Skip to content
Developers
Svenska GitHub

API reference

Vouchers

Vouchers: drafts, posting, corrections and attachments (underlag). A posted voucher is immutable.

List vouchers

GET /vouchers listVouchers

Vouchers with their rows and attachment metadata, filtered by status, series, fiscal year and voucher date. Use updated_since to sync: posting a draft changes its updated_at, a posted voucher never changes again except that corrected_by_voucher_id is set once when it is corrected.

Scope

vouchers:view

Parameters

  • limit integer query

    Page size, 1–200.

    Default: 50 · minimum 1 · maximum 200

  • cursor string query

    Opaque cursor from meta.next_cursor of the previous page.

    at most 2000 characters

  • updated_since string (date-time) query

    Only records whose updated_at is strictly later than this ISO 8601 time. Lists are ordered by updated_at, then id, so a sync stores the updated_at of the last record it has seen and passes it next time, walking all pages with `cursor`.

    Example: 2026-03-01T00:00:00+01:00

  • status string query

    DRAFT or POSTED.

    Values: DRAFT, POSTED

  • series string query

    Series code, for example A.

    at most 3 characters

  • fiscal_year_id integer query

    Only vouchers in this fiscal year.

  • date_from string (date) query

    Voucher date on or after (YYYY-MM-DD).

  • date_to string (date) query

    Voucher date on or before (YYYY-MM-DD).

Responses

200 OK – A page of vouchers.

application/jsonobject

  • data array<Voucher> required
    18 fields · each item
    • id string (uuid)
    • series string
    • number integer nullable

      Assigned at posting; null for a draft.

    • reference string nullable

      Series and number, e.g. A57; null for a draft.

    • status string

      Values: DRAFT, POSTED

    • fiscal_year_id integer
    • voucher_date string (date)
    • description string
    • source string

      Values: MANUAL, INVOICE, PAYMENT, SUPPLIER_INVOICE, VAT, PAYROLL, IMPORT_SIE, IMPORT_FORTNOX, CLOSING, CORRECTION

    • corrects_voucher_id string (uuid) nullable
    • corrected_by_voucher_id string (uuid) nullable
    • posted_at string (date-time) nullable
    • hash string nullable

      SHA-256 in the company's hash chain (ledger integrity).

    • currency string
    • rows array<VoucherRow>
      6 fields · each item
      • account integer required

        Account number.

      • debit_ore integer required

        Debit in öre.

        minimum 0

      • credit_ore integer required

        Credit in öre.

        minimum 0

      • description string nullable

        at most 255 characters

      • cost_center string nullable

        Cost center code (kostnadsställe).

      • project string nullable

        Project code.

    • attachments array<Attachment>
      6 fields · each item
      • id integer
      • name string
      • mime string

        Values: application/pdf, image/jpeg, image/png, image/webp

      • size integer

        Bytes.

      • sha256 string
      • created_at string (date-time)
    • created_at string (date-time)
    • updated_at string (date-time)
  • meta ListMeta required
    3 fields
    • limit integer required
    • next_cursor string required nullable

      Opaque; pass as `cursor` for the next page. null on the last page.

    • has_more boolean required

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

401 Unauthorized – Missing, invalid, expired or revoked token or API key. Also returned when the person behind the credential has left the company (an OAuth grant is then revoked for good).

All error codes · application/problem+json

  • unauthenticatedNo valid credential

    Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, WWW-Authenticate

403 Forbidden – The credential may not do this: a scope is missing, the granting person no longer has the permission, the address is not allowed, the company is archived (read-only) or no longer allows the app.

All error codes · application/problem+json

  • insufficient_scopeScope missing or permission lost

    Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.

  • forbiddenThe action refuses (for example changing a posted voucher)

    Behörighet saknas för det här.

  • ip_not_allowedOutside the IP allowlist

    Företaget tillåter inte anrop från den här adressen.

  • company_archivedWrite to an archived company

    Företaget är arkiverat och kan bara läsas.

  • app_not_allowedThe company no longer allows the app

    Företaget tillåter inte längre den här appen.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

404 Not Found – Not found. Also the answer for another company's ids (existence is never revealed) and for every call while NONOX Connect is turned off for the company.

All error codes · application/problem+json

  • not_foundUnknown id, other company's id, or module off

    Det du söker finns inte.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

429 Too Many Requests – Rate limit exceeded (per credential, per company or per address). Wait Retry-After seconds.

All error codes · application/problem+json

  • rate_limitedOver the limit

    För många anrop. Försök igen om 23 sekunder.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Retry-After

Code samples

curl
curl "https://nonox.app/api/v1/vouchers?limit=50&updated_since=2026-03-01T00%3A00%3A00%2B01%3A00" \
  -H "Authorization: Bearer $NONOX_TOKEN" \
  -H "Accept: application/json"
PHP (Laravel)
use Illuminate\Support\Facades\Http;

$response = Http::withToken(config('services.nonox.token'))
    ->acceptJson()
    ->get('https://nonox.app/api/v1/vouchers', [
        'limit' => 50,
        'updated_since' => '2026-03-01T00:00:00+01:00',
    ]);

$response->throw();

$data = $response->json('data');
PHP (Guzzle)
$client = new \GuzzleHttp\Client(['timeout' => 30]);

$response = $client->request('GET', 'https://nonox.app/api/v1/vouchers', [
    'headers' => [
        'Authorization' => 'Bearer '.getenv('NONOX_TOKEN'),
        'Accept' => 'application/json',
    ],
    'query' => [
        'limit' => 50,
        'updated_since' => '2026-03-01T00:00:00+01:00',
    ],
]);

$data = json_decode((string) $response->getBody(), true, flags: JSON_THROW_ON_ERROR)['data'];
JavaScript
const url = new URL('https://nonox.app/api/v1/vouchers');
url.searchParams.set('limit', '50');
url.searchParams.set('updated_since', '2026-03-01T00:00:00+01:00');

const response = await fetch(url, {
  headers: {
    Authorization: `Bearer ${process.env.NONOX_TOKEN}`,
    Accept: 'application/json',
  },
});

if (!response.ok) {
  const problem = await response.json();
  throw new Error(`${problem.code}: ${problem.detail}`);
}

const { data } = await response.json();
Python
import os
import requests

response = requests.get(
    "https://nonox.app/api/v1/vouchers",
    headers={
        "Authorization": f"Bearer {os.environ['NONOX_TOKEN']}",
        "Accept": "application/json",
    },
    params={
        "limit": 50,
        "updated_since": "2026-03-01T00:00:00+01:00",
    },
    timeout=30,
)
response.raise_for_status()

data = response.json()["data"]

