Customers

The customer register.

List customers

GET /customers listCustomers

The customer register. Personal numbers are never returned, only has_personal_number.

Scope

invoices:view

Parameters

limit integer query

Page size, 1–200.

Default: 50 · minimum 1 · maximum 200
cursor string query

Opaque cursor from meta.next_cursor of the previous page.

at most 2000 characters
updated_since string (date-time) query

Only records whose updated_at is strictly later than this ISO 8601 time. Lists are ordered by updated_at, then id, so a sync stores the updated_at of the last record it has seen and passes it next time, walking all pages with `cursor`.

Example: 2026-03-01T00:00:00+01:00
is_active boolean query

Only active (true) or inactive (false) records.

Responses

200 OK – A page of customers.

application/jsonobject

data array<Customer> required
16 fields · each item
- id integer
- number integer
- name string
- org_number string nullable
- has_personal_number boolean
  
  Whether a personal number is on file. The number itself is never returned.
- vat_number string nullable
- email string nullable
- phone string nullable
- address object
  5 fields
  - line1 string nullable
  - line2 string nullable
  - postal_code string nullable
  - city string nullable
  - country string nullable
    
    ISO 3166-1 alpha-2.
- payment_terms_days integer
- is_active boolean
- reverse_charge_construction boolean
- foreign_sale string nullable
  
  Values: EU_GOODS, EU_SERVICES, EXPORT_GOODS, EXPORT_SERVICES, EU_TRIANGULAR, EU_CONSUMER_OSS
- processing_restricted boolean
  
  Processing restricted under GDPR art. 18.
- created_at string (date-time)
- updated_at string (date-time)
meta ListMeta required
3 fields
- limit integer required
- next_cursor string required nullable
  
  Opaque; pass as `cursor` for the next page. null on the last page.
- has_more boolean required

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

401 Unauthorized – Missing, invalid, expired or revoked token or API key. Also returned when the person behind the credential has left the company (an OAuth grant is then revoked for good).

All error codes · application/problem+json

unauthenticatedNo valid credential

Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, WWW-Authenticate

403 Forbidden – The credential may not do this: a scope is missing, the granting person no longer has the permission, the address is not allowed, the company is archived (read-only) or no longer allows the app.

All error codes · application/problem+json

insufficient_scopeScope missing or permission lost

Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.
forbiddenThe action refuses (for example changing a posted voucher)

Behörighet saknas för det här.
ip_not_allowedOutside the IP allowlist

Företaget tillåter inte anrop från den här adressen.
company_archivedWrite to an archived company

Företaget är arkiverat och kan bara läsas.
app_not_allowedThe company no longer allows the app

Företaget tillåter inte längre den här appen.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

404 Not Found – Not found. Also the answer for another company's ids (existence is never revealed) and for every call while NONOX Connect is turned off for the company.

All error codes · application/problem+json

not_foundUnknown id, other company's id, or module off

Det du söker finns inte.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

429 Too Many Requests – Rate limit exceeded (per credential, per company or per address). Wait Retry-After seconds.

All error codes · application/problem+json

rate_limitedOver the limit

För många anrop. Försök igen om 23 sekunder.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Retry-After

Code samples

curl

curl "https://nonox.app/api/v1/customers?limit=50&updated_since=2026-03-01T00%3A00%3A00%2B01%3A00" \
  -H "Authorization: Bearer $NONOX_TOKEN" \
  -H "Accept: application/json"

PHP (Laravel)

use Illuminate\Support\Facades\Http;

$response = Http::withToken(config('services.nonox.token'))
    ->acceptJson()
    ->get('https://nonox.app/api/v1/customers', [
        'limit' => 50,
        'updated_since' => '2026-03-01T00:00:00+01:00',
    ]);

$response->throw();

$data = $response->json('data');

PHP (Guzzle)

$client = new \GuzzleHttp\Client(['timeout' => 30]);

$response = $client->request('GET', 'https://nonox.app/api/v1/customers', [
    'headers' => [
        'Authorization' => 'Bearer '.getenv('NONOX_TOKEN'),
        'Accept' => 'application/json',
    ],
    'query' => [
        'limit' => 50,
        'updated_since' => '2026-03-01T00:00:00+01:00',
    ],
]);

$data = json_decode((string) $response->getBody(), true, flags: JSON_THROW_ON_ERROR)['data'];

JavaScript

const url = new URL('https://nonox.app/api/v1/customers');
url.searchParams.set('limit', '50');
url.searchParams.set('updated_since', '2026-03-01T00:00:00+01:00');

const response = await fetch(url, {
  headers: {
    Authorization: `Bearer ${process.env.NONOX_TOKEN}`,
    Accept: 'application/json',
  },
});

if (!response.ok) {
  const problem = await response.json();
  throw new Error(`${problem.code}: ${problem.detail}`);
}

const { data } = await response.json();

