The REST API

Authentication

Create a key under Settings → API Keys and send it as X-Api-Key or Authorization: Bearer. Keys are scoped to one store. Requests are limited to 120 a minute per key and bodies to 64 KB.

Endpoints

POST /api/v1/invoices/generate       generate (or reuse) a PDF → document_id + 15-minute download URL
POST /api/v1/invoices/send           generate (or reuse) and email; optional additional_recipients (≤5)
GET  /api/v1/invoices/:order_id      current document: number, template, version_count, URL
GET  /api/v1/templates               custom templates + the active template per document type
GET  /api/v1/templates/:id           one template with its files, CSS, blocks and settings
GET  /api/v1/documents/:id/download  302 to a signed URL (?redirect=false for JSON)

Request shape

POST /api/v1/invoices/send
X-Api-Key: sk_live_…
Content-Type: application/json

{ "order_id": 7183970107474, "document_type": "invoice", "additional_recipients": ["accounts@example.com"] }

order_id accepts a numeric id or a full GID; document_type is invoice or estimate (estimates take a draft order id). Every response is an envelope: { ok: true, … } or { ok: false, error: { code, message } }. Plan-limit failures answer 429, render or send failures 422.

Reference

The full contract is published as an OpenAPI 3 document at /openapi.yaml; open it in Swagger Editor, Redoc or Postman to browse every endpoint, parameter and response. The API Keys page inside the app shows a quick-start example with your key.