
payments
Money received against documents.
GET /invoices/{id}/payments
List the payments recorded on a document #
Required scope: payments:read.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
page | query | integer (≥ 1, ≤ 1000000) | |
limit | query | integer (≥ 1, ≤ 100) |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | One page of payments. | application/json: PaymentList |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
POST /invoices/{id}/payments
Record a payment; once the document is covered it becomes paid #
Moves the document to partially paid or paid, raises the tax document of a payment on an advance invoice, fires payment.recorded and sends the thank-you e-mail when the workspace has it on. An amount over what is outstanding is refused unless allowOverpayment is true.
Required scope: payments:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Idempotency-Key | header | string (min length 1, max length 255) | Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key. |
Request body
Responses
| Status | Meaning | Body |
|---|---|---|
201 | The recorded payment. | application/json: Payment |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
409 | The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE). | application/json: Error |
422 | A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
POST /invoices/{id}/mark-paid
Settle a document in full: record what is still outstanding as one payment #
Records what is still outstanding as one payment, like the dashboard's "mark as paid". With nothing outstanding only the status moves. A draft cannot be settled; an already paid document answers 409.
Required scope: payments:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Idempotency-Key | header | string (min length 1, max length 255) | Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key. |
Request body (optional)
Responses
| Status | Meaning | Body |
|---|---|---|
200 | The paid document. | application/json: Invoice |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
409 | The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE). | application/json: Error |
422 | A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
DELETE /payments/{id}
Delete a recorded payment; the document status follows #
The document's status is recomputed from the payments that remain.
Required scope: payments:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Responses
| Status | Meaning | Body |
|---|---|---|
204 | Deleted. | — |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
409 | The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE). | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
clients
The client directory.
GET /clients
List clients #
Newest first unless sortBy says otherwise; ties are broken by id, so paging never repeats or skips a client. updatedSince returns only clients changed since then, for an incremental sync.
Required scope: clients:read.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
search | query | string (max length 120) | |
page | query | integer (≥ 1, default 1) | |
limit | query | integer (≥ 1, ≤ 100, default 20) | |
updatedSince | query | string (date-time) | |
sortBy | query | stringname createdAt updatedAt | |
sortDirection | query | stringasc desc |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | One page of clients. | application/json: ClientList |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
POST /clients
Create a client #
Refused with 409 CLIENT_DUPLICATE_SUSPECTED when the directory already holds a client that looks the same, unless allowDuplicate=true. The Start plan is limited to 5 clients (403 PLAN_LIMIT_REACHED).
Required scope: clients:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
allowDuplicate | query | stringtrue false | true saves past the duplicate warning. |
Idempotency-Key | header | string (min length 1, max length 255) | Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key. |
Request body
Responses
| Status | Meaning | Body |
|---|---|---|
201 | The created client. | application/json: Client |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
409 | The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE). | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
GET /clients/{id}
Get one client #
Required scope: clients:read.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | The client. | application/json: Client |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
PATCH /clients/{id}
Update a client #
Required scope: clients:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Idempotency-Key | header | string (min length 1, max length 255) | Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key. |
Request body
Responses
| Status | Meaning | Body |
|---|---|---|
200 | The updated client. | application/json: Client |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
DELETE /clients/{id}
Delete a client no document names (it goes to the recycle bin) #
A client named by any document cannot be deleted (409).
Required scope: clients:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Responses
| Status | Meaning | Body |
|---|---|---|
204 | Deleted. | — |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
409 | The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE). | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
items
The item and service catalogue (Profi).
GET /items
List catalogue items #
Needs the item catalogue feature of the Profi plan.
Required scope: items:read.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
search | query | string (max length 200) | |
category | query | string (max length 100) | |
isActive | query | boolean | |
clientId | query | string (uuid) | |
sortBy | query | stringname sku catalogueNumber unitPrice category createdAt updatedAt margin | |
sortDir | query | stringASC DESC | |
page | query | integer (≥ 1, ≤ 1000000) | |
limit | query | integer (≥ 1, ≤ 100) |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | One page of items. | application/json: ItemList |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
POST /items
Create a catalogue item #
Required scope: items:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
Idempotency-Key | header | string (min length 1, max length 255) | Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key. |
Request body
Responses
| Status | Meaning | Body |
|---|---|---|
201 | The created item. | application/json: Item |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
409 | The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE). | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
GET /items/{id}
Get one catalogue item #
Required scope: items:read.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | The item. | application/json: Item |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
PATCH /items/{id}
Update a catalogue item #
Required scope: items:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Idempotency-Key | header | string (min length 1, max length 255) | Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key. |
Request body
Responses
| Status | Meaning | Body |
|---|---|---|
200 | The updated item. | application/json: Item |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
409 | The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE). | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
DELETE /items/{id}
Delete a catalogue item (it goes to the recycle bin) #
The item goes to the recycle bin for 30 days.
Required scope: items:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Responses
| Status | Meaning | Body |
|---|---|---|
204 | Deleted. | — |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
expenses
Received documents and other expenses (Profi).
GET /expenses
List expenses (received documents) #
Needs the expenses feature of the Profi plan.
Required scope: expenses:read.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
search | query | string | |
supplierId | query | string (uuid) | |
status | query | stringdraft pending partially_paid paid overdue cancelled | |
category | query | stringmaterial goods services subcontractors rent energy telecom software marketing travel fuel vehicle office equipment education insurance bank_fees taxes_fees representation other | |
source | query | stringmanual ocr peppol import | |
dateFrom | query | string | |
dateTo | query | string | |
updatedSince | query | string (date-time) | |
unpaidOnly | query | boolean | |
needsReview | query | boolean | |
sortBy | query | stringissueDate dueDate totalGross supplierName createdAt | |
sortDir | query | stringASC DESC | |
page | query | integer (≥ 1, ≤ 1000000) | |
limit | query | integer (≥ 1, ≤ 100) |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | One page of expenses. | application/json: ExpenseList |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
POST /expenses
Book an expense #
A second document with the same supplier and number is refused (409) unless allowDuplicate=true.
Required scope: expenses:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
allowDuplicate | query | boolean (default false) | true books past the duplicate guard. |
Idempotency-Key | header | string (min length 1, max length 255) | Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key. |
Request body
Responses
| Status | Meaning | Body |
|---|---|---|
201 | The booked expense. | application/json: Expense |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
409 | The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE). | application/json: Error |
422 | A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
GET /expenses/{id}
Get one expense #
Required scope: expenses:read.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | The expense. | application/json: Expense |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
PATCH /expenses/{id}
Update an expense #
Required scope: expenses:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Idempotency-Key | header | string (min length 1, max length 255) | Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key. |
Request body
Responses
| Status | Meaning | Body |
|---|---|---|
200 | The updated expense. | application/json: Expense |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
409 | The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE). | application/json: Error |
422 | A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
DELETE /expenses/{id}
Delete an expense (it goes to the recycle bin) #
The expense goes to the recycle bin for 30 days.