Responses · 200

application/json
{
  "data": [
    {
      "id": "0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e",
      "series": "A",
      "number": 57,
      "reference": "A57",
      "status": "POSTED",
      "fiscal_year_id": 7,
      "voucher_date": "2026-03-02",
      "description": "Kontantförsäljning",
      "source": "MANUAL",
      "corrects_voucher_id": null,
      "corrected_by_voucher_id": null,
      "posted_at": "2026-03-02T10:45:12+01:00",
      "hash": "3c1f0e9d8b7a6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d",
      "currency": "SEK",
      "rows": [
        {
          "account": 1930,
          "debit_ore": 125000,
          "credit_ore": 0,
          "description": null,
          "cost_center": null,
          "project": null
        },
        {
          "account": 3001,
          "debit_ore": 0,
          "credit_ore": 100000,
          "description": null,
          "cost_center": null,
          "project": null
        },
        {
          "account": 2611,
          "debit_ore": 0,
          "credit_ore": 25000,
          "description": null,
          "cost_center": null,
          "project": null
        }
      ],
      "attachments": [
        {
          "id": 311,
          "name": "kvitto-kontorsmaterial.pdf",
          "mime": "application/pdf",
          "size": 48213,
          "sha256": "9f2b5c1d7e3a4b6c8d0e1f2a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e",
          "created_at": "2026-03-02T10:41:07+01:00"
        }
      ],
      "created_at": "2026-03-02T10:40:00+01:00",
      "updated_at": "2026-03-02T10:45:12+01:00"
    }
  ],
  "meta": {
    "limit": 50,
    "next_cursor": "eyJ1cGRhdGVkX2F0IjoiMjAyNi0wMy0wMiAxMDo0NToxMiIsImlkIjoiMGI5ZjNjMWUiLCJfcG9pbnRzVG9OZXh0SXRlbXMiOnRydWV9",
    "has_more": true
  }
}

Error

4011 example
No valid credential
{
  "type": "urn:nonox:problem:unauthenticated",
  "title": "Unauthorized",
  "status": 401,
  "code": "unauthenticated",
  "detail": "Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4035 examples
Scope missing or permission lost
{
  "type": "urn:nonox:problem:insufficient_scope",
  "title": "Forbidden",
  "status": 403,
  "code": "insufficient_scope",
  "detail": "Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17",
  "required_scopes": [
    "vouchers:post"
  ]
}
The action refuses (for example changing a posted voucher)
{
  "type": "urn:nonox:problem:forbidden",
  "title": "Forbidden",
  "status": 403,
  "code": "forbidden",
  "detail": "Behörighet saknas för det här.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Outside the IP allowlist
{
  "type": "urn:nonox:problem:ip_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "ip_not_allowed",
  "detail": "Företaget tillåter inte anrop från den här adressen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Write to an archived company
{
  "type": "urn:nonox:problem:company_archived",
  "title": "Forbidden",
  "status": 403,
  "code": "company_archived",
  "detail": "Företaget är arkiverat och kan bara läsas.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
The company no longer allows the app
{
  "type": "urn:nonox:problem:app_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "app_not_allowed",
  "detail": "Företaget tillåter inte längre den här appen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4041 example
Unknown id, other company's id, or module off
{
  "type": "urn:nonox:problem:not_found",
  "title": "Not Found",
  "status": 404,
  "code": "not_found",
  "detail": "Det du söker finns inte.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4291 example
Over the limit
{
  "type": "urn:nonox:problem:rate_limited",
  "title": "Too Many Requests",
  "status": 429,
  "code": "rate_limited",
  "detail": "För många anrop. Försök igen om 23 sekunder.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

Create a voucher draft

POST /vouchers createVoucher

Creates a draft (status DRAFT, no number). Rows are validated as in the app: known active accounts, cost center/project when the account requires one, a row has either debit or credit. The fiscal year is chosen from voucher_date. Balance is checked when posting. Same Action as the app (SaveDraftVoucher).

Scope

vouchers:create

Parameters

  • Idempotency-Key string header required

    Required on every POST. A unique value per intended operation (a UUID v4 is ideal), 1–255 visible ASCII characters. Kept 24 hours per credential: the same key with the same request returns the stored response (Idempotent-Replayed: true); with a different request 422 idempotency_key_reused; while the first is still running 409. Server errors (5xx) are not stored, so retry with the same key.

    at least 1 characters · at most 255 characters · Example: 3f6c1b7e-2d4a-4e8b-9c0d-5a1b2c3d4e5f

Request body

application/jsonVoucherInput required

The voucher. Amounts in öre (1 krona = 100 öre).

  • voucher_date string (date) required
  • description string required

    at most 255 characters

  • series string

    Default: "A" · at most 3 characters

  • rows array<VoucherRowInput> required

    A row has either debit_ore or credit_ore above zero, never both.

    at least 1 items

    6 fields · each item
    • account integer required

      Account number (must exist and be active).

    • debit_ore integer

      Default: 0 · minimum 0

    • credit_ore integer

      Default: 0 · minimum 0

    • description string nullable

      at most 255 characters

    • cost_center string nullable

      Code; required when the account requires a cost center.

    • project string nullable

      Code; required when the account requires a project.

Responses

201 Created – The draft.

application/jsonobject

  • data Voucher required
    18 fields
    • id string (uuid)
    • series string
    • number integer nullable

      Assigned at posting; null for a draft.

    • reference string nullable

      Series and number, e.g. A57; null for a draft.

    • status string

      Values: DRAFT, POSTED

    • fiscal_year_id integer
    • voucher_date string (date)
    • description string
    • source string

      Values: MANUAL, INVOICE, PAYMENT, SUPPLIER_INVOICE, VAT, PAYROLL, IMPORT_SIE, IMPORT_FORTNOX, CLOSING, CORRECTION

    • corrects_voucher_id string (uuid) nullable
    • corrected_by_voucher_id string (uuid) nullable
    • posted_at string (date-time) nullable
    • hash string nullable

      SHA-256 in the company's hash chain (ledger integrity).

    • currency string
    • rows array<VoucherRow>
      6 fields · each item
      • account integer required

        Account number.

      • debit_ore integer required

        Debit in öre.

        minimum 0

      • credit_ore integer required

        Credit in öre.

        minimum 0

      • description string nullable

        at most 255 characters

      • cost_center string nullable

        Cost center code (kostnadsställe).

      • project string nullable

        Project code.

    • attachments array<Attachment>
      6 fields · each item
      • id integer
      • name string
      • mime string

        Values: application/pdf, image/jpeg, image/png, image/webp

      • size integer

        Bytes.

      • sha256 string
      • created_at string (date-time)
    • created_at string (date-time)
    • updated_at string (date-time)

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Location, Idempotent-Replayed

400 Bad Request – Bad request: missing or invalid Idempotency-Key, or a body that is not a JSON object.

All error codes · application/problem+json

  • idempotency_key_requiredNo Idempotency-Key on a POST

    Skicka en unik Idempotency-Key (till exempel ett UUID) med varje POST, så att ett nytt försök aldrig bokför två gånger.

  • idempotency_key_invalidIdempotency-Key too long or not visible ASCII

    Idempotency-Key ska vara 1–255 synliga ASCII-tecken.

  • invalid_jsonMalformed JSON

    Kroppen är inte giltig JSON (ett objekt).

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

401 Unauthorized – Missing, invalid, expired or revoked token or API key. Also returned when the person behind the credential has left the company (an OAuth grant is then revoked for good).

All error codes · application/problem+json

  • unauthenticatedNo valid credential

    Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, WWW-Authenticate

403 Forbidden – The credential may not do this: a scope is missing, the granting person no longer has the permission, the address is not allowed, the company is archived (read-only) or no longer allows the app.

All error codes · application/problem+json

  • insufficient_scopeScope missing or permission lost

    Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.

  • forbiddenThe action refuses (for example changing a posted voucher)

    Behörighet saknas för det här.

  • ip_not_allowedOutside the IP allowlist

    Företaget tillåter inte anrop från den här adressen.

  • company_archivedWrite to an archived company

    Företaget är arkiverat och kan bara läsas.

  • app_not_allowedThe company no longer allows the app

    Företaget tillåter inte längre den här appen.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

404 Not Found – Not found. Also the answer for another company's ids (existence is never revealed) and for every call while NONOX Connect is turned off for the company.