Python

import os
import requests

response = requests.get(
    "https://nonox.app/api/v1/customers",
    headers={
        "Authorization": f"Bearer {os.environ['NONOX_TOKEN']}",
        "Accept": "application/json",
    },
    params={
        "limit": 50,
        "updated_since": "2026-03-01T00:00:00+01:00",
    },
    timeout=30,
)
response.raise_for_status()

data = response.json()["data"]

Responses · 200

application/json

{
  "data": [
    {
      "id": 18,
      "number": 1004,
      "name": "Kund Exempel AB",
      "org_number": "559900-4560",
      "has_personal_number": false,
      "vat_number": "SE559900456001",
      "email": "faktura@kund.example.se",
      "phone": "08-000 00 00",
      "address": {
        "line1": "Kundvägen 5",
        "line2": null,
        "postal_code": "222 33",
        "city": "Exempelby",
        "country": "SE"
      },
      "payment_terms_days": 30,
      "is_active": true,
      "reverse_charge_construction": false,
      "foreign_sale": null,
      "processing_restricted": false,
      "created_at": "2026-02-10T13:00:00+01:00",
      "updated_at": "2026-02-10T13:00:00+01:00"
    }
  ],
  "meta": {
    "limit": 50,
    "next_cursor": "eyJ1cGRhdGVkX2F0IjoiMjAyNi0wMy0wMiAxMDo0NToxMiIsImlkIjoiMGI5ZjNjMWUiLCJfcG9pbnRzVG9OZXh0SXRlbXMiOnRydWV9",
    "has_more": true
  }
}

Error

4011 example

No valid credential

{
  "type": "urn:nonox:problem:unauthenticated",
  "title": "Unauthorized",
  "status": 401,
  "code": "unauthenticated",
  "detail": "Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

4035 examples

Scope missing or permission lost

{
  "type": "urn:nonox:problem:insufficient_scope",
  "title": "Forbidden",
  "status": 403,
  "code": "insufficient_scope",
  "detail": "Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17",
  "required_scopes": [
    "vouchers:post"
  ]
}

The action refuses (for example changing a posted voucher)

{
  "type": "urn:nonox:problem:forbidden",
  "title": "Forbidden",
  "status": 403,
  "code": "forbidden",
  "detail": "Behörighet saknas för det här.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

Outside the IP allowlist

{
  "type": "urn:nonox:problem:ip_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "ip_not_allowed",
  "detail": "Företaget tillåter inte anrop från den här adressen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

Write to an archived company

{
  "type": "urn:nonox:problem:company_archived",
  "title": "Forbidden",
  "status": 403,
  "code": "company_archived",
  "detail": "Företaget är arkiverat och kan bara läsas.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

The company no longer allows the app

{
  "type": "urn:nonox:problem:app_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "app_not_allowed",
  "detail": "Företaget tillåter inte längre den här appen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

4041 example

Unknown id, other company's id, or module off

{
  "type": "urn:nonox:problem:not_found",
  "title": "Not Found",
  "status": 404,
  "code": "not_found",
  "detail": "Det du söker finns inte.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

4291 example

Over the limit

{
  "type": "urn:nonox:problem:rate_limited",
  "title": "Too Many Requests",
  "status": 429,
  "code": "rate_limited",
  "detail": "För många anrop. Försök igen om 23 sekunder.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

Create a customer

POST /customers createCustomer

Adds a customer; the number comes from the company's customer number series. personal_number is write-only (for sole traders and private persons) and is stored encrypted. Same Action as the app (SaveCustomer).

Scope

invoices:create

Parameters

Idempotency-Key string header required

Required on every POST. A unique value per intended operation (a UUID v4 is ideal), 1–255 visible ASCII characters. Kept 24 hours per credential: the same key with the same request returns the stored response (Idempotent-Replayed: true); with a different request 422 idempotency_key_reused; while the first is still running 409. Server errors (5xx) are not stored, so retry with the same key.

at least 1 characters · at most 255 characters · Example: 3f6c1b7e-2d4a-4e8b-9c0d-5a1b2c3d4e5f

Request body

application/jsonCustomerInput required

The customer.

name string required

at most 255 characters
org_number string nullable

Swedish organisation number, checked with Luhn.
personal_number string nullable write-only

Write-only. Personnummer for sole traders and private persons, checked with Luhn, stored encrypted, never returned.
vat_number string nullable

Starts with the country code.

at most 20 characters · pattern ^[A-Z]{2}[0-9A-Z]{2,18}$
email string (email) nullable

at most 255 characters
phone string nullable

at most 50 characters
address_line1 string nullable

at most 255 characters
address_line2 string nullable

at most 255 characters
postal_code string nullable

at most 20 characters
city string nullable

at most 255 characters
country string nullable

Two-letter country code.

pattern ^[A-Za-z]{2}$
payment_terms_days integer required

minimum 0 · maximum 365
is_active boolean
reverse_charge_construction boolean

Construction services under omvänd betalningsskyldighet.
foreign_sale string nullable