Required scope: expenses:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Responses
| Status | Meaning | Body |
|---|---|---|
204 | Deleted. | — |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
received_invoices
The e-Faktúra inbox: e-invoices received over Peppol or uploaded, read-only.
GET /received-invoices
List received e-invoices (the e-Faktúra inbox) #
Reading does not mark a document read; only a person opening it in the dashboard does.
Required scope: received_invoices:read.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
status | query | stringnew read converted ignored | |
search | query | string (max length 120) | |
page | query | integer (≥ 1, ≤ 1000000) | |
limit | query | integer (≥ 1, ≤ 100) |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | One page of received e-invoices. | application/json: ReceivedInvoiceList |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
GET /received-invoices/{id}
Get one received e-invoice with its lines #
Required scope: received_invoices:read.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | The received e-invoice. | application/json: ReceivedInvoiceDetail |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
GET /received-invoices/{id}/xml
Get the archived original UBL XML of a received e-invoice #
The legal document: the archived original, byte for byte, with its SHA-256.
Required scope: received_invoices:read.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | The original XML. | application/json: ReceivedInvoiceXml |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
recurring_invoices
Recurring invoice schedules, read-only.
GET /recurring-invoices
List recurring invoice schedules #
Required scope: recurring_invoices:read.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
page | query | integer (≥ 1, ≤ 1000000) | |
limit | query | integer (≥ 1, ≤ 100) |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | One page of schedules. | application/json: RecurringInvoiceList |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
GET /recurring-invoices/{id}
Get one schedule with its recent runs #
Required scope: recurring_invoices:read.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | The schedule with its recent runs. | application/json: RecurringInvoice |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
companies
The issuer company profiles of the workspace, read-only.
GET /companies
List the issuer company profiles of the workspace #
Required scope: company:read.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
page | query | integer (≥ 1, ≤ 1000000) | |
limit | query | integer (≥ 1, ≤ 100) |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | One page of issuer profiles. | application/json: CompanyList |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
bank_accounts
The bank accounts documents are paid into, read-only.
GET /bank-accounts
List the bank accounts the workspace is paid into #
Name one in bankAccountId when creating a document to have it paid into an account other than the primary one.
Required scope: bank_accounts:read.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
page | query | integer (≥ 1, ≤ 1000000) | |
limit | query | integer (≥ 1, ≤ 100) |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | One page of bank accounts. | application/json: BankAccountList |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
GET /bank-accounts/{id}
Get one bank account #
Required scope: bank_accounts:read.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | The bank account. | application/json: BankAccount |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
webhooks
Webhook endpoints the credential manages: a partner app registers its own in each workspace it is connected to.
GET /webhooks
List the webhook endpoints this credential manages #
A partner app sees the endpoints it registered in this workspace; an API key sees the workspace's own, including those registered in the app.
Required scope: webhooks:read.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
page | query | integer (≥ 1, ≤ 1000000) | |
limit | query | integer (≥ 1, ≤ 100) |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | One page of endpoints. | application/json: WebhookList |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
POST /webhooks
Register a webhook endpoint; the answer carries its signing secret once #
Name the events explicitly. Each must be one whose data the credential may read (invoice.* needs invoices:read, expense.* expenses:read, and so on; account events such as bank feeds, VAT reports, the subscription and the team are kept off the API), or the answer is 403 WEBHOOK_EVENT_NOT_ALLOWED. The URL must be publicly reachable over https (422 WEBHOOK_URL_NOT_ALLOWED). A partner app may register 5 endpoints per workspace; they are deleted when the workspace disconnects the app. The answer carries the signing secret, once.
Required scope: webhooks:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
Idempotency-Key | header | string (min length 1, max length 255) | Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key. |
Request body
Responses
| Status | Meaning | Body |
|---|---|---|
201 | The endpoint and its secret. | application/json: WebhookWithSecret |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
409 | The state of the resource refuses the request (e.g. DOCUMENT_LOCKED, INVOICE_ALREADY_PAID, INVOICE_NUMBER_ALREADY_EXISTS), or the Idempotency-Key guards another request (IDEMPOTENCY_KEY_REUSED) or one still running (IDEMPOTENCY_KEY_IN_USE). | application/json: Error |
422 | A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
GET /webhooks/{id}
Get one webhook endpoint #
Required scope: webhooks:read.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | The endpoint. | application/json: Webhook |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
PATCH /webhooks/{id}
Change the URL, events, label or state of a webhook endpoint #
What the endpoint receives after the change must lie within the credential's scopes, including events it was already subscribed to. isActive: true resumes an endpoint that was switched off after repeated failures.
Required scope: webhooks:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Idempotency-Key | header | string (min length 1, max length 255) | Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key. |
Request body
Responses
| Status | Meaning | Body |
|---|---|---|
200 | The updated endpoint. | application/json: Webhook |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
422 | A business rule refuses the data, e.g. a VAT rate that is not a Slovak statutory rate. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
DELETE /webhooks/{id}
Delete a webhook endpoint #
Deliveries still waiting for a retry are closed off; the delivery log is kept.
Required scope: webhooks:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Responses
| Status | Meaning | Body |
|---|---|---|
204 | Deleted. | — |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
POST /webhooks/{id}/rotate-secret
Replace the signing secret of a webhook endpoint #
The old secret stops signing at once; deliveries from now on use the new one.
Required scope: webhooks:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Idempotency-Key | header | string (min length 1, max length 255) | Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key. |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | The endpoint and its new secret. | application/json: WebhookWithSecret |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
POST /webhooks/{id}/test
Send a signed ping event to a webhook endpoint and report the result #
Sends a signed ping event to this endpoint now and reports how it answered.
