API reference
Every record call the kit's samples make to a shop, one section per address, from the kit's API description (api/openapi.yaml). This page is built from that file, so the two cannot disagree. The few calls that are not record calls, such as the event feed and the ivendnext_mpos.api.v1 methods, are in the recipes that use them.
How every call signs in. Each call runs as your app's own integration user, with its key in one header: Authorization: token <api key>:<api secret>. It sees only what that user's role allows: a record the role cannot read answers 403, a missing one 404. The address is the shop's own, https://<site>. Security and the handshake says how your app gets the user and its key.
Try them. api/collection/run.sh sends every call with curl alone, against your sandbox (Get started, step 3).
/api/resource/Sales%20Invoice
GET List booked sales — the reconciliation pull filters on modified after a watermark
| Parameter | In | Required | What it is |
|---|---|---|---|
fields |
query | no | JSON array of field names, e.g. ["name","modified"]. Default: ["name"]. |
filters |
query | no | JSON array of [field, operator, value], e.g. [["docstatus","=",1],["modified",">=","2026-10-01 00:00:00"]]. |
order_by |
query | no | For example modified asc. |
limit_page_length |
query | no | Page size (default 20; 0 = all). |
limit_start |
query | no |
Sign-in: the Authorization header: Authorization: token <api_key>:<api_secret> — the integration user's key pair.
Answers: 200 The matching records — only the requested fields. · 401, 403 An error. exc_type names it (e.g. PermissionError, DoesNotExistError, ValidationError).
/api/resource/Sales%20Invoice/{name}
GET Read one sale with its lines
| Parameter | In | Required | What it is |
|---|---|---|---|
name |
path | yes | The record's name (URL-encoded). |
Sign-in: the Authorization header: Authorization: token <api_key>:<api_secret> — the integration user's key pair.
Answers: 200 The sale. · 403, 404 An error. exc_type names it (e.g. PermissionError, DoesNotExistError, ValidationError).
/api/resource/POS%20Invoice
GET List till sales (POS Invoices)
| Parameter | In | Required | What it is |
|---|---|---|---|
fields |
query | no | JSON array of field names, e.g. ["name","modified"]. Default: ["name"]. |
filters |
query | no | JSON array of [field, operator, value], e.g. [["docstatus","=",1],["modified",">=","2026-10-01 00:00:00"]]. |
order_by |
query | no | For example modified asc. |
limit_page_length |
query | no | Page size (default 20; 0 = all). |
Sign-in: the Authorization header: Authorization: token <api_key>:<api_secret> — the integration user's key pair.
Answers: 200 The matching records — only the requested fields. · 403 An error. exc_type names it (e.g. PermissionError, DoesNotExistError, ValidationError).
/api/resource/POS%20Invoice/{name}
GET Read one till sale with its lines
| Parameter | In | Required | What it is |
|---|---|---|---|
name |
path | yes | The record's name (URL-encoded). |
Sign-in: the Authorization header: Authorization: token <api_key>:<api_secret> — the integration user's key pair.
Answers: 200 The till sale. · 404 An error. exc_type names it (e.g. PermissionError, DoesNotExistError, ValidationError).
/api/resource/Item
GET List items — e.g. fields=["name","item_group"] and a name in [...] filter
| Parameter | In | Required | What it is |
|---|---|---|---|
fields |
query | no | JSON array of field names, e.g. ["name","modified"]. Default: ["name"]. |
filters |
query | no | JSON array of [field, operator, value], e.g. [["docstatus","=",1],["modified",">=","2026-10-01 00:00:00"]]. |
order_by |
query | no | For example modified asc. |
limit_page_length |
query | no | Page size (default 20; 0 = all). |
Sign-in: the Authorization header: Authorization: token <api_key>:<api_secret> — the integration user's key pair.
Answers: 200 The matching records — only the requested fields. · 403 An error. exc_type names it (e.g. PermissionError, DoesNotExistError, ValidationError).
/api/resource/Item/{name}
GET Read one item
| Parameter | In | Required | What it is |
|---|---|---|---|
name |
path | yes | The record's name (URL-encoded). |
Sign-in: the Authorization header: Authorization: token <api_key>:<api_secret> — the integration user's key pair.
Answers: 200 One record, with its child rows. · 404 An error. exc_type names it (e.g. PermissionError, DoesNotExistError, ValidationError).
/api/resource/Customer
GET List customers
| Parameter | In | Required | What it is |
|---|---|---|---|
fields |
query | no | JSON array of field names, e.g. ["name","modified"]. Default: ["name"]. |
filters |
query | no | JSON array of [field, operator, value], e.g. [["docstatus","=",1],["modified",">=","2026-10-01 00:00:00"]]. |
limit_page_length |
query | no | Page size (default 20; 0 = all). |
Sign-in: the Authorization header: Authorization: token <api_key>:<api_secret> — the integration user's key pair.
Answers: 200 The matching records — only the requested fields. · 403 An error. exc_type names it (e.g. PermissionError, DoesNotExistError, ValidationError).