All error codes · application/problem+json

  • not_foundUnknown id, other company's id, or module off

    Det du söker finns inte.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

409 Conflict – A request with the same Idempotency-Key is still running.

All error codes · application/problem+json

  • idempotency_in_progressSame key, first request not finished

    En begäran med samma Idempotency-Key pågår. Vänta och försök igen.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Retry-After

415 Unsupported Media Type – The body is not application/json (or multipart/form-data where a file is accepted).

All error codes · application/problem+json

  • unsupported_media_typeWrong Content-Type

    Skicka JSON (application/json).

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

422 Unprocessable Content – Validation failed, or the Idempotency-Key was already used for a different request.

All error codes · application/problem+json

  • validation_failedField errors

    Uppgifterna kunde inte godtas. Se errors.

  • idempotency_key_reusedSame key, different body

    Idempotency-Key har redan använts för en annan begäran. Använd en ny nyckel för en ny begäran.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

429 Too Many Requests – Rate limit exceeded (per credential, per company or per address). Wait Retry-After seconds.

All error codes · application/problem+json

  • rate_limitedOver the limit

    För många anrop. Försök igen om 23 sekunder.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Retry-After

Code samples

curl
curl -X POST "https://nonox.app/api/v1/vouchers" \
  -H "Authorization: Bearer $NONOX_TOKEN" \
  -H "Accept: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "voucher_date": "2026-03-02",
  "description": "Kontantförsäljning",
  "series": "A",
  "rows": [
    {
      "account": 1930,
      "debit_ore": 125000
    },
    {
      "account": 3001,
      "credit_ore": 100000
    },
    {
      "account": 2611,
      "credit_ore": 25000
    }
  ]
}'
PHP (Laravel)
use Illuminate\Support\Facades\Http;
use Illuminate\Support\Str;

$response = Http::withToken(config('services.nonox.token'))
    ->acceptJson()
    ->withHeaders(['Idempotency-Key' => (string) Str::uuid()])
    ->post('https://nonox.app/api/v1/vouchers', [
        'voucher_date' => '2026-03-02',
        'description' => 'Kontantförsäljning',
        'series' => 'A',
        'rows' => [
            [
                'account' => 1930,
                'debit_ore' => 125000,
            ],
            [
                'account' => 3001,
                'credit_ore' => 100000,
            ],
            [
                'account' => 2611,
                'credit_ore' => 25000,
            ],
        ],
    ]);

$response->throw();

$data = $response->json('data');
PHP (Guzzle)
$client = new \GuzzleHttp\Client(['timeout' => 30]);

$response = $client->request('POST', 'https://nonox.app/api/v1/vouchers', [
    'headers' => [
        'Authorization' => 'Bearer '.getenv('NONOX_TOKEN'),
        'Accept' => 'application/json',
        'Idempotency-Key' => bin2hex(random_bytes(16)),
    ],
    'json' => [
        'voucher_date' => '2026-03-02',
        'description' => 'Kontantförsäljning',
        'series' => 'A',
        'rows' => [
            [
                'account' => 1930,
                'debit_ore' => 125000,
            ],
            [
                'account' => 3001,
                'credit_ore' => 100000,
            ],
            [
                'account' => 2611,
                'credit_ore' => 25000,
            ],
        ],
    ],
]);

$data = json_decode((string) $response->getBody(), true, flags: JSON_THROW_ON_ERROR)['data'];
JavaScript
const response = await fetch('https://nonox.app/api/v1/vouchers', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NONOX_TOKEN}`,
    Accept: 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "voucher_date": "2026-03-02",
    "description": "Kontantförsäljning",
    "series": "A",
    "rows": [
      {
        "account": 1930,
        "debit_ore": 125000
      },
      {
        "account": 3001,
        "credit_ore": 100000
      },
      {
        "account": 2611,
        "credit_ore": 25000
      }
    ]
  }),
});

if (!response.ok) {
  const problem = await response.json();
  throw new Error(`${problem.code}: ${problem.detail}`);
}

const { data } = await response.json();
Python
import os
import uuid
import requests

response = requests.post(
    "https://nonox.app/api/v1/vouchers",
    headers={
        "Authorization": f"Bearer {os.environ['NONOX_TOKEN']}",
        "Accept": "application/json",
        "Idempotency-Key": str(uuid.uuid4()),
    },
    json={
        "voucher_date": "2026-03-02",
        "description": "Kontantförsäljning",
        "series": "A",
        "rows": [
            {
                "account": 1930,
                "debit_ore": 125000,
            },
            {
                "account": 3001,
                "credit_ore": 100000,
            },
            {
                "account": 2611,
                "credit_ore": 25000,
            },
        ],
    },
    timeout=30,
)
response.raise_for_status()

data = response.json()["data"]

Responses · 201

application/json
{
  "data": {
    "id": "0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e",
    "series": "A",
    "number": null,
    "reference": null,
    "status": "DRAFT",
    "fiscal_year_id": 7,
    "voucher_date": "2026-03-02",
    "description": "Kontantförsäljning",
    "source": "MANUAL",
    "corrects_voucher_id": null,
    "corrected_by_voucher_id": null,
    "posted_at": null,
    "hash": null,
    "currency": "SEK",
    "rows": [
      {
        "account": 1930,
        "debit_ore": 125000,
        "credit_ore": 0,
        "description": null,
        "cost_center": null,
        "project": null
      },
      {
        "account": 3001,
        "debit_ore": 0,
        "credit_ore": 100000,
        "description": null,
        "cost_center": null,
        "project": null
      },
      {
        "account": 2611,
        "debit_ore": 0,
        "credit_ore": 25000,
        "description": null,
        "cost_center": null,
        "project": null
      }
    ],
    "attachments": [],
    "created_at": "2026-03-02T10:40:00+01:00",
    "updated_at": "2026-03-02T10:40:00+01:00"
  }
}