Values: EU_GOODS, EU_SERVICES, EXPORT_GOODS, EXPORT_SERVICES, EU_TRIANGULAR, EU_CONSUMER_OSS

Responses

201 Created – The customer.

application/jsonobject

data Customer required
16 fields
- id integer
- number integer
- name string
- org_number string nullable
- has_personal_number boolean
  
  Whether a personal number is on file. The number itself is never returned.
- vat_number string nullable
- email string nullable
- phone string nullable
- address object
  5 fields
  - line1 string nullable
  - line2 string nullable
  - postal_code string nullable
  - city string nullable
  - country string nullable
    
    ISO 3166-1 alpha-2.
- payment_terms_days integer
- is_active boolean
- reverse_charge_construction boolean
- foreign_sale string nullable
  
  Values: EU_GOODS, EU_SERVICES, EXPORT_GOODS, EXPORT_SERVICES, EU_TRIANGULAR, EU_CONSUMER_OSS
- processing_restricted boolean
  
  Processing restricted under GDPR art. 18.
- created_at string (date-time)
- updated_at string (date-time)

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Location, Idempotent-Replayed

400 Bad Request – Bad request: missing or invalid Idempotency-Key, or a body that is not a JSON object.

All error codes · application/problem+json

idempotency_key_requiredNo Idempotency-Key on a POST

Skicka en unik Idempotency-Key (till exempel ett UUID) med varje POST, så att ett nytt försök aldrig bokför två gånger.
idempotency_key_invalidIdempotency-Key too long or not visible ASCII

Idempotency-Key ska vara 1–255 synliga ASCII-tecken.
invalid_jsonMalformed JSON

Kroppen är inte giltig JSON (ett objekt).

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

401 Unauthorized – Missing, invalid, expired or revoked token or API key. Also returned when the person behind the credential has left the company (an OAuth grant is then revoked for good).

All error codes · application/problem+json

unauthenticatedNo valid credential

Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, WWW-Authenticate

All error codes · application/problem+json

insufficient_scopeScope missing or permission lost

Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.
forbiddenThe action refuses (for example changing a posted voucher)

Behörighet saknas för det här.
ip_not_allowedOutside the IP allowlist

Företaget tillåter inte anrop från den här adressen.
company_archivedWrite to an archived company

Företaget är arkiverat och kan bara läsas.
app_not_allowedThe company no longer allows the app

Företaget tillåter inte längre den här appen.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

404 Not Found – Not found. Also the answer for another company's ids (existence is never revealed) and for every call while NONOX Connect is turned off for the company.

All error codes · application/problem+json

not_foundUnknown id, other company's id, or module off

Det du söker finns inte.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

409 Conflict – A request with the same Idempotency-Key is still running.

All error codes · application/problem+json

idempotency_in_progressSame key, first request not finished

En begäran med samma Idempotency-Key pågår. Vänta och försök igen.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Retry-After

415 Unsupported Media Type – The body is not application/json (or multipart/form-data where a file is accepted).

All error codes · application/problem+json

unsupported_media_typeWrong Content-Type

Skicka JSON (application/json).

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

422 Unprocessable Content – Validation failed, or the Idempotency-Key was already used for a different request.

All error codes · application/problem+json

validation_failedField errors

Uppgifterna kunde inte godtas. Se errors.
idempotency_key_reusedSame key, different body

Idempotency-Key har redan använts för en annan begäran. Använd en ny nyckel för en ny begäran.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

429 Too Many Requests – Rate limit exceeded (per credential, per company or per address). Wait Retry-After seconds.

All error codes · application/problem+json

rate_limitedOver the limit

För många anrop. Försök igen om 23 sekunder.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Retry-After

Code samples

curl

curl -X POST "https://nonox.app/api/v1/customers" \
  -H "Authorization: Bearer $NONOX_TOKEN" \
  -H "Accept: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "Kund Exempel AB",
  "org_number": "559900-4560",
  "vat_number": "SE559900456001",
  "email": "faktura@kund.example.se",
  "address_line1": "Kundvägen 5",
  "postal_code": "222 33",
  "city": "Exempelby",
  "country": "SE",
  "payment_terms_days": 30
}'

PHP (Laravel)

use Illuminate\Support\Facades\Http;
use Illuminate\Support\Str;

$response = Http::withToken(config('services.nonox.token'))
    ->acceptJson()
    ->withHeaders(['Idempotency-Key' => (string) Str::uuid()])
    ->post('https://nonox.app/api/v1/customers', [
        'name' => 'Kund Exempel AB',
        'org_number' => '559900-4560',
        'vat_number' => 'SE559900456001',
        'email' => 'faktura@kund.example.se',
        'address_line1' => 'Kundvägen 5',
        'postal_code' => '222 33',
        'city' => 'Exempelby',
        'country' => 'SE',
        'payment_terms_days' => 30,
    ]);