Required scope: webhooks:write.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
id required | path | string (uuid) | UUID of the resource. A malformed one answers 400. |
Idempotency-Key | header | string (min length 1, max length 255) | Makes the request safe to retry. The first request with a key runs; a repeat within 24 hours with the same method, path and body gets the stored response (with Idempotent-Replayed: true) and runs nothing. A UUID v4 per logical operation is a good key. |
Responses
| Status | Meaning | Body |
|---|---|---|
200 | The test delivery. | application/json: WebhookTestResult |
400 | The request is malformed: VALIDATION_FAILED (with details.errors), BAD_REQUEST or IDEMPOTENCY_KEY_INVALID. | application/json: Error |
401 | UNAUTHORIZED: the key is missing, unknown or revoked. | application/json: Error |
403 | API_KEY_SCOPE_MISSING (the key lacks the scope; details.required names it), FORBIDDEN (the workspace has no Firma add-on), FEATURE_NOT_AVAILABLE or PLAN_LIMIT_REACHED (the plan does not include it). | application/json: Error |
404 | Not in this workspace. An id of another workspace is indistinguishable from one that does not exist. | application/json: Error |
429 | RATE_LIMIT_EXCEEDED: more than 120 requests in 60 seconds on this key, or more than 30 failed authentications from this address. Wait Retry-After seconds. | application/json: Error |
500 | INTERNAL_ERROR. Nothing internal is exposed. A failed request stores nothing under its Idempotency-Key; before retrying a write, check whether it took effect. | application/json: Error |
Webhooks
Events vporiadku sends to the endpoints a workspace registers under Settings → API → Webhooks. Each request carries the WebhookEnvelope and is signed with the endpoint's secret.
| Event | Group | When |
|---|---|---|
invoice.created | invoice | An invoice was created. |
invoice.updated | invoice | An invoice was modified. |
invoice.sent | invoice | An invoice was e-mailed to the customer. |
invoice.viewed | invoice | The customer opened the public link of an invoice. |
invoice.paid | invoice | An invoice became fully settled. |
invoice.overdue | invoice | An invoice passed its due date unpaid. |
invoice.cancelled | invoice | An issued invoice was voided by a storno document. |
credit_note.created | document | A credit note was issued against an invoice. |
quote.created | document | A quote was created. |
quote.accepted | document | A quote was marked accepted by the customer. |
quote.rejected | document | A quote was marked rejected. |
quote.expired | document | A quote passed its validity date without an answer. |
delivery_note.created | document | A delivery note was created. |
order.created | document | An order confirmation was created. |
payment.recorded | payment | A settlement was recorded against an invoice. |
payment.matched | payment | A bank statement entry was allocated to a document. |
expense.created | expense | A received document was booked. |
expense.updated | expense | A received document was modified. |
expense.paid | expense | A received document became fully settled. |
client.created | contact | A customer record was created. |
supplier.created | contact | A supplier record was created. |
item.created | catalogue | A catalogue item was created. |
einvoice.sent | einvoice | A document was handed to the Peppol Access Point. |
einvoice.delivered | einvoice | The Access Point confirmed delivery to the recipient. |
einvoice.failed | einvoice | A transmission was rejected or failed validation. |
einvoice.received | einvoice | An inbound e-invoice arrived in the workspace inbox. |
bank_statement.imported | banking | A bank statement was imported and reconciled. |
bank_feed.synced | banking | An automatic bank feed imported transactions and reconciled them. |
bank_feed.consent_expiring | banking | A PSD2 bank consent is close to expiry, or has expired, and needs re-authorisation. |
recurring_invoice.generated | recurring | A recurring schedule issued a document. |
recurring_invoice.failed | recurring | A recurring schedule failed to issue a document. |
vat_report.generated | vat | A VAT return or control statement was generated. |
subscription.updated | billing | The workspace's own vporiadku subscription changed. |
team.member_joined | team | An invited user activated their workspace membership. |
ping | system | Test event, sent only by the "send test event" button. |
Schemas
Error
Every error response has this shape.
| Field | Type | Notes |
|---|---|---|
data required | null | |
meta required | null | |
error required | object |
Ping
| Field | Type | Notes |
|---|---|---|
ok required | boolean | Always true. |
plan required | string | Stored plan of the workspace: free, pro or the grandfathered firma. |
authType | stringapi_key oauth_app | What authenticated the request. |
keyPrefix required | string | The first characters of the API key or the access token. |
scopes required | array of string | Scopes of the credential; ["*"] on a key issued before scopes existed (full access). |
workspace | object | The workspace the credential acts in. |
app | object | null | null for an API key. |
environment required | stringlive sandbox | sandbox for a sandbox key (fak_test_…) or the token of a sandbox app, live otherwise. |
sandbox | object | null | null outside a sandbox. |
SendResult
| Field | Type | Notes |
|---|---|---|
queued required | boolean | true when the mail provider was unavailable and the message waits in the retry queue; the document already counts as sent. |
InvoiceLine
One line of a document. Amounts are decimal numbers in the document currency.
| Field | Type | Notes |
|---|---|---|
id required | string (uuid) | |
name required | string | |
description required | string | null | |
quantity required | number | |
unit required | string | |
unitPrice required | number | Unit price before the line discount, in the document currency. |
vatRate required | number | VAT rate in percent; 0 is legitimate (reverse charge, export, non-payer). |
discountPercent required | number | |
totalNet required | number | |
totalVat required | number | |
totalGross required | number |
ClientSummary
The client a document names.
| Field | Type | Notes |
|---|---|---|
id required | string (uuid) | |
name required | string | |
email required | string | null | |
ico required | string | null | IČO: Slovak company registration number. |
dic required | string | null | DIČ: tax identification number. |
icDph required | string | null | IČ DPH: EU VAT identification number. |
Invoice
A document: an invoice or any other document type. Lists carry the same shape.
