EncryptInvoice API

The EncryptInvoice REST API gives you programmatic access to invoicing, quotes, customers, expenses, payments, e-invoicing (PEPPOL and country networks), banking, reporting, and webhooks — everything you can do in the app, from your own systems.

Base URLs

Environment	Base URL
Production	`https://app.encryptinvoice.com`
Staging	`https://sandbox.encryptinvoice.com`

All API endpoints live under /api/v1. Versioning is URI-based; breaking changes will ship as a new version prefix.

Health check (no authentication): GET /api/health.

Quick start

Get a token. In the admin panel, open Organization → API Tokens and create an organization API token with the scopes you need. (For apps acting on behalf of users, use OAuth 2.0 + PKCE instead.)
Call the API.

curl "https://app.encryptinvoice.com/api/v1/invoices" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "X-Organization-Id: YOUR_ORG_ID" \
  -H "Accept: application/json"

Explore. The full endpoint reference is in API Reference, generated from the same OpenAPI specification that drives our tests.

Documentation map

Guide	What it covers
Authentication	API tokens, OAuth 2.0 + PKCE, scopes, token lifetimes
Organizations & multi-tenancy	The `X-Organization-Id` header, token audiences
Pagination	List envelopes, `page` / `per_page`
Errors	Status codes and error envelopes
Rate limits	Limits and throttle headers
Webhooks	Event subscriptions, payload signatures
Changelog & roadmap	What changed, what's coming

Machine-readable spec & client collection

OpenAPI 3.1 specification: openapi.yaml at the repository root — import it into your tooling of choice.
Bruno collection: bruno/encryptinvoice-api/ — open it in Bruno and set the access_token / organization_id environment variables to start making calls.

Conventions at a glance

Dates: timestamps are ISO 8601 with offset (2026-05-01T10:00:00+00:00); business dates (issue_date, due_date) are Y-m-d.
Money: decimal strings ("1210.0000"), never floats; currency is a separate 3-letter ISO 4217 field.
Headers: always send Accept: application/json, and Content-Type: application/json on write requests.