$response->throw();

$data = $response->json('data');

PHP (Guzzle)

$client = new \GuzzleHttp\Client(['timeout' => 30]);

$response = $client->request('POST', 'https://nonox.app/api/v1/customers', [
    'headers' => [
        'Authorization' => 'Bearer '.getenv('NONOX_TOKEN'),
        'Accept' => 'application/json',
        'Idempotency-Key' => bin2hex(random_bytes(16)),
    ],
    'json' => [
        'name' => 'Kund Exempel AB',
        'org_number' => '559900-4560',
        'vat_number' => 'SE559900456001',
        'email' => 'faktura@kund.example.se',
        'address_line1' => 'Kundvägen 5',
        'postal_code' => '222 33',
        'city' => 'Exempelby',
        'country' => 'SE',
        'payment_terms_days' => 30,
    ],
]);

$data = json_decode((string) $response->getBody(), true, flags: JSON_THROW_ON_ERROR)['data'];

JavaScript

const response = await fetch('https://nonox.app/api/v1/customers', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NONOX_TOKEN}`,
    Accept: 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "name": "Kund Exempel AB",
    "org_number": "559900-4560",
    "vat_number": "SE559900456001",
    "email": "faktura@kund.example.se",
    "address_line1": "Kundvägen 5",
    "postal_code": "222 33",
    "city": "Exempelby",
    "country": "SE",
    "payment_terms_days": 30
  }),
});

if (!response.ok) {
  const problem = await response.json();
  throw new Error(`${problem.code}: ${problem.detail}`);
}

const { data } = await response.json();

Python

import os
import uuid
import requests

response = requests.post(
    "https://nonox.app/api/v1/customers",
    headers={
        "Authorization": f"Bearer {os.environ['NONOX_TOKEN']}",
        "Accept": "application/json",
        "Idempotency-Key": str(uuid.uuid4()),
    },
    json={
        "name": "Kund Exempel AB",
        "org_number": "559900-4560",
        "vat_number": "SE559900456001",
        "email": "faktura@kund.example.se",
        "address_line1": "Kundvägen 5",
        "postal_code": "222 33",
        "city": "Exempelby",
        "country": "SE",
        "payment_terms_days": 30,
    },
    timeout=30,
)
response.raise_for_status()

data = response.json()["data"]

Responses · 201

application/json

{
  "data": {
    "id": 18,
    "number": 1004,
    "name": "Kund Exempel AB",
    "org_number": "559900-4560",
    "has_personal_number": false,
    "vat_number": "SE559900456001",
    "email": "faktura@kund.example.se",
    "phone": "08-000 00 00",
    "address": {
      "line1": "Kundvägen 5",
      "line2": null,
      "postal_code": "222 33",
      "city": "Exempelby",
      "country": "SE"
    },
    "payment_terms_days": 30,
    "is_active": true,
    "reverse_charge_construction": false,
    "foreign_sale": null,
    "processing_restricted": false,
    "created_at": "2026-02-10T13:00:00+01:00",
    "updated_at": "2026-02-10T13:00:00+01:00"
  }
}

Error

4003 examples

No Idempotency-Key on a POST

{
  "type": "urn:nonox:problem:idempotency_key_required",
  "title": "Bad Request",
  "status": 400,
  "code": "idempotency_key_required",
  "detail": "Skicka en unik Idempotency-Key (till exempel ett UUID) med varje POST, så att ett nytt försök aldrig bokför två gånger.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

Idempotency-Key too long or not visible ASCII

{
  "type": "urn:nonox:problem:idempotency_key_invalid",
  "title": "Bad Request",
  "status": 400,
  "code": "idempotency_key_invalid",
  "detail": "Idempotency-Key ska vara 1–255 synliga ASCII-tecken.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

Malformed JSON

{
  "type": "urn:nonox:problem:invalid_json",
  "title": "Bad Request",
  "status": 400,
  "code": "invalid_json",
  "detail": "Kroppen är inte giltig JSON (ett objekt).",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

4011 example

No valid credential

{
  "type": "urn:nonox:problem:unauthenticated",
  "title": "Unauthorized",
  "status": 401,
  "code": "unauthenticated",
  "detail": "Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

4035 examples

Scope missing or permission lost

{
  "type": "urn:nonox:problem:insufficient_scope",
  "title": "Forbidden",
  "status": 403,
  "code": "insufficient_scope",
  "detail": "Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17",
  "required_scopes": [
    "vouchers:post"
  ]
}

The action refuses (for example changing a posted voucher)

{
  "type": "urn:nonox:problem:forbidden",
  "title": "Forbidden",
  "status": 403,
  "code": "forbidden",
  "detail": "Behörighet saknas för det här.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

Outside the IP allowlist

{
  "type": "urn:nonox:problem:ip_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "ip_not_allowed",
  "detail": "Företaget tillåter inte anrop från den här adressen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