| Field | Type | Notes |
|---|---|---|
id required | string (uuid) | |
invoiceNumber required | string | Document number; assigned from the series when the document is issued. |
documentType required | stringinvoice proforma advance credit_note debit_note quote delivery_note order_received order_sent cancellation payment_tax_document | |
status required | stringdraft issued sent pending partially_paid paid overdue cancelled accepted rejected expired confirmed delivered completed | |
issueDate required | string (date) | |
dueDate required | string (date) | |
supplyDate | string | null (date) | Date of supply (tax point). |
currency required | stringEUR USD GBP CHF JPY CAD AUD CZK PLN HUF RON BGN SEK DKK NOK ISK HRK CNY KRW INR IDR THB VND PHP MYR SGD HKD TWD NZD AED SAR ILS TRY ZAR EGP NGN KES BRL MXN ARS CLP COP PEN UAH GEL KZT RSD BAM MKD ALL MDL | ISO 4217 currency code. |
exchangeRate | number | null | Rate to EUR for a foreign-currency document. |
totalNet required | number | |
totalVat required | number | |
totalGross required | number | |
amountDue required | number | What the customer is asked to pay: gross less advance deduction and retainer. |
variableSymbol | string | null | |
paymentMethod | string | null | |
documentLanguage | string | nullsk uk en cs de ru null | Language the document is printed and e-mailed in. A document created without one takes its client's documentLanguage, else Slovak. |
clientId | string | null (uuid) | |
client | ClientSummary | The client, when the document names one. |
companyId | string | null (uuid) | Issuer company profile. |
relatedInvoiceId | string | null (uuid) | The document a credit note, debit note or cancellation corrects. |
isLocked | boolean | true once issued: the content is frozen. |
issuedAt | string | null (date-time) | |
isSent | boolean | |
sentAt | string | null (date-time) | |
cancelledAt | string | null (date-time) | |
tags | array | null | |
items | array of InvoiceLine | The lines, on the detail and on every list page. |
createdAt | string (date-time) | |
updatedAt | string (date-time) |
Payment
| Field | Type | Notes |
|---|---|---|
id required | string (uuid) | |
invoiceId required | string (uuid) | |
amount required | number | Amount received, in the document currency. |
paymentDate required | string (date) | |
paymentMethod required | stringcash bank_transfer card paypal other | |
note required | string | null | |
isRoundingAdjustment required | boolean | true on a halierové vyrovnanie the server booked to settle a few cents of difference. |
createdAt required | string (date-time) |
Client
| Field | Type | Notes |
|---|---|---|
id required | string (uuid) | |
name required | string | |
email | string | null | |
ico | string | null | IČO: Slovak company registration number. |
dic | string | null | DIČ: tax identification number. |
icDph | string | null | IČ DPH: EU VAT identification number. |
contactPerson | string | null | |
phone | string | null | |
iban | string | null | |
addressJson | PostalAddress | null | |
postalAddressJson | PostalAddress | null | |
documentLanguage | string | nullsk uk en cs de ru null | Language a new document for this client is printed and e-mailed in when it names no documentLanguage of its own. null is the default, Slovak. |
createdAt | string (date-time) | |
updatedAt | string (date-time) |
PostalAddress
A postal address. Every field is optional.
| Field | Type | Notes |
|---|---|---|
street | string | |
city | string | |
zip | string | |
country | string | ISO 3166-1 alpha-2 country code or a country name. |
Item
A catalogue item or service.
| Field | Type | Notes |
|---|---|---|
id required | string (uuid) | |
sku | string | null | |
name required | string | |
description | string | null | |
unit required | string | |
unitPrice required | number | Default unit price without VAT. |
vatRate required | number | |
currency required | stringEUR USD GBP CHF JPY CAD AUD CZK PLN HUF RON BGN SEK DKK NOK ISK HRK CNY KRW INR IDR THB VND PHP MYR SGD HKD TWD NZD AED SAR ILS TRY ZAR EGP NGN KES BRL MXN ARS CLP COP PEN UAH GEL KZT RSD BAM MKD ALL MDL | ISO 4217 currency code. |
category | string | null | |
isActive required | boolean | |
purchasePrice | number | null | |
barcode | string | null | |
clientPrice | number | null | The negotiated price of the client named by clientId on the list, else null. |
effectiveUnitPrice | number | clientPrice when there is one, else unitPrice. |
usageCount | integer | |
createdAt | string (date-time) | |
updatedAt | string (date-time) |
Expense
A received document (expense).
| Field | Type | Notes |
|---|---|---|
id required | string (uuid) | |
supplierId | string | null (uuid) | |
supplierName required | string | |
supplierIco | string | null | |
documentNumber required | string | The supplier's document number. |
variableSymbol | string | null | |
issueDate required | string (date) | |
deliveryDate | string | null (date) | |
dueDate | string | null (date) | |
status required | string | |
category | string | |
source | string | How the document entered the system. |
currency required | stringEUR USD GBP CHF JPY CAD AUD CZK PLN HUF RON BGN SEK DKK NOK ISK HRK CNY KRW INR IDR THB VND PHP MYR SGD HKD TWD NZD AED SAR ILS TRY ZAR EGP NGN KES BRL MXN ARS CLP COP PEN UAH GEL KZT RSD BAM MKD ALL MDL | ISO 4217 currency code. |
totalNet | number | |
totalVat | number | |
totalGross required | number | |
amountPaid | number | |
amountDue | number | |
vatDeductible | boolean | |
deductibleVat | number | |
note | string | null | |
receivedEInvoiceId | string | null (uuid) | The received e-invoice the expense was converted from. |
createdAt | string (date-time) | |
updatedAt | string (date-time) |
ReceivedInvoice
A received e-invoice as the inbox lists it.
| Field | Type | Notes |
|---|---|---|
id required | string (uuid) | |
status required | stringnew read converted ignored | |
source | string | How it arrived: Peppol or a manual upload. |
documentTypeCode | string | null | UNCL1001 code, e.g. 380 for an invoice. |
isCreditNote | boolean | |
documentNumber | string | null | |
issueDate | string | null (date) | |
dueDate | string | null (date) | |
currency required | string | |
senderName | string | null | |
senderVatId | string | null | |
totalNet | number | |
totalVat | number | |
totalGross required | number | |
payableAmount | number | |
hasParseErrors | boolean | |
convertedExpenseId | string | null (uuid) | |
receivedAt required | string (date-time) |
ReceivedInvoiceDetail
A received e-invoice with its parties, lines and VAT breakdown. Carries every field of ReceivedInvoice too.
| Field | Type | Notes |
|---|---|---|
id required | string (uuid) | |
status required | string | |
documentNumber | string | null | |
issueDate | string | null (date) | |
currency | string | |
totalGross | number | |
sender | UblParty | null | |
recipient | UblParty | null | |
paymentIban | string | null | |
paymentReference | string | null | |
taxSubtotals required | array of UblTaxSubtotal | |
lines required | array of UblLine | |
parseErrors | array of string | |
rawXmlSha256 | string | SHA-256 of the archived original. |
retentionUntil | string | null (date) | The archive keeps the original until this date. |
UblParty
| Field | Type | Notes |
|---|---|---|
name | string | null | |
registrationName | string | null | |
endpointId | string | null | Peppol participant id. |
endpointScheme | string | null | |
vatId | string | null | |
companyId | string | null | |
street | string | null | |
city | string | null | |
zip | string | null | |
countryCode | string | null | |
email | string | null |
UblLine
| Field | Type | Notes |
|---|---|---|
lineNumber required | integer | |
name required | string | |
description required | string | null | |
quantity required | number | |
unitCode required | string | UN/ECE Recommendation 20 unit code. |
unitPrice required | number | |
netAmount required | number | |
vatRate required | number | |
vatCategory required | string | null |
UblTaxSubtotal
| Field | Type | Notes |
|---|---|---|
taxableAmount required | number | |
taxAmount required | number | |
percent required | number | |
category required | string | null |
ReceivedInvoiceXml
| Field | Type | Notes |
|---|---|---|
xml required | string | The original UBL document, byte for byte. |
fileName required | string | |
sha256 required | string |
RecurringInvoice
A recurring invoice schedule.