Error

4003 examples
No Idempotency-Key on a POST
{
  "type": "urn:nonox:problem:idempotency_key_required",
  "title": "Bad Request",
  "status": 400,
  "code": "idempotency_key_required",
  "detail": "Skicka en unik Idempotency-Key (till exempel ett UUID) med varje POST, så att ett nytt försök aldrig bokför två gånger.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Idempotency-Key too long or not visible ASCII
{
  "type": "urn:nonox:problem:idempotency_key_invalid",
  "title": "Bad Request",
  "status": 400,
  "code": "idempotency_key_invalid",
  "detail": "Idempotency-Key ska vara 1–255 synliga ASCII-tecken.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Malformed JSON
{
  "type": "urn:nonox:problem:invalid_json",
  "title": "Bad Request",
  "status": 400,
  "code": "invalid_json",
  "detail": "Kroppen är inte giltig JSON (ett objekt).",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4011 example
No valid credential
{
  "type": "urn:nonox:problem:unauthenticated",
  "title": "Unauthorized",
  "status": 401,
  "code": "unauthenticated",
  "detail": "Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4035 examples
Scope missing or permission lost
{
  "type": "urn:nonox:problem:insufficient_scope",
  "title": "Forbidden",
  "status": 403,
  "code": "insufficient_scope",
  "detail": "Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17",
  "required_scopes": [
    "vouchers:post"
  ]
}
The action refuses (for example changing a posted voucher)
{
  "type": "urn:nonox:problem:forbidden",
  "title": "Forbidden",
  "status": 403,
  "code": "forbidden",
  "detail": "Behörighet saknas för det här.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Outside the IP allowlist
{
  "type": "urn:nonox:problem:ip_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "ip_not_allowed",
  "detail": "Företaget tillåter inte anrop från den här adressen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Write to an archived company
{
  "type": "urn:nonox:problem:company_archived",
  "title": "Forbidden",
  "status": 403,
  "code": "company_archived",
  "detail": "Företaget är arkiverat och kan bara läsas.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
The company no longer allows the app
{
  "type": "urn:nonox:problem:app_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "app_not_allowed",
  "detail": "Företaget tillåter inte längre den här appen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4041 example
Unknown id, other company's id, or module off
{
  "type": "urn:nonox:problem:not_found",
  "title": "Not Found",
  "status": 404,
  "code": "not_found",
  "detail": "Det du söker finns inte.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4091 example
Same key, first request not finished
{
  "type": "urn:nonox:problem:idempotency_in_progress",
  "title": "Conflict",
  "status": 409,
  "code": "idempotency_in_progress",
  "detail": "En begäran med samma Idempotency-Key pågår. Vänta och försök igen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4151 example
Wrong Content-Type
{
  "type": "urn:nonox:problem:unsupported_media_type",
  "title": "Unsupported Media Type",
  "status": 415,
  "code": "unsupported_media_type",
  "detail": "Skicka JSON (application/json).",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4222 examples
Field errors
{
  "type": "urn:nonox:problem:validation_failed",
  "title": "Unprocessable Content",
  "status": 422,
  "code": "validation_failed",
  "detail": "Uppgifterna kunde inte godtas. Se errors.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17",
  "errors": {
    "rows": [
      "Verifikationen balanserar inte: debet och kredit skiljer sig åt."
    ],
    "voucher_date": [
      "Det finns inget räkenskapsår som omfattar 2031-01-01."
    ]
  }
}
Same key, different body
{
  "type": "urn:nonox:problem:idempotency_key_reused",
  "title": "Unprocessable Content",
  "status": 422,
  "code": "idempotency_key_reused",
  "detail": "Idempotency-Key har redan använts för en annan begäran. Använd en ny nyckel för en ny begäran.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4291 example
Over the limit
{
  "type": "urn:nonox:problem:rate_limited",
  "title": "Too Many Requests",
  "status": 429,
  "code": "rate_limited",
  "detail": "För många anrop. Försök igen om 23 sekunder.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

Get a voucher

GET /vouchers/{voucher} getVoucher

One voucher with rows and attachment metadata.

Scope

vouchers:view

Parameters

  • voucher string (uuid) path required

    Voucher id (UUID).

    Example: 0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e

Responses

200 OK – The voucher.

application/jsonobject

  • data Voucher required
    18 fields
    • id string (uuid)
    • series string
    • number integer nullable

      Assigned at posting; null for a draft.

    • reference string nullable

      Series and number, e.g. A57; null for a draft.

    • status string

      Values: DRAFT, POSTED

    • fiscal_year_id integer
    • voucher_date string (date)
    • description string
    • source string

      Values: MANUAL, INVOICE, PAYMENT, SUPPLIER_INVOICE, VAT, PAYROLL, IMPORT_SIE, IMPORT_FORTNOX, CLOSING, CORRECTION

    • corrects_voucher_id string (uuid) nullable
    • corrected_by_voucher_id string (uuid) nullable
    • posted_at string (date-time) nullable
    • hash string nullable

      SHA-256 in the company's hash chain (ledger integrity).

    • currency string
    • rows array<VoucherRow>
      6 fields · each item
      • account integer required

        Account number.

      • debit_ore integer required

        Debit in öre.

        minimum 0

      • credit_ore integer required

        Credit in öre.

        minimum 0

      • description string nullable

        at most 255 characters

      • cost_center string nullable

        Cost center code (kostnadsställe).

      • project string nullable

        Project code.

    • attachments array<Attachment>
      6 fields · each item
      • id integer
      • name string
      • mime string

        Values: application/pdf, image/jpeg, image/png, image/webp

      • size integer

        Bytes.

      • sha256 string
      • created_at string (date-time)
    • created_at string (date-time)
    • updated_at string (date-time)

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

401 Unauthorized – Missing, invalid, expired or revoked token or API key. Also returned when the person behind the credential has left the company (an OAuth grant is then revoked for good).

All error codes · application/problem+json

  • unauthenticatedNo valid credential

    Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, WWW-Authenticate

403 Forbidden – The credential may not do this: a scope is missing, the granting person no longer has the permission, the address is not allowed, the company is archived (read-only) or no longer allows the app.

All error codes · application/problem+json

  • insufficient_scopeScope missing or permission lost

    Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.

  • forbiddenThe action refuses (for example changing a posted voucher)

    Behörighet saknas för det här.

  • ip_not_allowedOutside the IP allowlist

    Företaget tillåter inte anrop från den här adressen.

  • company_archivedWrite to an archived company

    Företaget är arkiverat och kan bara läsas.

  • app_not_allowedThe company no longer allows the app

    Företaget tillåter inte längre den här appen.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

404 Not Found – Not found. Also the answer for another company's ids (existence is never revealed) and for every call while NONOX Connect is turned off for the company.

All error codes · application/problem+json

  • not_foundUnknown id, other company's id, or module off

    Det du söker finns inte.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

429 Too Many Requests – Rate limit exceeded (per credential, per company or per address). Wait Retry-After seconds.

All error codes · application/problem+json

  • rate_limitedOver the limit

    För många anrop. Försök igen om 23 sekunder.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Retry-After

Code samples

curl
curl "https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e" \
  -H "Authorization: Bearer $NONOX_TOKEN" \
  -H "Accept: application/json"
PHP (Laravel)
use Illuminate\Support\Facades\Http;

$response = Http::withToken(config('services.nonox.token'))
    ->acceptJson()
    ->get('https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e');

$response->throw();

$data = $response->json('data');
PHP (Guzzle)
$client = new \GuzzleHttp\Client(['timeout' => 30]);

$response = $client->request('GET', 'https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e', [
    'headers' => [
        'Authorization' => 'Bearer '.getenv('NONOX_TOKEN'),
        'Accept' => 'application/json',
    ],
]);

$data = json_decode((string) $response->getBody(), true, flags: JSON_THROW_ON_ERROR)['data'];
JavaScript
const response = await fetch('https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e', {
  headers: {
    Authorization: `Bearer ${process.env.NONOX_TOKEN}`,
    Accept: 'application/json',
  },
});

if (!response.ok) {
  const problem = await response.json();
  throw new Error(`${problem.code}: ${problem.detail}`);
}

const { data } = await response.json();
Python
import os
import requests

response = requests.get(
    "https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e",
    headers={
        "Authorization": f"Bearer {os.environ['NONOX_TOKEN']}",
        "Accept": "application/json",
    },
    timeout=30,
)
response.raise_for_status()

data = response.json()["data"]

Responses · 200

application/json
{
  "data": {
    "id": "0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e",
    "series": "A",
    "number": 57,
    "reference": "A57",
    "status": "POSTED",
    "fiscal_year_id": 7,
    "voucher_date": "2026-03-02",
    "description": "Kontantförsäljning",
    "source": "MANUAL",
    "corrects_voucher_id": null,
    "corrected_by_voucher_id": null,
    "posted_at": "2026-03-02T10:45:12+01:00",
    "hash": "3c1f0e9d8b7a6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d",
    "currency": "SEK",
    "rows": [
      {
        "account": 1930,
        "debit_ore": 125000,
        "credit_ore": 0,
        "description": null,
        "cost_center": null,
        "project": null
      },
      {
        "account": 3001,
        "debit_ore": 0,
        "credit_ore": 100000,
        "description": null,
        "cost_center": null,
        "project": null
      },
      {
        "account": 2611,
        "debit_ore": 0,
        "credit_ore": 25000,
        "description": null,
        "cost_center": null,
        "project": null
      }
    ],
    "attachments": [
      {
        "id": 311,
        "name": "kvitto-kontorsmaterial.pdf",
        "mime": "application/pdf",
        "size": 48213,
        "sha256": "9f2b5c1d7e3a4b6c8d0e1f2a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e",
        "created_at": "2026-03-02T10:41:07+01:00"
      }
    ],
    "created_at": "2026-03-02T10:40:00+01:00",
    "updated_at": "2026-03-02T10:45:12+01:00"
  }
}