/api/resource/Warehouse
GET List stores and stock locations (warehouses)
| Parameter | In | Required | What it is |
|---|---|---|---|
fields |
query | no | JSON array of field names, e.g. ["name","modified"]. Default: ["name"]. |
filters |
query | no | JSON array of [field, operator, value], e.g. [["docstatus","=",1],["modified",">=","2026-10-01 00:00:00"]]. |
limit_page_length |
query | no | Page size (default 20; 0 = all). |
Sign-in: the Authorization header: Authorization: token <api_key>:<api_secret> — the integration user's key pair.
Answers: 200 The matching records — only the requested fields. · 403 An error. exc_type names it (e.g. PermissionError, DoesNotExistError, ValidationError).
/api/resource/Serial%20No
GET List serial numbers — e.g. by item_code or status
| Parameter | In | Required | What it is |
|---|---|---|---|
fields |
query | no | JSON array of field names, e.g. ["name","modified"]. Default: ["name"]. |
filters |
query | no | JSON array of [field, operator, value], e.g. [["docstatus","=",1],["modified",">=","2026-10-01 00:00:00"]]. |
limit_page_length |
query | no | Page size (default 20; 0 = all). |
Sign-in: the Authorization header: Authorization: token <api_key>:<api_secret> — the integration user's key pair.
Answers: 200 The matching records — only the requested fields. · 403 An error. exc_type names it (e.g. PermissionError, DoesNotExistError, ValidationError).
/api/resource/Serial%20No/{name}
GET Read one serial number
| Parameter | In | Required | What it is |
|---|---|---|---|
name |
path | yes | The record's name (URL-encoded). |
Sign-in: the Authorization header: Authorization: token <api_key>:<api_secret> — the integration user's key pair.
Answers: 200 One record, with its child rows. · 404 An error. exc_type names it (e.g. PermissionError, DoesNotExistError, ValidationError).
/api/resource/Serial%20and%20Batch%20Bundle/{name}
GET Read the serial numbers a sale or stock line moved (its entries)
A sale line names its bundle in serial_and_batch_bundle; its entries[].serial_no are the line's serial numbers.
| Parameter | In | Required | What it is |
|---|---|---|---|
name |
path | yes | The record's name (URL-encoded). |
Sign-in: the Authorization header: Authorization: token <api_key>:<api_secret> — the integration user's key pair.
Answers: 200 The bundle. · 404 An error. exc_type names it (e.g. PermissionError, DoesNotExistError, ValidationError).
/api/resource/Stock%20Entry
GET List stock movements
| Parameter | In | Required | What it is |
|---|---|---|---|
fields |
query | no | JSON array of field names, e.g. ["name","modified"]. Default: ["name"]. |
filters |
query | no | JSON array of [field, operator, value], e.g. [["docstatus","=",1],["modified",">=","2026-10-01 00:00:00"]]. |
limit_page_length |
query | no | Page size (default 20; 0 = all). |
Sign-in: the Authorization header: Authorization: token <api_key>:<api_secret> — the integration user's key pair.
Answers: 200 The matching records — only the requested fields.
POST Create a stock movement — with docstatus 1 it is created AND booked in one call
Body: a JSON object (StockEntryIn), with stock_entry_type, items required.
Sign-in: the Authorization header: Authorization: token <api_key>:<api_secret> — the integration user's key pair.
Answers: 200 One record, with its child rows. · 403, 417 An error. exc_type names it (e.g. PermissionError, DoesNotExistError, ValidationError).
/api/resource/Stock%20Entry/{name}
GET Read one stock movement — its lines name the Serial and Batch Bundle that holds their serials
| Parameter | In | Required | What it is |
|---|---|---|---|
name |
path | yes | The record's name (URL-encoded). |
Sign-in: the Authorization header: Authorization: token <api_key>:<api_secret> — the integration user's key pair.
Answers: 200 One record, with its child rows. · 404 An error. exc_type names it (e.g. PermissionError, DoesNotExistError, ValidationError).
/api/v2/document/Stock%20Entry/{name}/method/submit/
POST Book (submit) a draft stock movement — the two-step alternative
| Parameter | In | Required | What it is |
|---|---|---|---|
name |
path | yes | The record's name (URL-encoded). |
Sign-in: the Authorization header: Authorization: token <api_key>:<api_secret> — the integration user's key pair.
Answers: 200 One record, with its child rows. · 403, 417 An error. exc_type names it (e.g. PermissionError, DoesNotExistError, ValidationError).
/api/resource/Comment
GET List comments on a record — how a service finds its own earlier comment
| Parameter | In | Required | What it is |
|---|---|---|---|
fields |
query | no | JSON array of field names, e.g. ["name","modified"]. Default: ["name"]. |
filters |
query | no | JSON array of [field, operator, value], e.g. [["docstatus","=",1],["modified",">=","2026-10-01 00:00:00"]]. |
limit_page_length |
query | no | Page size (default 20; 0 = all). |
Sign-in: the Authorization header: Authorization: token <api_key>:<api_secret> — the integration user's key pair.
Answers: 200 The matching records — only the requested fields.
