Conventions
Request format
HTTPS is required in production.
Send
Content-Type: application/jsonand a JSON body on POST and PUT.Dates are
YYYY-MM-DD.Currencies are three-letter ISO codes.
URL path segments are length-limited and sanitised. A segment longer than 32 characters is rejected.
Warning
Do not append extra query parameters beyond those documented. The router fails closed on unexpected parameters and returns an error rather than guessing what you meant.
Response format
Responses are JSON objects. Collection endpoints return an array of items, and
many payloads include a response_code integer.
Errors
Errors use a single envelope:
{
"result": -1,
"message": "Human readable message"
}
Status codes
Code |
Meaning |
|---|---|
|
OK. |
|
Created. Returned by successful POST. |
|
No content. Returned by successful DELETE. |
|
Validation error. The body explains what failed. |
|
Authentication failed, or the key is expired or revoked. |
|
Authenticated, but the key lacks the scope or the user lacks rights. |
|
Not found. |
|
Gone. Returned by |
|
Rate limited. See |
|
Server error. |
|
A dependent subsystem is unavailable. Retry with backoff. |
Distinguishing 401 from 403 matters when you debug: 401 means the key was
not accepted, 403 means it was accepted but is not allowed to do this.
Pagination
Collection endpoints that can return large result sets accept limit and
offset query parameters. Transaction and verification listings also accept
a date range.
?start-date=2026-01-01&end-date=2026-03-31&limit=100&offset=0
Note
The date parameters are spelled differently in different places:
bank and tax account items use start-date and end-date (hyphens),
while verifications use start_date and end_date (underscores). Check
the endpoint reference rather than assuming.
Fiscal years
Accounting data is scoped to a fiscal year, and fiscal years are integers (1, 2, 3, …) — an internal sequence number, not a calendar year.
Get the list first:
GET /user-companies/{company_id}/fiscal-years
Endpoints that require a fiscal year will not fall back to “the current one”. Pass it explicitly.
Deprecations
Deprecated |
Use instead |
|---|---|
|
|
|
Create a Personal Access Token in the application. The endpoint answers
|
|
|