Error

4011 example
No valid credential
{
  "type": "urn:nonox:problem:unauthenticated",
  "title": "Unauthorized",
  "status": 401,
  "code": "unauthenticated",
  "detail": "Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4035 examples
Scope missing or permission lost
{
  "type": "urn:nonox:problem:insufficient_scope",
  "title": "Forbidden",
  "status": 403,
  "code": "insufficient_scope",
  "detail": "Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17",
  "required_scopes": [
    "vouchers:post"
  ]
}
The action refuses (for example changing a posted voucher)
{
  "type": "urn:nonox:problem:forbidden",
  "title": "Forbidden",
  "status": 403,
  "code": "forbidden",
  "detail": "Behörighet saknas för det här.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Outside the IP allowlist
{
  "type": "urn:nonox:problem:ip_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "ip_not_allowed",
  "detail": "Företaget tillåter inte anrop från den här adressen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Write to an archived company
{
  "type": "urn:nonox:problem:company_archived",
  "title": "Forbidden",
  "status": 403,
  "code": "company_archived",
  "detail": "Företaget är arkiverat och kan bara läsas.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
The company no longer allows the app
{
  "type": "urn:nonox:problem:app_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "app_not_allowed",
  "detail": "Företaget tillåter inte längre den här appen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4041 example
Unknown id, other company's id, or module off
{
  "type": "urn:nonox:problem:not_found",
  "title": "Not Found",
  "status": 404,
  "code": "not_found",
  "detail": "Det du söker finns inte.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4291 example
Over the limit
{
  "type": "urn:nonox:problem:rate_limited",
  "title": "Too Many Requests",
  "status": 429,
  "code": "rate_limited",
  "detail": "För många anrop. Försök igen om 23 sekunder.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

Change a voucher draft

PATCH /vouchers/{voucher} updateVoucherDraft

Changes a draft. Fields left out keep their values; `rows`, when sent, replaces all rows. A posted voucher can never be changed: the answer is 403 (correct it instead).

Scope

vouchers:create

Parameters

  • voucher string (uuid) path required

    Voucher id (UUID).

    Example: 0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e

Request body

application/jsonVoucherPatch required

Any subset of VoucherInput. `rows` replaces all rows.

  • voucher_date string (date)
  • description string

    at most 255 characters

  • series string

    at most 3 characters

  • rows array<VoucherRowInput>

    A row has either debit_ore or credit_ore above zero, never both.

    at least 1 items

    6 fields · each item
    • account integer required

      Account number (must exist and be active).

    • debit_ore integer

      Default: 0 · minimum 0

    • credit_ore integer

      Default: 0 · minimum 0

    • description string nullable

      at most 255 characters

    • cost_center string nullable

      Code; required when the account requires a cost center.

    • project string nullable

      Code; required when the account requires a project.

Responses

200 OK – The changed draft.

application/jsonobject

  • data Voucher required
    18 fields
    • id string (uuid)
    • series string
    • number integer nullable

      Assigned at posting; null for a draft.

    • reference string nullable

      Series and number, e.g. A57; null for a draft.

    • status string

      Values: DRAFT, POSTED

    • fiscal_year_id integer
    • voucher_date string (date)
    • description string
    • source string

      Values: MANUAL, INVOICE, PAYMENT, SUPPLIER_INVOICE, VAT, PAYROLL, IMPORT_SIE, IMPORT_FORTNOX, CLOSING, CORRECTION

    • corrects_voucher_id string (uuid) nullable
    • corrected_by_voucher_id string (uuid) nullable
    • posted_at string (date-time) nullable
    • hash string nullable

      SHA-256 in the company's hash chain (ledger integrity).

    • currency string
    • rows array<VoucherRow>
      6 fields · each item
      • account integer required

        Account number.

      • debit_ore integer required

        Debit in öre.

        minimum 0

      • credit_ore integer required

        Credit in öre.

        minimum 0

      • description string nullable

        at most 255 characters

      • cost_center string nullable

        Cost center code (kostnadsställe).

      • project string nullable

        Project code.

    • attachments array<Attachment>
      6 fields · each item
      • id integer
      • name string
      • mime string

        Values: application/pdf, image/jpeg, image/png, image/webp

      • size integer

        Bytes.

      • sha256 string
      • created_at string (date-time)
    • created_at string (date-time)
    • updated_at string (date-time)

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

400 Bad Request – Bad request: missing or invalid Idempotency-Key, or a body that is not a JSON object.

All error codes · application/problem+json

  • idempotency_key_requiredNo Idempotency-Key on a POST

    Skicka en unik Idempotency-Key (till exempel ett UUID) med varje POST, så att ett nytt försök aldrig bokför två gånger.

  • idempotency_key_invalidIdempotency-Key too long or not visible ASCII

    Idempotency-Key ska vara 1–255 synliga ASCII-tecken.

  • invalid_jsonMalformed JSON

    Kroppen är inte giltig JSON (ett objekt).

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

401 Unauthorized – Missing, invalid, expired or revoked token or API key. Also returned when the person behind the credential has left the company (an OAuth grant is then revoked for good).

All error codes · application/problem+json

  • unauthenticatedNo valid credential

    Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, WWW-Authenticate

403 Forbidden – The credential may not do this: a scope is missing, the granting person no longer has the permission, the address is not allowed, the company is archived (read-only) or no longer allows the app.

All error codes · application/problem+json

  • insufficient_scopeScope missing or permission lost

    Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.

  • forbiddenThe action refuses (for example changing a posted voucher)

    Behörighet saknas för det här.

  • ip_not_allowedOutside the IP allowlist

    Företaget tillåter inte anrop från den här adressen.

  • company_archivedWrite to an archived company

    Företaget är arkiverat och kan bara läsas.

  • app_not_allowedThe company no longer allows the app

    Företaget tillåter inte längre den här appen.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

404 Not Found – Not found. Also the answer for another company's ids (existence is never revealed) and for every call while NONOX Connect is turned off for the company.

All error codes · application/problem+json

  • not_foundUnknown id, other company's id, or module off

    Det du söker finns inte.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

415 Unsupported Media Type – The body is not application/json (or multipart/form-data where a file is accepted).

All error codes · application/problem+json

  • unsupported_media_typeWrong Content-Type

    Skicka JSON (application/json).

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

422 Unprocessable Content – Validation failed, or the Idempotency-Key was already used for a different request.

All error codes · application/problem+json

  • validation_failedField errors

    Uppgifterna kunde inte godtas. Se errors.