| Field | Type | Notes |
|---|---|---|
id required | string (uuid) | |
invoiceId required | string (uuid) | The template document every run copies. |
name | string | null | |
frequency required | string | |
nextRunDate required | string (date) | |
lastRunDate | string | null (date) | |
endDate | string | null (date) | |
maxOccurrences | integer | null | |
occurrencesCount | integer | |
autoIssue | boolean | Whether a generated document is issued, not left as a draft. |
isActive required | boolean | |
lastRunStatus | string | null | |
runs | array of RecurringInvoiceRun | The most recent runs; on the detail only. |
createdAt | string (date-time) | |
updatedAt | string (date-time) |
RecurringInvoiceRun
| Field | Type | Notes |
|---|---|---|
id required | string (uuid) | |
runDate required | string (date) | |
status required | string | |
trigger | string | |
generatedInvoiceId | string | null (uuid) | |
generatedInvoiceNumber | string | null | |
errorMessage | string | null | |
createdAt | string (date-time) |
Company
An issuer company profile.
| Field | Type | Notes |
|---|---|---|
id required | string (uuid) | |
name required | string | |
ico | string | null | |
dic | string | null | |
icDph | string | null | |
addressJson | PostalAddress | null | |
taxPayerType | string | null | VAT registration status of the issuer. |
email | string | null | |
phone | string | null | |
web | string | null | |
isActive required | boolean | The profile a document is issued under when it names no companyId. |
createdAt | string (date-time) | |
updatedAt | string (date-time) |
BankAccount
A bank account of the workspace.
| Field | Type | Notes |
|---|---|---|
id required | string (uuid) | |
iban required | string | IBAN, as printed on documents. |
swift | string | null | BIC / SWIFT code. |
bankName | string | null | |
bankCode | string | null | Slovak four-digit bank code. |
currency required | stringEUR USD GBP CHF JPY CAD AUD CZK PLN HUF RON BGN SEK DKK NOK ISK HRK CNY KRW INR IDR THB VND PHP MYR SGD HKD TWD NZD AED SAR ILS TRY ZAR EGP NGN KES BRL MXN ARS CLP COP PEN UAH GEL KZT RSD BAM MKD ALL MDL | ISO 4217 currency code. |
isPrimary required | boolean | The account a document is paid to when it names no bankAccountId. |
isForeign | boolean | An account held outside Slovakia. |
autoPaymentMatching | boolean | Imported statements of this account are matched to documents automatically. |
Webhook
A webhook endpoint. Never carries its secret.
| Field | Type | Notes |
|---|---|---|
id required | string (uuid) | |
url required | string (uri) | Where the events are POSTed. |
description | string | null | |
events required | array of string | Events it receives. |
isActive required | boolean | false while paused, by hand or automatically. |
consecutiveFailures | integer | Terminal failures since the last 2xx. |
disabledAt | string | null (date-time) | |
disabledReason | string | null | Why it was switched off. |
lastSuccessAt | string | null (date-time) | |
lastFailureAt | string | null (date-time) | |
createdAt | string (date-time) |
WebhookWithSecret
A webhook endpoint with its signing secret.
| Field | Type | Notes |
|---|---|---|
id required | string (uuid) | |
url required | string (uri) | Where the events are POSTed. |
description | string | null | |
events required | array of string | Events it receives. |
isActive required | boolean | false while paused, by hand or automatically. |
consecutiveFailures | integer | Terminal failures since the last 2xx. |
disabledAt | string | null (date-time) | |
disabledReason | string | null | Why it was switched off. |
lastSuccessAt | string | null (date-time) | |
lastFailureAt | string | null (date-time) | |
createdAt | string (date-time) | |
secret required | string | Signing secret, whsec_…, answered only here and on rotation. Verify x-vporiadku-signature with it. |
WebhookDelivery
One delivery of one event to one endpoint.
| Field | Type | Notes |
|---|---|---|
id required | string (uuid) | |
event required | string | |
status required | stringpending delivered failed dead_lettered | Lifecycle of the delivery. |
attempts | integer | |
responseStatus | integer | null | What the endpoint answered. |
durationMs | integer | null | |
lastAttemptAt | string | null (date-time) | |
createdAt | string (date-time) |
WebhookTestResult
| Field | Type | Notes |
|---|---|---|
dispatched required | boolean | true when the ping was sent. |
deliveries required | array of WebhookDelivery | The delivery of the ping, with how the endpoint answered. |
InvoiceList
One page of documents.
| Field | Type | Notes |
|---|---|---|
data required | array of Invoice | |
total required | integer | Items matching the request, across all pages. |
page required | integer | The 1-based page this response holds. |
limit required | integer | The page size the server applied. |
PaymentList
One page of payments.
| Field | Type | Notes |
|---|---|---|
data required | array of Payment | |
total required | integer | Items matching the request, across all pages. |
page required | integer | The 1-based page this response holds. |
limit required | integer | The page size the server applied. |
ClientList
One page of clients.
| Field | Type | Notes |
|---|---|---|
data required | array of Client | |
total required | integer | Items matching the request, across all pages. |
page required | integer | The 1-based page this response holds. |
limit required | integer | The page size the server applied. |
ItemList
One page of catalogue items.
| Field | Type | Notes |
|---|---|---|
data required | array of Item | |
total required | integer | Items matching the request, across all pages. |
page required | integer | The 1-based page this response holds. |
limit required | integer | The page size the server applied. |
ExpenseList
One page of expenses.
| Field | Type | Notes |
|---|---|---|
data required | array of Expense | |
total required | integer | Items matching the request, across all pages. |
page required | integer | The 1-based page this response holds. |
limit required | integer | The page size the server applied. |
ReceivedInvoiceList
One page of received e-invoices.
| Field | Type | Notes |
|---|---|---|
data required | array of ReceivedInvoice | |
total required | integer | Items matching the request, across all pages. |
page required | integer | The 1-based page this response holds. |
limit required | integer | The page size the server applied. |
RecurringInvoiceList
One page of schedules.
| Field | Type | Notes |
|---|---|---|
data required | array of RecurringInvoice | |
total required | integer | Items matching the request, across all pages. |
page required | integer | The 1-based page this response holds. |
limit required | integer | The page size the server applied. |
CompanyList
One page of issuer profiles.