POST Write a comment on a record — visible to staff on that record in iVendNext Desk
Body: a JSON object (CommentIn), with comment_type, reference_doctype, reference_name, content required.
Sign-in: the Authorization header: Authorization: token <api_key>:<api_secret> — the integration user's key pair.
Answers: 200 One record, with its child rows. · 403 An error. exc_type names it (e.g. PermissionError, DoesNotExistError, ValidationError).
/api/resource/POS%20Profile
GET List till profiles and the selling warehouse each sells from
| Parameter | In | Required | What it is |
|---|---|---|---|
fields |
query | no | JSON array of field names, e.g. ["name","modified"]. Default: ["name"]. |
filters |
query | no | JSON array of [field, operator, value], e.g. [["docstatus","=",1],["modified",">=","2026-10-01 00:00:00"]]. |
limit_page_length |
query | no | Page size (default 20; 0 = all). |
Sign-in: the Authorization header: Authorization: token <api_key>:<api_secret> — the integration user's key pair.
Answers: 200 The matching records — only the requested fields.
/api/resource/POS%20Profile/{name}
GET Read one till profile — its warehouse is where a till sale takes stock from
| Parameter | In | Required | What it is |
|---|---|---|---|
name |
path | yes | The record's name (URL-encoded). |
Sign-in: the Authorization header: Authorization: token <api_key>:<api_secret> — the integration user's key pair.
Answers: 200 One record, with its child rows. · 404 An error. exc_type names it (e.g. PermissionError, DoesNotExistError, ValidationError).
/api/resource/Bin
GET Read stock balances (the engine's own figures) — actual_qty per item and warehouse
| Parameter | In | Required | What it is |
|---|---|---|---|
fields |
query | no | JSON array of field names, e.g. ["name","modified"]. Default: ["name"]. |
filters |
query | no | JSON array of [field, operator, value], e.g. [["docstatus","=",1],["modified",">=","2026-10-01 00:00:00"]]. |
limit_page_length |
query | no | Page size (default 20; 0 = all). |
Sign-in: the Authorization header: Authorization: token <api_key>:<api_secret> — the integration user's key pair.
Answers: 200 The matching records — only the requested fields. · 403 An error. exc_type names it (e.g. PermissionError, DoesNotExistError, ValidationError).
/api/resource/{record_type}
GET List records of a type the partner's manifest installed (e.g. PP BLN Item In Bin)
The same record API as every other type. Only types whose permissions grant the integration role may be read.
| Parameter | In | Required | What it is |
|---|---|---|---|
record_type |
path | yes | A record type the partner's manifest installed, URL-encoded (e.g. PP%20BLN%20Item%20In%20Bin). |
fields |
query | no | JSON array of field names, e.g. ["name","modified"]. Default: ["name"]. |
filters |
query | no | JSON array of [field, operator, value], e.g. [["docstatus","=",1],["modified",">=","2026-10-01 00:00:00"]]. |
limit_page_length |
query | no | Page size (default 20; 0 = all). |
Sign-in: the Authorization header: Authorization: token <api_key>:<api_secret> — the integration user's key pair.
Answers: 200 The matching records — only the requested fields. · 403 An error. exc_type names it (e.g. PermissionError, DoesNotExistError, ValidationError).
POST Create a record of a manifest-installed type
| Parameter | In | Required | What it is |
|---|---|---|---|
record_type |
path | yes | A record type the partner's manifest installed, URL-encoded (e.g. PP%20BLN%20Item%20In%20Bin). |
Body: a JSON object, with the record's fields.
Sign-in: the Authorization header: Authorization: token <api_key>:<api_secret> — the integration user's key pair.
Answers: 200 One record, with its child rows. · 403, 417 An error. exc_type names it (e.g. PermissionError, DoesNotExistError, ValidationError).
/api/resource/{record_type}/{name}
GET Read one record of a manifest-installed type, with its child rows
| Parameter | In | Required | What it is |
|---|---|---|---|
record_type |
path | yes | A record type the partner's manifest installed, URL-encoded (e.g. PP%20BLN%20Item%20In%20Bin). |
name |
path | yes | The record's name (URL-encoded). |
Sign-in: the Authorization header: Authorization: token <api_key>:<api_secret> — the integration user's key pair.
Answers: 200 One record, with its child rows. · 404 An error. exc_type names it (e.g. PermissionError, DoesNotExistError, ValidationError).
PUT Change fields on that record — a child table sent here REPLACES its rows, so send the existing rows too
| Parameter | In | Required | What it is |
|---|---|---|---|
record_type |
path | yes | A record type the partner's manifest installed, URL-encoded (e.g. PP%20BLN%20Item%20In%20Bin). |
name |
path | yes | The record's name (URL-encoded). |
Body: a JSON object, with the record's fields.
Sign-in: the Authorization header: Authorization: token <api_key>:<api_secret> — the integration user's key pair.
Answers: 200 One record, with its child rows. · 403, 417 An error. exc_type names it (e.g. PermissionError, DoesNotExistError, ValidationError).