Write to an archived company

{
  "type": "urn:nonox:problem:company_archived",
  "title": "Forbidden",
  "status": 403,
  "code": "company_archived",
  "detail": "Företaget är arkiverat och kan bara läsas.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

The company no longer allows the app

{
  "type": "urn:nonox:problem:app_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "app_not_allowed",
  "detail": "Företaget tillåter inte längre den här appen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

4041 example

Unknown id, other company's id, or module off

{
  "type": "urn:nonox:problem:not_found",
  "title": "Not Found",
  "status": 404,
  "code": "not_found",
  "detail": "Det du söker finns inte.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

4091 example

Same key, first request not finished

{
  "type": "urn:nonox:problem:idempotency_in_progress",
  "title": "Conflict",
  "status": 409,
  "code": "idempotency_in_progress",
  "detail": "En begäran med samma Idempotency-Key pågår. Vänta och försök igen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

4151 example

Wrong Content-Type

{
  "type": "urn:nonox:problem:unsupported_media_type",
  "title": "Unsupported Media Type",
  "status": 415,
  "code": "unsupported_media_type",
  "detail": "Skicka JSON (application/json).",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

4222 examples

Field errors

{
  "type": "urn:nonox:problem:validation_failed",
  "title": "Unprocessable Content",
  "status": 422,
  "code": "validation_failed",
  "detail": "Uppgifterna kunde inte godtas. Se errors.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17",
  "errors": {
    "rows": [
      "Verifikationen balanserar inte: debet och kredit skiljer sig åt."
    ],
    "voucher_date": [
      "Det finns inget räkenskapsår som omfattar 2031-01-01."
    ]
  }
}

Same key, different body

{
  "type": "urn:nonox:problem:idempotency_key_reused",
  "title": "Unprocessable Content",
  "status": 422,
  "code": "idempotency_key_reused",
  "detail": "Idempotency-Key har redan använts för en annan begäran. Använd en ny nyckel för en ny begäran.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

4291 example

Over the limit

{
  "type": "urn:nonox:problem:rate_limited",
  "title": "Too Many Requests",
  "status": 429,
  "code": "rate_limited",
  "detail": "För många anrop. Försök igen om 23 sekunder.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

Get a customer

GET /customers/{customer} getCustomer

One customer by id.

Scope

invoices:view

Parameters

customer integer path required

Customer id (not the customer number).

Example: 18

Responses

200 OK – The customer.

application/jsonobject

data Customer required
16 fields
- id integer
- number integer
- name string
- org_number string nullable
- has_personal_number boolean
  
  Whether a personal number is on file. The number itself is never returned.
- vat_number string nullable
- email string nullable
- phone string nullable
- address object
  5 fields
  - line1 string nullable
  - line2 string nullable
  - postal_code string nullable
  - city string nullable
  - country string nullable
    
    ISO 3166-1 alpha-2.
- payment_terms_days integer
- is_active boolean
- reverse_charge_construction boolean
- foreign_sale string nullable
  
  Values: EU_GOODS, EU_SERVICES, EXPORT_GOODS, EXPORT_SERVICES, EU_TRIANGULAR, EU_CONSUMER_OSS
- processing_restricted boolean
  
  Processing restricted under GDPR art. 18.
- created_at string (date-time)
- updated_at string (date-time)

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

401 Unauthorized – Missing, invalid, expired or revoked token or API key. Also returned when the person behind the credential has left the company (an OAuth grant is then revoked for good).

All error codes · application/problem+json

unauthenticatedNo valid credential

Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, WWW-Authenticate

All error codes · application/problem+json

insufficient_scopeScope missing or permission lost

Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.
forbiddenThe action refuses (for example changing a posted voucher)

Behörighet saknas för det här.
ip_not_allowedOutside the IP allowlist

Företaget tillåter inte anrop från den här adressen.
company_archivedWrite to an archived company

Företaget är arkiverat och kan bara läsas.
app_not_allowedThe company no longer allows the app

Företaget tillåter inte längre den här appen.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

404 Not Found – Not found. Also the answer for another company's ids (existence is never revealed) and for every call while NONOX Connect is turned off for the company.