| Field | Type | Notes |
|---|---|---|
data required | array of Company | |
total required | integer | Items matching the request, across all pages. |
page required | integer | The 1-based page this response holds. |
limit required | integer | The page size the server applied. |
BankAccountList
One page of bank accounts.
| Field | Type | Notes |
|---|---|---|
data required | array of BankAccount | |
total required | integer | Items matching the request, across all pages. |
page required | integer | The 1-based page this response holds. |
limit required | integer | The page size the server applied. |
WebhookList
One page of webhook endpoints.
| Field | Type | Notes |
|---|---|---|
data required | array of Webhook | |
total required | integer | Items matching the request, across all pages. |
page required | integer | The 1-based page this response holds. |
limit required | integer | The page size the server applied. |
WebhookEnvelope
Every delivery has this envelope; only data differs per event.
| Field | Type | Notes |
|---|---|---|
id required | string | Unique per event occurrence; stable across retries. |
event required | string | Catalogue name, e.g. invoice.paid. |
apiVersion required | string | Version of the envelope. |
schemaVersion required | integer | Version of this event's data. Branch on this. |
occurredAt required | string (date-time) | When the business fact happened. |
createdAt | string (date-time) | Deprecated alias of occurredAt. |
workspaceId required | string (uuid) | |
idempotencyKey required | string | Stable key of the business fact; deduplicate on it. |
attempt required | integer | 1 on the first try, incrementing on each retry. |
data required | object | Event payload. Never contains a secret. |
CreateInvoice
| Field | Type | Notes |
|---|---|---|
companyId | string (uuid) | |
clientId | string (uuid) | |
invoiceNumber | string (max length 50) | |
documentType | stringinvoice proforma advance credit_note debit_note quote delivery_note order_received order_sent cancellation payment_tax_document | |
issueDate required | string (date) | |
dueDate required | string (date) | |
supplyDate | string (date) | |
status | stringdraft issued sent pending partially_paid paid overdue cancelled accepted rejected expired confirmed delivered completed | |
totalNet | number | |
totalVat | number | |
totalGross | number | |
amountDue | number | |
currency | stringEUR USD GBP CHF JPY CAD AUD CZK PLN HUF RON BGN SEK DKK NOK ISK HRK CNY KRW INR IDR THB VND PHP MYR SGD HKD TWD NZD AED SAR ILS TRY ZAR EGP NGN KES BRL MXN ARS CLP COP PEN UAH GEL KZT RSD BAM MKD ALL MDL | |
paymentTerms | string | |
paymentMethod | string | |
note | string | |
description | string | |
orderNumber | string | |
contractNumber | string | |
openingText | string | |
closingText | string | |
internalNote | string | |
variableSymbol | string | |
dueDays | number (≥ 0, ≤ 3650) | |
exchangeRate | number (≥ 0.0001, ≤ 999999.9999) | At most 6 decimal places. |
requiredVatText | string | |
documentLanguage | stringsk uk en cs de ru | |
bankAccountId | string (uuid) | |
items | array of InvoiceLineInput | |
tags | array of string | |
hasRetainer | boolean | |
retainerAmount | number (≥ 0, ≤ 9999999999) | At most 2 decimal places. |
hasDocumentDiscount | boolean | |
documentDiscountPercent | number (≥ 0, ≤ 100) | At most 2 decimal places. |
hasAdvanceDeduction | boolean | |
advanceDeductionAmount | number (≥ 0, ≤ 9999999999) | At most 2 decimal places. |
showStampSignature | boolean | |
contactPersonName | string | |
contactPersonEmail | string | |
contactPersonPhone | string | |
relatedInvoiceId | string (uuid) |
InvoiceLineInput
| Field | Type | Notes |
|---|---|---|
name required | string (min length 1, max length 255) | |
description | string (max length 2000) | |
quantity required | number (≥ -9999999999, ≤ 9999999999) | At most 4 decimal places. |
unit | string (max length 20) | |
unitPrice required | number (≥ -9999999999, ≤ 9999999999) | At most 4 decimal places. |
vatRate | number (≥ 0, ≤ 100) | At most 2 decimal places. |
discountPercent | number (≥ 0, ≤ 100) | At most 2 decimal places. |
totalNet | number | |
totalVat | number | |
totalGross | number |
UpdateInvoice
| Field | Type | Notes |
|---|---|---|
companyId | string (uuid) | |
clientId | string (uuid) | |
invoiceNumber | string (max length 50) | |
documentType | stringinvoice proforma advance credit_note debit_note quote delivery_note order_received order_sent cancellation payment_tax_document | |
issueDate | string (date) | |
dueDate | string (date) | |
supplyDate | string (date) | |
status | stringdraft issued sent pending partially_paid paid overdue cancelled accepted rejected expired confirmed delivered completed | |
totalNet | number | |
totalVat | number | |
totalGross | number | |
amountDue | number | |
currency | stringEUR USD GBP CHF JPY CAD AUD CZK PLN HUF RON BGN SEK DKK NOK ISK HRK CNY KRW INR IDR THB VND PHP MYR SGD HKD TWD NZD AED SAR ILS TRY ZAR EGP NGN KES BRL MXN ARS CLP COP PEN UAH GEL KZT RSD BAM MKD ALL MDL | |
paymentTerms | string | |
paymentMethod | string | |
note | string | |
items | array of InvoiceLineInput | |
description | string | |
orderNumber | string | |
contractNumber | string | |
openingText | string | |
closingText | string | |
internalNote | string | |
variableSymbol | string | |
dueDays | number (≥ 0, ≤ 3650) | |
exchangeRate | number (≥ 0.0001, ≤ 999999.9999) | At most 6 decimal places. |
requiredVatText | string | |
documentLanguage | stringsk uk en cs de ru | |
bankAccountId | string (uuid) | |
tags | array of string | |
hasRetainer | boolean | |
retainerAmount | number (≥ 0, ≤ 9999999999) | At most 2 decimal places. |
hasDocumentDiscount | boolean | |
documentDiscountPercent | number (≥ 0, ≤ 100) | At most 2 decimal places. |
hasAdvanceDeduction | boolean | |
advanceDeductionAmount | number (≥ 0, ≤ 9999999999) | At most 2 decimal places. |
showStampSignature | boolean | |
contactPersonName | string | |
contactPersonEmail | string | |