  • idempotency_key_reusedSame key, different body

    Idempotency-Key har redan använts för en annan begäran. Använd en ny nyckel för en ny begäran.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

429 Too Many Requests – Rate limit exceeded (per credential, per company or per address). Wait Retry-After seconds.

All error codes · application/problem+json

  • rate_limitedOver the limit

    För många anrop. Försök igen om 23 sekunder.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Retry-After

Code samples

curl
curl -X PATCH "https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e" \
  -H "Authorization: Bearer $NONOX_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{
  "description": "Kontantförsäljning, kassa 2"
}'
PHP (Laravel)
use Illuminate\Support\Facades\Http;

$response = Http::withToken(config('services.nonox.token'))
    ->acceptJson()
    ->patch('https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e', [
        'description' => 'Kontantförsäljning, kassa 2',
    ]);

$response->throw();

$data = $response->json('data');
PHP (Guzzle)
$client = new \GuzzleHttp\Client(['timeout' => 30]);

$response = $client->request('PATCH', 'https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e', [
    'headers' => [
        'Authorization' => 'Bearer '.getenv('NONOX_TOKEN'),
        'Accept' => 'application/json',
    ],
    'json' => [
        'description' => 'Kontantförsäljning, kassa 2',
    ],
]);

$data = json_decode((string) $response->getBody(), true, flags: JSON_THROW_ON_ERROR)['data'];
JavaScript
const response = await fetch('https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e', {
  method: 'PATCH',
  headers: {
    Authorization: `Bearer ${process.env.NONOX_TOKEN}`,
    Accept: 'application/json',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "description": "Kontantförsäljning, kassa 2"
  }),
});

if (!response.ok) {
  const problem = await response.json();
  throw new Error(`${problem.code}: ${problem.detail}`);
}

const { data } = await response.json();
Python
import os
import requests

response = requests.patch(
    "https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e",
    headers={
        "Authorization": f"Bearer {os.environ['NONOX_TOKEN']}",
        "Accept": "application/json",
    },
    json={
        "description": "Kontantförsäljning, kassa 2",
    },
    timeout=30,
)
response.raise_for_status()

data = response.json()["data"]

Responses · 200

application/json
{
  "data": {
    "id": "0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e",
    "series": "A",
    "number": null,
    "reference": null,
    "status": "DRAFT",
    "fiscal_year_id": 7,
    "voucher_date": "2026-03-02",
    "description": "Kontantförsäljning, kassa 2",
    "source": "MANUAL",
    "corrects_voucher_id": null,
    "corrected_by_voucher_id": null,
    "posted_at": null,
    "hash": null,
    "currency": "SEK",
    "rows": [
      {
        "account": 1930,
        "debit_ore": 125000,
        "credit_ore": 0,
        "description": null,
        "cost_center": null,
        "project": null
      },
      {
        "account": 3001,
        "debit_ore": 0,
        "credit_ore": 100000,
        "description": null,
        "cost_center": null,
        "project": null
      },
      {
        "account": 2611,
        "debit_ore": 0,
        "credit_ore": 25000,
        "description": null,
        "cost_center": null,
        "project": null
      }
    ],
    "attachments": [],
    "created_at": "2026-03-02T10:40:00+01:00",
    "updated_at": "2026-03-02T10:40:00+01:00"
  }
}

Error

4003 examples
No Idempotency-Key on a POST
{
  "type": "urn:nonox:problem:idempotency_key_required",
  "title": "Bad Request",
  "status": 400,
  "code": "idempotency_key_required",
  "detail": "Skicka en unik Idempotency-Key (till exempel ett UUID) med varje POST, så att ett nytt försök aldrig bokför två gånger.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Idempotency-Key too long or not visible ASCII
{
  "type": "urn:nonox:problem:idempotency_key_invalid",
  "title": "Bad Request",
  "status": 400,
  "code": "idempotency_key_invalid",
  "detail": "Idempotency-Key ska vara 1–255 synliga ASCII-tecken.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Malformed JSON
{
  "type": "urn:nonox:problem:invalid_json",
  "title": "Bad Request",
  "status": 400,
  "code": "invalid_json",
  "detail": "Kroppen är inte giltig JSON (ett objekt).",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4011 example
No valid credential
{
  "type": "urn:nonox:problem:unauthenticated",
  "title": "Unauthorized",
  "status": 401,
  "code": "unauthenticated",
  "detail": "Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4035 examples
Scope missing or permission lost
{
  "type": "urn:nonox:problem:insufficient_scope",
  "title": "Forbidden",
  "status": 403,
  "code": "insufficient_scope",
  "detail": "Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17",
  "required_scopes": [
    "vouchers:post"
  ]
}
The action refuses (for example changing a posted voucher)
{
  "type": "urn:nonox:problem:forbidden",
  "title": "Forbidden",
  "status": 403,
  "code": "forbidden",
  "detail": "Behörighet saknas för det här.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Outside the IP allowlist
{
  "type": "urn:nonox:problem:ip_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "ip_not_allowed",
  "detail": "Företaget tillåter inte anrop från den här adressen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Write to an archived company
{
  "type": "urn:nonox:problem:company_archived",
  "title": "Forbidden",
  "status": 403,
  "code": "company_archived",
  "detail": "Företaget är arkiverat och kan bara läsas.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
The company no longer allows the app
{
  "type": "urn:nonox:problem:app_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "app_not_allowed",
  "detail": "Företaget tillåter inte längre den här appen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4041 example
Unknown id, other company's id, or module off
{
  "type": "urn:nonox:problem:not_found",
  "title": "Not Found",
  "status": 404,
  "code": "not_found",
  "detail": "Det du söker finns inte.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4151 example
Wrong Content-Type
{
  "type": "urn:nonox:problem:unsupported_media_type",
  "title": "Unsupported Media Type",
  "status": 415,
  "code": "unsupported_media_type",
  "detail": "Skicka JSON (application/json).",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4222 examples
Field errors
{
  "type": "urn:nonox:problem:validation_failed",
  "title": "Unprocessable Content",
  "status": 422,
  "code": "validation_failed",
  "detail": "Uppgifterna kunde inte godtas. Se errors.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17",
  "errors": {
    "rows": [
      "Verifikationen balanserar inte: debet och kredit skiljer sig åt."
    ],
    "voucher_date": [
      "Det finns inget räkenskapsår som omfattar 2031-01-01."
    ]
  }
}
Same key, different body
{
  "type": "urn:nonox:problem:idempotency_key_reused",
  "title": "Unprocessable Content",
  "status": 422,
  "code": "idempotency_key_reused",
  "detail": "Idempotency-Key har redan använts för en annan begäran. Använd en ny nyckel för en ny begäran.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4291 example
Over the limit
{
  "type": "urn:nonox:problem:rate_limited",
  "title": "Too Many Requests",
  "status": 429,
  "code": "rate_limited",
  "detail": "För många anrop. Försök igen om 23 sekunder.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

Delete a voucher draft

DELETE /vouchers/{voucher} deleteVoucherDraft

Deletes a draft. A posted voucher can never be deleted (403).

Scope

vouchers:create

Parameters

  • voucher string (uuid) path required

    Voucher id (UUID).

    Example: 0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e

Responses

204 No Content – Deleted.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

401 Unauthorized – Missing, invalid, expired or revoked token or API key. Also returned when the person behind the credential has left the company (an OAuth grant is then revoked for good).

All error codes · application/problem+json

  • unauthenticatedNo valid credential

    Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, WWW-Authenticate

403 Forbidden – The credential may not do this: a scope is missing, the granting person no longer has the permission, the address is not allowed, the company is archived (read-only) or no longer allows the app.

All error codes · application/problem+json

  • insufficient_scopeScope missing or permission lost

    Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.

  • forbiddenThe action refuses (for example changing a posted voucher)

    Behörighet saknas för det här.

  • ip_not_allowedOutside the IP allowlist

    Företaget tillåter inte anrop från den här adressen.

  • company_archivedWrite to an archived company

    Företaget är arkiverat och kan bara läsas.