All error codes · application/problem+json

not_foundUnknown id, other company's id, or module off

Det du söker finns inte.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

429 Too Many Requests – Rate limit exceeded (per credential, per company or per address). Wait Retry-After seconds.

All error codes · application/problem+json

rate_limitedOver the limit

För många anrop. Försök igen om 23 sekunder.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Retry-After

Code samples

curl

curl "https://nonox.app/api/v1/customers/18" \
  -H "Authorization: Bearer $NONOX_TOKEN" \
  -H "Accept: application/json"

PHP (Laravel)

use Illuminate\Support\Facades\Http;

$response = Http::withToken(config('services.nonox.token'))
    ->acceptJson()
    ->get('https://nonox.app/api/v1/customers/18');

$response->throw();

$data = $response->json('data');

PHP (Guzzle)

$client = new \GuzzleHttp\Client(['timeout' => 30]);

$response = $client->request('GET', 'https://nonox.app/api/v1/customers/18', [
    'headers' => [
        'Authorization' => 'Bearer '.getenv('NONOX_TOKEN'),
        'Accept' => 'application/json',
    ],
]);

$data = json_decode((string) $response->getBody(), true, flags: JSON_THROW_ON_ERROR)['data'];

JavaScript

const response = await fetch('https://nonox.app/api/v1/customers/18', {
  headers: {
    Authorization: `Bearer ${process.env.NONOX_TOKEN}`,
    Accept: 'application/json',
  },
});

if (!response.ok) {
  const problem = await response.json();
  throw new Error(`${problem.code}: ${problem.detail}`);
}

const { data } = await response.json();

Python

import os
import requests

response = requests.get(
    "https://nonox.app/api/v1/customers/18",
    headers={
        "Authorization": f"Bearer {os.environ['NONOX_TOKEN']}",
        "Accept": "application/json",
    },
    timeout=30,
)
response.raise_for_status()

data = response.json()["data"]

Responses · 200

application/json

{
  "data": {
    "id": 18,
    "number": 1004,
    "name": "Kund Exempel AB",
    "org_number": "559900-4560",
    "has_personal_number": false,
    "vat_number": "SE559900456001",
    "email": "faktura@kund.example.se",
    "phone": "08-000 00 00",
    "address": {
      "line1": "Kundvägen 5",
      "line2": null,
      "postal_code": "222 33",
      "city": "Exempelby",
      "country": "SE"
    },
    "payment_terms_days": 30,
    "is_active": true,
    "reverse_charge_construction": false,
    "foreign_sale": null,
    "processing_restricted": false,
    "created_at": "2026-02-10T13:00:00+01:00",
    "updated_at": "2026-02-10T13:00:00+01:00"
  }
}

Error

4011 example

No valid credential

{
  "type": "urn:nonox:problem:unauthenticated",
  "title": "Unauthorized",
  "status": 401,
  "code": "unauthenticated",
  "detail": "Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

4035 examples

Scope missing or permission lost

{
  "type": "urn:nonox:problem:insufficient_scope",
  "title": "Forbidden",
  "status": 403,
  "code": "insufficient_scope",
  "detail": "Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17",
  "required_scopes": [
    "vouchers:post"
  ]
}

The action refuses (for example changing a posted voucher)

{
  "type": "urn:nonox:problem:forbidden",
  "title": "Forbidden",
  "status": 403,
  "code": "forbidden",
  "detail": "Behörighet saknas för det här.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

Outside the IP allowlist

{
  "type": "urn:nonox:problem:ip_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "ip_not_allowed",
  "detail": "Företaget tillåter inte anrop från den här adressen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

Write to an archived company

{
  "type": "urn:nonox:problem:company_archived",
  "title": "Forbidden",
  "status": 403,
  "code": "company_archived",
  "detail": "Företaget är arkiverat och kan bara läsas.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

The company no longer allows the app

{
  "type": "urn:nonox:problem:app_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "app_not_allowed",
  "detail": "Företaget tillåter inte längre den här appen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

4041 example

Unknown id, other company's id, or module off

{
  "type": "urn:nonox:problem:not_found",
  "title": "Not Found",
  "status": 404,
  "code": "not_found",
  "detail": "Det du söker finns inte.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

4291 example

Over the limit

{
  "type": "urn:nonox:problem:rate_limited",
  "title": "Too Many Requests",
  "status": 429,
  "code": "rate_limited",
  "detail": "För många anrop. Försök igen om 23 sekunder.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

Change a customer

PATCH /customers/{customer} updateCustomer

Changes the fields sent; the others keep their values.

Scope

invoices:create

Parameters

customer integer path required

Customer id (not the customer number).

Example: 18

Request body

application/jsonCustomerPatch required

Any subset of CustomerInput.

name string

at most 255 characters
org_number string nullable

Swedish organisation number, checked with Luhn.
personal_number string nullable write-only

Write-only. Personnummer for sole traders and private persons, checked with Luhn, stored encrypted, never returned.
vat_number string nullable

Starts with the country code.

at most 20 characters · pattern ^[A-Z]{2}[0-9A-Z]{2,18}$
email string (email) nullable

at most 255 characters
phone string nullable

at most 50 characters
address_line1 string nullable

at most 255 characters
address_line2 string nullable

at most 255 characters
postal_code string nullable

at most 20 characters
city string nullable

at most 255 characters
country string nullable

Two-letter country code.

pattern ^[A-Za-z]{2}$
payment_terms_days integer

minimum 0 · maximum 365
is_active boolean
reverse_charge_construction boolean

Construction services under omvänd betalningsskyldighet.
foreign_sale string nullable

