Machine-readable contract published

Eonebill API Reference

Understand what the integration API exposes before handing the contract to Zapier, an AI agent, or another developer tool.

OpenAPI

3.1.0

Contract version

1.0.0

Public paths

76

Operations

101

Delivery boundary

What is ready now

The API contract, scoped key management, monthly usage enforcement, and discovery files are available for private integration testing. Zapier directory publishing and public MCP access remain separate releases.

OpenAPI contract

A validated OpenAPI 3.1 document describes public routes, methods, schemas, responses, and authentication.

Discovery catalog

A well-known API catalog lets compatible tools locate the contract without a hard-coded file path.

Agent-ready foundation

The same contract can ground future Zapier actions and MCP tools while keeping implementation details private.

Authentication is explicit

Every operation declares whether it accepts an organization API key, OAuth 2.1 access token, or signed-in Bearer session. Sensitive human actions such as sending an invoice remain session-only.

API key

Authorization: Bearer eob_...

Intended for supported machine-to-machine operations scoped to an organization.

Manage API keys

OAuth 2.1

Authorization: Bearer <oauth-token>

Authorization code + PKCE for third-party apps, with explicit organization and scope consent.

Register OAuth app

Bearer session

Authorization: Bearer <session>

Required for user-authorized actions and endpoints not enabled for API keys.

Predictable monthly limits

Every organization receives 1,000 API-key requests per UTC month. Multiple keys share the same allowance, so creating a new key does not reset usage.

Monthly allowance

1,000

API-key requests per organization

Hard limit

HTTP 429

No silent expansion beyond the allowance

Reset window

UTC month

Retry-After identifies the next available time

Successful API-key responses include X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset. A limited response also includes Retry-After.

Core workflow

Invoice and customer endpoints

Authentication badges below are read from the generated contract, not maintained separately.

get

List invoices

/api/v1/invoices
API key, OAuth, or session
post

Create an invoice

/api/v1/invoices
API key, OAuth, or session
get

Retrieve an invoice

/api/v1/invoices/{id}
API key, OAuth, or session
put

Update an invoice

/api/v1/invoices/{id}
API key, OAuth, or session
post

Send an invoice

/api/v1/invoices/{id}/send
Bearer session
post

Send a payment reminder

/api/v1/invoices/{id}/remind
Bearer session
get

List customers

/api/v1/customers
API key, OAuth, or session
post

Create a customer

/api/v1/customers
API key, OAuth, or session

Coverage by module

The largest public API areas in the current generated contract.

Invoices12 ops
User11 ops
Signatures10 ops
Auth8 ops
Estimates8 ops
Expenses8 ops
Proposals8 ops
Contracts7 ops

Source of truth

Use the files when you are ready to integrate

The JSON document is for tools and code generators. The catalog is the stable discovery entry point. This page is the human acceptance view of the same delivery.