contactPersonPhone | string | |
relatedInvoiceId | string (uuid) | |
validUntil | string | ISO 8601 date, e.g. 2026-10-12. |
isLocked | boolean | |
isSent | boolean | |
sentAt | string | ISO 8601 date, e.g. 2026-10-12. |
IssueInvoice
| Field | Type | Notes |
|---|---|---|
number | string (max length 50) | |
issueDate | string | ISO 8601 date, e.g. 2026-10-12. |
CreateCreditNote
| Field | Type | Notes |
|---|---|---|
reason | string (max length 500) | |
issueDate | string | ISO 8601 date, e.g. 2026-10-12. |
items | array of CreditNoteLineInput |
CreditNoteLineInput
| Field | Type | Notes |
|---|---|---|
name required | string (min length 1, max length 255) | |
description | string (max length 2000) | |
quantity required | number (≥ -9999999999, ≤ 9999999999) | At most 4 decimal places. |
unit | string (max length 20) | |
unitPrice required | number (≥ -9999999999, ≤ 9999999999) | At most 4 decimal places. |
vatRate | number (≥ 0, ≤ 100) | At most 2 decimal places. |
discountPercent | number (≥ 0, ≤ 100) | At most 2 decimal places. |
totalNet | number | |
totalVat | number | |
totalGross | number |
CancelInvoice
| Field | Type | Notes |
|---|---|---|
reason | string (max length 500) | |
issueDate | string | ISO 8601 date, e.g. 2026-10-12. |
CreatePayment
| Field | Type | Notes |
|---|---|---|
amount required | number (≥ 0.01, ≤ 9999999999) | |
paymentDate required | string (date) | |
paymentMethod | stringcash bank_transfer card paypal other | |
note | string (max length 500) | |
allowOverpayment | boolean |
MarkInvoicePaid
| Field | Type | Notes |
|---|---|---|
paymentDate | string (date) | |
paymentMethod | stringcash bank_transfer card paypal other |
CreateClient
| Field | Type | Notes |
|---|---|---|
name required | string (min length 1, max length 200) | |
email | string (email) | |
contactPerson | string (max length 200) | |
cashAccountingMode | stringinherit enabled disabled | |
documentLanguage | stringsk uk en cs de ru | |
phone | string (max length 40) | |
iban | string (max length 34) | |
ico | string (max length 32) | |
dic | string (max length 32) | |
icDph | string (max length 32) | |
addressJson | PostalAddressInput | |
postalAddressJson | PostalAddressInput | |
contacts | array of ClientContactInput |
PostalAddressInput
| Field | Type | Notes |
|---|---|---|
street | string (max length 200) | |
city | string (max length 200) | |
zip | string (max length 200) | |
country | string (max length 200) |
ClientContactInput
| Field | Type | Notes |
|---|---|---|
type required | stringemail phone mobile fax other | |
value required | string (min length 1, max length 200) | |
label | string (max length 80) | |
isPrimary | boolean |
UpdateClient
| Field | Type | Notes |
|---|---|---|
name | string (min length 1, max length 200) | |
email | string (email) | |
contactPerson | string (max length 200) | |
cashAccountingMode | stringinherit enabled disabled | |
documentLanguage | stringsk uk en cs de ru | |
phone | string (max length 40) | |
iban | string (max length 34) | |
ico | string (max length 32) | |
dic | string (max length 32) | |
icDph | string (max length 32) | |
addressJson | PostalAddressInput | |
postalAddressJson | PostalAddressInput | |
contacts | array of ClientContactInput |
CreateItem
| Field | Type | Notes |
|---|---|---|
sku | string (max length 64) | |
catalogueNumber | string (max length 64) | |
name required | string (min length 1, max length 200) | |
description | string (max length 2000) | |
unit | string (max length 20) | |
unitPrice | number (≥ 0, ≤ 99999999) | At most 2 decimal places. |
vatRate | number (≥ 0, ≤ 100) | At most 2 decimal places. |
currency | stringEUR USD GBP CHF JPY CAD AUD CZK PLN HUF RON BGN SEK DKK NOK ISK HRK CNY KRW INR IDR THB VND PHP MYR SGD HKD TWD NZD AED SAR ILS TRY ZAR EGP NGN KES BRL MXN ARS CLP COP PEN UAH GEL KZT RSD BAM MKD ALL MDL | |
category | string (max length 100) | |
isActive | boolean | |
purchasePrice | number (≥ 0, ≤ 99999999) | At most 2 decimal places. |
stockQuantity | number (≥ -99999999, ≤ 99999999) | At most 3 decimal places. |
tracksStock | boolean | |
lowStockThreshold | number (≥ 0, ≤ 99999999) | At most 3 decimal places. |
defaultWarehouseId | string (uuid) | |
barcode | string (max length 64) | |
sellInMultiplesOf | number (≥ 0, ≤ 1000000) | At most 4 decimal places. |
UpdateItem
| Field | Type | Notes |
|---|---|---|
sku | string (max length 64) | |
catalogueNumber | string (max length 64) | |
name | string (min length 1, max length 200) | |
description | string (max length 2000) | |
unit | string (max length 20) | |
unitPrice | number (≥ 0, ≤ 99999999) | At most 2 decimal places. |
vatRate | number (≥ 0, ≤ 100) | At most 2 decimal places. |
currency | stringEUR USD GBP CHF JPY CAD AUD CZK PLN HUF RON BGN SEK DKK NOK ISK HRK CNY KRW INR IDR THB VND PHP MYR SGD HKD TWD NZD AED SAR ILS TRY ZAR EGP NGN KES BRL MXN ARS CLP COP PEN UAH GEL KZT RSD BAM MKD ALL MDL | |
category | string (max length 100) | |
isActive | boolean | |
purchasePrice | number (≥ 0, ≤ 99999999) | At most 2 decimal places. |
stockQuantity | number (≥ -99999999, ≤ 99999999) | At most 3 decimal places. |
tracksStock | boolean | |
lowStockThreshold | number (≥ 0, ≤ 99999999) | At most 3 decimal places. |
defaultWarehouseId | string (uuid) | |
barcode | string (max length 64) | |
sellInMultiplesOf | number (≥ 0, ≤ 1000000) | At most 4 decimal places. |
CreateExpense
| Field | Type | Notes |
|---|---|---|
supplierId | string (uuid) | |
supplierName | string (max length 200) | |
supplierIco | string | |
supplierIcDph | string (max length 20) | |
documentNumber required | string (min length 1, max length 60) | |
variableSymbol | string (max length 20) | |
constantSymbol | string (max length 10) | |
specificSymbol | string (max length 20) | |
issueDate required | string | ISO 8601 date, e.g. 2026-10-12. |
deliveryDate | string | ISO 8601 date, e.g. 2026-10-12. |
dueDate | string | ISO 8601 date, e.g. 2026-10-12. |
receivedDate | string | ISO 8601 date, e.g. 2026-10-12. |