  • app_not_allowedThe company no longer allows the app

    Företaget tillåter inte längre den här appen.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

404 Not Found – Not found. Also the answer for another company's ids (existence is never revealed) and for every call while NONOX Connect is turned off for the company.

All error codes · application/problem+json

  • not_foundUnknown id, other company's id, or module off

    Det du söker finns inte.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

429 Too Many Requests – Rate limit exceeded (per credential, per company or per address). Wait Retry-After seconds.

All error codes · application/problem+json

  • rate_limitedOver the limit

    För många anrop. Försök igen om 23 sekunder.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Retry-After

Code samples

curl
curl -X DELETE "https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e" \
  -H "Authorization: Bearer $NONOX_TOKEN" \
  -H "Accept: application/json"
PHP (Laravel)
use Illuminate\Support\Facades\Http;

$response = Http::withToken(config('services.nonox.token'))
    ->acceptJson()
    ->delete('https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e');

$response->throw();
PHP (Guzzle)
$client = new \GuzzleHttp\Client(['timeout' => 30]);

$response = $client->request('DELETE', 'https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e', [
    'headers' => [
        'Authorization' => 'Bearer '.getenv('NONOX_TOKEN'),
        'Accept' => 'application/json',
    ],
]);
JavaScript
const response = await fetch('https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e', {
  method: 'DELETE',
  headers: {
    Authorization: `Bearer ${process.env.NONOX_TOKEN}`,
    Accept: 'application/json',
  },
});

if (!response.ok) {
  const problem = await response.json();
  throw new Error(`${problem.code}: ${problem.detail}`);
}
Python
import os
import requests

response = requests.delete(
    "https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e",
    headers={
        "Authorization": f"Bearer {os.environ['NONOX_TOKEN']}",
        "Accept": "application/json",
    },
    timeout=30,
)
response.raise_for_status()

Error

4011 example
No valid credential
{
  "type": "urn:nonox:problem:unauthenticated",
  "title": "Unauthorized",
  "status": 401,
  "code": "unauthenticated",
  "detail": "Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4035 examples
Scope missing or permission lost
{
  "type": "urn:nonox:problem:insufficient_scope",
  "title": "Forbidden",
  "status": 403,
  "code": "insufficient_scope",
  "detail": "Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17",
  "required_scopes": [
    "vouchers:post"
  ]
}
The action refuses (for example changing a posted voucher)
{
  "type": "urn:nonox:problem:forbidden",
  "title": "Forbidden",
  "status": 403,
  "code": "forbidden",
  "detail": "Behörighet saknas för det här.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Outside the IP allowlist
{
  "type": "urn:nonox:problem:ip_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "ip_not_allowed",
  "detail": "Företaget tillåter inte anrop från den här adressen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Write to an archived company
{
  "type": "urn:nonox:problem:company_archived",
  "title": "Forbidden",
  "status": 403,
  "code": "company_archived",
  "detail": "Företaget är arkiverat och kan bara läsas.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
The company no longer allows the app
{
  "type": "urn:nonox:problem:app_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "app_not_allowed",
  "detail": "Företaget tillåter inte längre den här appen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4041 example
Unknown id, other company's id, or module off
{
  "type": "urn:nonox:problem:not_found",
  "title": "Not Found",
  "status": 404,
  "code": "not_found",
  "detail": "Det du söker finns inte.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4291 example
Over the limit
{
  "type": "urn:nonox:problem:rate_limited",
  "title": "Too Many Requests",
  "status": 429,
  "code": "rate_limited",
  "detail": "För många anrop. Försök igen om 23 sekunder.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

Post a voucher

POST /vouchers/{voucher}/post postVoucher

Posts a draft (bokför): checks that it balances, that the date is in an open fiscal year and not in a locked period, assigns the next gapless number in its series and fiscal year, extends the hash chain and writes the audit log. Irreversible: a posted voucher is only ever corrected. Same Action as the app (PostVoucher). No body.

Scope

vouchers:post

Parameters

  • voucher string (uuid) path required

    Voucher id (UUID).

    Example: 0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e

  • Idempotency-Key string header required

    Required on every POST. A unique value per intended operation (a UUID v4 is ideal), 1–255 visible ASCII characters. Kept 24 hours per credential: the same key with the same request returns the stored response (Idempotent-Replayed: true); with a different request 422 idempotency_key_reused; while the first is still running 409. Server errors (5xx) are not stored, so retry with the same key.

    at least 1 characters · at most 255 characters · Example: 3f6c1b7e-2d4a-4e8b-9c0d-5a1b2c3d4e5f

Responses

200 OK – The posted voucher.

application/jsonobject

  • data Voucher required
    18 fields
    • id string (uuid)
    • series string
    • number integer nullable

      Assigned at posting; null for a draft.

    • reference string nullable

      Series and number, e.g. A57; null for a draft.

    • status string

      Values: DRAFT, POSTED

    • fiscal_year_id integer
    • voucher_date string (date)
    • description string
    • source string

      Values: MANUAL, INVOICE, PAYMENT, SUPPLIER_INVOICE, VAT, PAYROLL, IMPORT_SIE, IMPORT_FORTNOX, CLOSING, CORRECTION

    • corrects_voucher_id string (uuid) nullable
    • corrected_by_voucher_id string (uuid) nullable
    • posted_at string (date-time) nullable
    • hash string nullable

      SHA-256 in the company's hash chain (ledger integrity).

    • currency string
    • rows array<VoucherRow>
      6 fields · each item
      • account integer required

        Account number.

      • debit_ore integer required

        Debit in öre.

        minimum 0

      • credit_ore integer required

        Credit in öre.

        minimum 0

      • description string nullable

        at most 255 characters

      • cost_center string nullable

        Cost center code (kostnadsställe).

      • project string nullable

        Project code.

    • attachments array<Attachment>
      6 fields · each item
      • id integer
      • name string
      • mime string

        Values: application/pdf, image/jpeg, image/png, image/webp

      • size integer

        Bytes.

      • sha256 string
      • created_at string (date-time)
    • created_at string (date-time)
    • updated_at string (date-time)

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Idempotent-Replayed

400 Bad Request – Bad request: missing or invalid Idempotency-Key, or a body that is not a JSON object.

All error codes · application/problem+json

  • idempotency_key_requiredNo Idempotency-Key on a POST

    Skicka en unik Idempotency-Key (till exempel ett UUID) med varje POST, så att ett nytt försök aldrig bokför två gånger.

  • idempotency_key_invalidIdempotency-Key too long or not visible ASCII

    Idempotency-Key ska vara 1–255 synliga ASCII-tecken.

  • invalid_jsonMalformed JSON

    Kroppen är inte giltig JSON (ett objekt).

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

401 Unauthorized – Missing, invalid, expired or revoked token or API key. Also returned when the person behind the credential has left the company (an OAuth grant is then revoked for good).

All error codes · application/problem+json

  • unauthenticatedNo valid credential

    Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, WWW-Authenticate

403 Forbidden – The credential may not do this: a scope is missing, the granting person no longer has the permission, the address is not allowed, the company is archived (read-only) or no longer allows the app.

All error codes · application/problem+json

  • insufficient_scopeScope missing or permission lost

    Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.

  • forbiddenThe action refuses (for example changing a posted voucher)

    Behörighet saknas för det här.

  • ip_not_allowedOutside the IP allowlist

    Företaget tillåter inte anrop från den här adressen.

  • company_archivedWrite to an archived company

    Företaget är arkiverat och kan bara läsas.