Values: EU_GOODS, EU_SERVICES, EXPORT_GOODS, EXPORT_SERVICES, EU_TRIANGULAR, EU_CONSUMER_OSS

Responses

200 OK – The customer.

application/jsonobject

data Customer required
16 fields
- id integer
- number integer
- name string
- org_number string nullable
- has_personal_number boolean
  
  Whether a personal number is on file. The number itself is never returned.
- vat_number string nullable
- email string nullable
- phone string nullable
- address object
  5 fields
  - line1 string nullable
  - line2 string nullable
  - postal_code string nullable
  - city string nullable
  - country string nullable
    
    ISO 3166-1 alpha-2.
- payment_terms_days integer
- is_active boolean
- reverse_charge_construction boolean
- foreign_sale string nullable
  
  Values: EU_GOODS, EU_SERVICES, EXPORT_GOODS, EXPORT_SERVICES, EU_TRIANGULAR, EU_CONSUMER_OSS
- processing_restricted boolean
  
  Processing restricted under GDPR art. 18.
- created_at string (date-time)
- updated_at string (date-time)

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

400 Bad Request – Bad request: missing or invalid Idempotency-Key, or a body that is not a JSON object.

All error codes · application/problem+json

idempotency_key_requiredNo Idempotency-Key on a POST

Skicka en unik Idempotency-Key (till exempel ett UUID) med varje POST, så att ett nytt försök aldrig bokför två gånger.
idempotency_key_invalidIdempotency-Key too long or not visible ASCII

Idempotency-Key ska vara 1–255 synliga ASCII-tecken.
invalid_jsonMalformed JSON

Kroppen är inte giltig JSON (ett objekt).

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

401 Unauthorized – Missing, invalid, expired or revoked token or API key. Also returned when the person behind the credential has left the company (an OAuth grant is then revoked for good).

All error codes · application/problem+json

unauthenticatedNo valid credential

Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, WWW-Authenticate

All error codes · application/problem+json

insufficient_scopeScope missing or permission lost

Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.
forbiddenThe action refuses (for example changing a posted voucher)

Behörighet saknas för det här.
ip_not_allowedOutside the IP allowlist

Företaget tillåter inte anrop från den här adressen.
company_archivedWrite to an archived company

Företaget är arkiverat och kan bara läsas.
app_not_allowedThe company no longer allows the app

Företaget tillåter inte längre den här appen.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

404 Not Found – Not found. Also the answer for another company's ids (existence is never revealed) and for every call while NONOX Connect is turned off for the company.

All error codes · application/problem+json

not_foundUnknown id, other company's id, or module off

Det du söker finns inte.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

415 Unsupported Media Type – The body is not application/json (or multipart/form-data where a file is accepted).

All error codes · application/problem+json

unsupported_media_typeWrong Content-Type

Skicka JSON (application/json).

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

422 Unprocessable Content – Validation failed, or the Idempotency-Key was already used for a different request.

All error codes · application/problem+json

validation_failedField errors

Uppgifterna kunde inte godtas. Se errors.
idempotency_key_reusedSame key, different body

Idempotency-Key har redan använts för en annan begäran. Använd en ny nyckel för en ny begäran.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

429 Too Many Requests – Rate limit exceeded (per credential, per company or per address). Wait Retry-After seconds.

All error codes · application/problem+json

rate_limitedOver the limit

För många anrop. Försök igen om 23 sekunder.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Retry-After

Code samples

curl

curl -X PATCH "https://nonox.app/api/v1/customers/18" \
  -H "Authorization: Bearer $NONOX_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{
  "payment_terms_days": 20
}'

PHP (Laravel)

use Illuminate\Support\Facades\Http;

$response = Http::withToken(config('services.nonox.token'))
    ->acceptJson()
    ->patch('https://nonox.app/api/v1/customers/18', [
        'payment_terms_days' => 20,
    ]);

$response->throw();

$data = $response->json('data');

PHP (Guzzle)

$client = new \GuzzleHttp\Client(['timeout' => 30]);

$response = $client->request('PATCH', 'https://nonox.app/api/v1/customers/18', [
    'headers' => [
        'Authorization' => 'Bearer '.getenv('NONOX_TOKEN'),
        'Accept' => 'application/json',
    ],
    'json' => [
        'payment_terms_days' => 20,
    ],
]);

$data = json_decode((string) $response->getBody(), true, flags: JSON_THROW_ON_ERROR)['data'];

JavaScript

const response = await fetch('https://nonox.app/api/v1/customers/18', {
  method: 'PATCH',
  headers: {
    Authorization: `Bearer ${process.env.NONOX_TOKEN}`,
    Accept: 'application/json',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "payment_terms_days": 20
  }),
});

if (!response.ok) {
  const problem = await response.json();
  throw new Error(`${problem.code}: ${problem.detail}`);
}

const { data } = await response.json();

