Skip to content
Developers
Svenska GitHub

Developers

API changelog

Every change to the NONOX Connect API, newest first. Within v1 changes are additive only (new endpoints, new optional fields, new values in responses); anything that would break an existing integration gets /v2, and v1 stays alongside for at least twelve months. This file is shown at nonox.app/utvecklare/andringar.

2026-11-01: v1.1.0

Added

  • Webhooks are now delivered: voucher.posted, invoice.sent, invoice.paid, supplier_invoice.approved. Signed with Nonox-Signature: t=<unix>,v1=<HMAC-SHA256 of "t.body">, with Nonox-Event-Id and Nonox-Event-Type, sent after commit, eight attempts over about a day and then disabled with a mail to the owner. Managed under Anslutningar (owner or administrator, passkey).
  • Token revocation (RFC 7009): POST /oauth/revoke, and revocation_endpoint in the metadata.
  • Articles: GET/POST /articles, GET/PATCH /articles/{id}.
  • Cost centres and projects: GET/POST /cost-centers, GET/PATCH /cost-centers/{id}, the same for /projects.
  • Customer invoices: GET/POST /invoices, GET/PATCH /invoices/{id}, POST /invoices/{id}/issue, /send, /credit, /payments, GET /invoices/{id}/pdf.
  • Supplier invoices: GET/POST /supplier-invoices, GET/PATCH/DELETE /supplier-invoices/{id}, POST /supplier-invoices/{id}/file, /register, /approve, /payments.
  • Payments: GET /payments, GET /supplier-payments.
  • Reports: GET /reports/trial-balance, /general-ledger, /balance-sheet, /income-statement.
  • VAT: GET /vat-periods, GET /vat-return.
  • Fiscal years: GET /fiscal-years/{id}/periods (locked months), GET /fiscal-years/{id}/sie (SIE 4).
  • Scopes: accounts:manage, reports:view, vat:prepare, export:sie, invoices:send, invoices:credit, payments:create.
  • required_scope_sets in 403 insufficient_scope: which combinations of scopes are enough.
  • Test companies with demo data for trying the API (php artisan connect:test-company or under Anslutningar).

Changed

  • The descriptions of invoices:view, invoices:create, supplier-invoices:create and supplier-invoices:approve now also cover the new resources. A key or app that already has them gets access to the new endpoints in the same area; nothing that worked before stops working.

2026-11-01: developer site

  • The public developer site at /utvecklare, in Swedish and English (?lang=en): guides, a reference generated from openapi.yaml, code samples in curl, PHP, JavaScript and Python, and the spec as YAML and JSON downloads.
  • openapi.yaml: the tags have an English name (x-en-name) and the scopes a Swedish description (x-sv-scopes). Additions only; no endpoint changed.

2026-11-01: v1.0.0

The first version of NONOX Connect (ADR-032).

  • Endpoints: the company, chart of accounts, VAT codes, fiscal years, voucher series, vouchers (list, get, create and change drafts, delete drafts, post, correct, upload and download attachments), customers and suppliers (list, get, create, change).
  • Authentication: OAuth 2.0 authorization code with PKCE (S256 for every app), consent by an owner or administrator with a passkey, access tokens of at most 15 minutes, refresh tokens rotated on every use that revoke the whole connection when used twice. API keys with an expiry date and an optional IP list.
  • Rules: Idempotency-Key on every POST, cursor pagination with updated_since, problem+json errors (RFC 9457), limits per key, company and IP address with RateLimit-* headers.
  • Coming: webhooks for voucher.posted, invoice.sent, invoice.paid and supplier_invoice.approved are described but not delivered yet.

Suggest a change on GitHub