status | stringdraft pending partially_paid paid overdue cancelled | |
category | stringmaterial goods services subcontractors rent energy telecom software marketing travel fuel vehicle office equipment education insurance bank_fees taxes_fees representation other | |
currency | stringEUR USD GBP CHF JPY CAD AUD CZK PLN HUF RON BGN SEK DKK NOK ISK HRK CNY KRW INR IDR THB VND PHP MYR SGD HKD TWD NZD AED SAR ILS TRY ZAR EGP NGN KES BRL MXN ARS CLP COP PEN UAH GEL KZT RSD BAM MKD ALL MDL | |
exchangeRate | number (≥ 0.0001, ≤ 999999.9999) | At most 6 decimal places. |
items | array of ExpenseLineInput | |
totalNet | number (≥ -100000000, ≤ 100000000) | At most 2 decimal places. |
totalVat | number (≥ -100000000, ≤ 100000000) | At most 2 decimal places. |
totalGross | number (≥ -100000000, ≤ 100000000) | At most 2 decimal places. |
vatBreakdown | array of ExpenseVatBreakdownInput | |
vatDeductible | boolean | |
vatDeductionPercent | number (≥ 0, ≤ 100) | At most 2 decimal places. |
kvSection | stringB1 B2 B3 none | |
correctionType | stringcredit_note debit_note | |
correctedExpenseId | string (uuid) | |
correctedDocumentNumber | string (max length 60) | |
taxDeductible | boolean | |
paymentMethod | stringcash bank_transfer card paypal other | |
note | string (max length 4000) | |
internalNote | string (max length 4000) | |
attachmentUrl | string (max length 500) | |
attachmentName | string (max length 255) | |
attachmentMimeType | string (max length 120) |
ExpenseLineInput
| Field | Type | Notes |
|---|---|---|
name required | string (min length 1, max length 300) | |
description | string (max length 2000) | |
quantity | number (≥ -1000000, ≤ 1000000) | At most 3 decimal places. |
unit | string (max length 20) | |
unitPrice | number (≥ -100000000, ≤ 100000000) | At most 2 decimal places. |
vatRate | number (≥ 0, ≤ 100) | At most 2 decimal places. |
discountPercent | number (≥ 0, ≤ 100) | At most 2 decimal places. |
vatAmountOverride | number (≥ -100000000, ≤ 100000000) | At most 2 decimal places. |
ExpenseVatBreakdownInput
| Field | Type | Notes |
|---|---|---|
rate required | number (≥ 0, ≤ 100) | At most 2 decimal places. |
base required | number (≥ -100000000, ≤ 100000000) | At most 2 decimal places. |
vat required | number (≥ -100000000, ≤ 100000000) | At most 2 decimal places. |
UpdateExpense
| Field | Type | Notes |
|---|---|---|
needsReview | boolean | |
supplierId | string (uuid) | |
supplierName | string (max length 200) | |
supplierIco | string | |
supplierIcDph | string (max length 20) | |
documentNumber | string (min length 1, max length 60) | |
variableSymbol | string (max length 20) | |
constantSymbol | string (max length 10) | |
specificSymbol | string (max length 20) | |
issueDate | string | ISO 8601 date, e.g. 2026-10-12. |
deliveryDate | string | ISO 8601 date, e.g. 2026-10-12. |
dueDate | string | ISO 8601 date, e.g. 2026-10-12. |
receivedDate | string | ISO 8601 date, e.g. 2026-10-12. |
status | stringdraft pending partially_paid paid overdue cancelled | |
category | stringmaterial goods services subcontractors rent energy telecom software marketing travel fuel vehicle office equipment education insurance bank_fees taxes_fees representation other | |
currency | stringEUR USD GBP CHF JPY CAD AUD CZK PLN HUF RON BGN SEK DKK NOK ISK HRK CNY KRW INR IDR THB VND PHP MYR SGD HKD TWD NZD AED SAR ILS TRY ZAR EGP NGN KES BRL MXN ARS CLP COP PEN UAH GEL KZT RSD BAM MKD ALL MDL | |
exchangeRate | number (≥ 0.0001, ≤ 999999.9999) | At most 6 decimal places. |
items | array of ExpenseLineInput | |
totalNet | number (≥ -100000000, ≤ 100000000) | At most 2 decimal places. |
totalVat | number (≥ -100000000, ≤ 100000000) | At most 2 decimal places. |
totalGross | number (≥ -100000000, ≤ 100000000) | At most 2 decimal places. |
vatBreakdown | array of ExpenseVatBreakdownInput | |
vatDeductible | boolean | |
vatDeductionPercent | number (≥ 0, ≤ 100) | At most 2 decimal places. |
kvSection | stringB1 B2 B3 none | |
correctionType | stringcredit_note debit_note | |
correctedExpenseId | string (uuid) | |
correctedDocumentNumber | string (max length 60) | |
taxDeductible | boolean | |
paymentMethod | stringcash bank_transfer card paypal other | |
note | string (max length 4000) | |
internalNote | string (max length 4000) | |
attachmentUrl | string (max length 500) | |
attachmentName | string (max length 255) | |
attachmentMimeType | string (max length 120) |
CreateWebhook
| Field | Type | Notes |
|---|---|---|
url required | string (uri, max length 2048) | |
description | string (max length 120) | |
events required | array of stringinvoice.created invoice.updated invoice.sent invoice.viewed invoice.paid invoice.overdue invoice.cancelled credit_note.created quote.created quote.accepted quote.rejected quote.expired delivery_note.created order.created payment.recorded payment.matched expense.created expense.updated expense.paid client.created supplier.created item.created einvoice.sent einvoice.delivered einvoice.failed einvoice.received bank_statement.imported bank_feed.synced bank_feed.consent_expiring recurring_invoice.generated recurring_invoice.failed vat_report.generated subscription.updated team.member_joined ping | |
isActive | boolean |
UpdateWebhook
| Field | Type | Notes |
|---|---|---|
url | string (uri, max length 2048) | |
description | string (max length 120) | |
events | array of stringinvoice.created invoice.updated invoice.sent invoice.viewed invoice.paid invoice.overdue invoice.cancelled credit_note.created quote.created quote.accepted quote.rejected quote.expired delivery_note.created order.created payment.recorded payment.matched expense.created expense.updated expense.paid client.created supplier.created item.created einvoice.sent einvoice.delivered einvoice.failed einvoice.received bank_statement.imported bank_feed.synced bank_feed.consent_expiring recurring_invoice.generated recurring_invoice.failed vat_report.generated subscription.updated team.member_joined ping | |
isActive | boolean |