Python

import os
import requests

response = requests.patch(
    "https://nonox.app/api/v1/customers/18",
    headers={
        "Authorization": f"Bearer {os.environ['NONOX_TOKEN']}",
        "Accept": "application/json",
    },
    json={
        "payment_terms_days": 20,
    },
    timeout=30,
)
response.raise_for_status()

data = response.json()["data"]

Responses · 200

application/json

{
  "data": {
    "id": 18,
    "number": 1004,
    "name": "Kund Exempel AB",
    "org_number": "559900-4560",
    "has_personal_number": false,
    "vat_number": "SE559900456001",
    "email": "faktura@kund.example.se",
    "phone": "08-000 00 00",
    "address": {
      "line1": "Kundvägen 5",
      "line2": null,
      "postal_code": "222 33",
      "city": "Exempelby",
      "country": "SE"
    },
    "payment_terms_days": 20,
    "is_active": true,
    "reverse_charge_construction": false,
    "foreign_sale": null,
    "processing_restricted": false,
    "created_at": "2026-02-10T13:00:00+01:00",
    "updated_at": "2026-02-10T13:00:00+01:00"
  }
}

Error

4003 examples

No Idempotency-Key on a POST

{
  "type": "urn:nonox:problem:idempotency_key_required",
  "title": "Bad Request",
  "status": 400,
  "code": "idempotency_key_required",
  "detail": "Skicka en unik Idempotency-Key (till exempel ett UUID) med varje POST, så att ett nytt försök aldrig bokför två gånger.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

Idempotency-Key too long or not visible ASCII

{
  "type": "urn:nonox:problem:idempotency_key_invalid",
  "title": "Bad Request",
  "status": 400,
  "code": "idempotency_key_invalid",
  "detail": "Idempotency-Key ska vara 1–255 synliga ASCII-tecken.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

Malformed JSON

{
  "type": "urn:nonox:problem:invalid_json",
  "title": "Bad Request",
  "status": 400,
  "code": "invalid_json",
  "detail": "Kroppen är inte giltig JSON (ett objekt).",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

4011 example

No valid credential

{
  "type": "urn:nonox:problem:unauthenticated",
  "title": "Unauthorized",
  "status": 401,
  "code": "unauthenticated",
  "detail": "Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

4035 examples

Scope missing or permission lost

{
  "type": "urn:nonox:problem:insufficient_scope",
  "title": "Forbidden",
  "status": 403,
  "code": "insufficient_scope",
  "detail": "Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17",
  "required_scopes": [
    "vouchers:post"
  ]
}

The action refuses (for example changing a posted voucher)

{
  "type": "urn:nonox:problem:forbidden",
  "title": "Forbidden",
  "status": 403,
  "code": "forbidden",
  "detail": "Behörighet saknas för det här.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

Outside the IP allowlist

{
  "type": "urn:nonox:problem:ip_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "ip_not_allowed",
  "detail": "Företaget tillåter inte anrop från den här adressen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

Write to an archived company

{
  "type": "urn:nonox:problem:company_archived",
  "title": "Forbidden",
  "status": 403,
  "code": "company_archived",
  "detail": "Företaget är arkiverat och kan bara läsas.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

The company no longer allows the app

{
  "type": "urn:nonox:problem:app_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "app_not_allowed",
  "detail": "Företaget tillåter inte längre den här appen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

4041 example

Unknown id, other company's id, or module off

{
  "type": "urn:nonox:problem:not_found",
  "title": "Not Found",
  "status": 404,
  "code": "not_found",
  "detail": "Det du söker finns inte.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

4151 example

Wrong Content-Type

{
  "type": "urn:nonox:problem:unsupported_media_type",
  "title": "Unsupported Media Type",
  "status": 415,
  "code": "unsupported_media_type",
  "detail": "Skicka JSON (application/json).",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

4222 examples

Field errors

{
  "type": "urn:nonox:problem:validation_failed",
  "title": "Unprocessable Content",
  "status": 422,
  "code": "validation_failed",
  "detail": "Uppgifterna kunde inte godtas. Se errors.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17",
  "errors": {
    "rows": [
      "Verifikationen balanserar inte: debet och kredit skiljer sig åt."
    ],
    "voucher_date": [
      "Det finns inget räkenskapsår som omfattar 2031-01-01."
    ]
  }
}

Same key, different body

{
  "type": "urn:nonox:problem:idempotency_key_reused",
  "title": "Unprocessable Content",
  "status": 422,
  "code": "idempotency_key_reused",
  "detail": "Idempotency-Key har redan använts för en annan begäran. Använd en ny nyckel för en ny begäran.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

4291 example

Over the limit

{
  "type": "urn:nonox:problem:rate_limited",
  "title": "Too Many Requests",
  "status": 429,
  "code": "rate_limited",
  "detail": "För många anrop. Försök igen om 23 sekunder.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}