  • app_not_allowedThe company no longer allows the app

    Företaget tillåter inte längre den här appen.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

404 Not Found – Not found. Also the answer for another company's ids (existence is never revealed) and for every call while NONOX Connect is turned off for the company.

All error codes · application/problem+json

  • not_foundUnknown id, other company's id, or module off

    Det du söker finns inte.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

409 Conflict – A request with the same Idempotency-Key is still running.

All error codes · application/problem+json

  • idempotency_in_progressSame key, first request not finished

    En begäran med samma Idempotency-Key pågår. Vänta och försök igen.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Retry-After

415 Unsupported Media Type – The body is not application/json (or multipart/form-data where a file is accepted).

All error codes · application/problem+json

  • unsupported_media_typeWrong Content-Type

    Skicka JSON (application/json).

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

422 Unprocessable Content – Validation failed, or the Idempotency-Key was already used for a different request.

All error codes · application/problem+json

  • validation_failedField errors

    Uppgifterna kunde inte godtas. Se errors.

  • idempotency_key_reusedSame key, different body

    Idempotency-Key har redan använts för en annan begäran. Använd en ny nyckel för en ny begäran.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

429 Too Many Requests – Rate limit exceeded (per credential, per company or per address). Wait Retry-After seconds.

All error codes · application/problem+json

  • rate_limitedOver the limit

    För många anrop. Försök igen om 23 sekunder.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Retry-After

Code samples

curl
curl -X POST "https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/post" \
  -H "Authorization: Bearer $NONOX_TOKEN" \
  -H "Accept: application/json" \
  -H "Idempotency-Key: $(uuidgen)"
PHP (Laravel)
use Illuminate\Support\Facades\Http;
use Illuminate\Support\Str;

$response = Http::withToken(config('services.nonox.token'))
    ->acceptJson()
    ->withHeaders(['Idempotency-Key' => (string) Str::uuid()])
    ->post('https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/post');

$response->throw();

$data = $response->json('data');
PHP (Guzzle)
$client = new \GuzzleHttp\Client(['timeout' => 30]);

$response = $client->request('POST', 'https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/post', [
    'headers' => [
        'Authorization' => 'Bearer '.getenv('NONOX_TOKEN'),
        'Accept' => 'application/json',
        'Idempotency-Key' => bin2hex(random_bytes(16)),
    ],
]);

$data = json_decode((string) $response->getBody(), true, flags: JSON_THROW_ON_ERROR)['data'];
JavaScript
const response = await fetch('https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/post', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NONOX_TOKEN}`,
    Accept: 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
  },
});

if (!response.ok) {
  const problem = await response.json();
  throw new Error(`${problem.code}: ${problem.detail}`);
}

const { data } = await response.json();
Python
import os
import uuid
import requests

response = requests.post(
    "https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/post",
    headers={
        "Authorization": f"Bearer {os.environ['NONOX_TOKEN']}",
        "Accept": "application/json",
        "Idempotency-Key": str(uuid.uuid4()),
    },
    timeout=30,
)
response.raise_for_status()

data = response.json()["data"]

Responses · 200

application/json
{
  "data": {
    "id": "0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e",
    "series": "A",
    "number": 57,
    "reference": "A57",
    "status": "POSTED",
    "fiscal_year_id": 7,
    "voucher_date": "2026-03-02",
    "description": "Kontantförsäljning",
    "source": "MANUAL",
    "corrects_voucher_id": null,
    "corrected_by_voucher_id": null,
    "posted_at": "2026-03-02T10:45:12+01:00",
    "hash": "3c1f0e9d8b7a6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d",
    "currency": "SEK",
    "rows": [
      {
        "account": 1930,
        "debit_ore": 125000,
        "credit_ore": 0,
        "description": null,
        "cost_center": null,
        "project": null
      },
      {
        "account": 3001,
        "debit_ore": 0,
        "credit_ore": 100000,
        "description": null,
        "cost_center": null,
        "project": null
      },
      {
        "account": 2611,
        "debit_ore": 0,
        "credit_ore": 25000,
        "description": null,
        "cost_center": null,
        "project": null
      }
    ],
    "attachments": [],
    "created_at": "2026-03-02T10:40:00+01:00",
    "updated_at": "2026-03-02T10:45:12+01:00"
  }
}

Error

4003 examples
No Idempotency-Key on a POST
{
  "type": "urn:nonox:problem:idempotency_key_required",
  "title": "Bad Request",
  "status": 400,
  "code": "idempotency_key_required",
  "detail": "Skicka en unik Idempotency-Key (till exempel ett UUID) med varje POST, så att ett nytt försök aldrig bokför två gånger.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Idempotency-Key too long or not visible ASCII
{
  "type": "urn:nonox:problem:idempotency_key_invalid",
  "title": "Bad Request",
  "status": 400,
  "code": "idempotency_key_invalid",
  "detail": "Idempotency-Key ska vara 1–255 synliga ASCII-tecken.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Malformed JSON
{
  "type": "urn:nonox:problem:invalid_json",
  "title": "Bad Request",
  "status": 400,
  "code": "invalid_json",
  "detail": "Kroppen är inte giltig JSON (ett objekt).",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4011 example
No valid credential
{
  "type": "urn:nonox:problem:unauthenticated",
  "title": "Unauthorized",
  "status": 401,
  "code": "unauthenticated",
  "detail": "Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4035 examples
Scope missing or permission lost
{
  "type": "urn:nonox:problem:insufficient_scope",
  "title": "Forbidden",
  "status": 403,
  "code": "insufficient_scope",
  "detail": "Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17",
  "required_scopes": [
    "vouchers:post"
  ]
}
The action refuses (for example changing a posted voucher)
{
  "type": "urn:nonox:problem:forbidden",
  "title": "Forbidden",
  "status": 403,
  "code": "forbidden",
  "detail": "Behörighet saknas för det här.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Outside the IP allowlist
{
  "type": "urn:nonox:problem:ip_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "ip_not_allowed",
  "detail": "Företaget tillåter inte anrop från den här adressen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Write to an archived company
{
  "type": "urn:nonox:problem:company_archived",
  "title": "Forbidden",
  "status": 403,
  "code": "company_archived",
  "detail": "Företaget är arkiverat och kan bara läsas.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
The company no longer allows the app
{
  "type": "urn:nonox:problem:app_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "app_not_allowed",
  "detail": "Företaget tillåter inte längre den här appen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4041 example
Unknown id, other company's id, or module off
{
  "type": "urn:nonox:problem:not_found",
  "title": "Not Found",
  "status": 404,
  "code": "not_found",
  "detail": "Det du söker finns inte.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4091 example
Same key, first request not finished
{
  "type": "urn:nonox:problem:idempotency_in_progress",
  "title": "Conflict",
  "status": 409,
  "code": "idempotency_in_progress",
  "detail": "En begäran med samma Idempotency-Key pågår. Vänta och försök igen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4151 example
Wrong Content-Type
{
  "type": "urn:nonox:problem:unsupported_media_type",
  "title": "Unsupported Media Type",
  "status": 415,
  "code": "unsupported_media_type",
  "detail": "Skicka JSON (application/json).",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4222 examples
Field errors
{
  "type": "urn:nonox:problem:validation_failed",
  "title": "Unprocessable Content",
  "status": 422,
  "code": "validation_failed",
  "detail": "Uppgifterna kunde inte godtas. Se errors.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17",
  "errors": {
    "rows": [
      "Verifikationen balanserar inte: debet och kredit skiljer sig åt."
    ],
    "voucher_date": [
      "Det finns inget räkenskapsår som omfattar 2031-01-01."
    ]
  }
}
Same key, different body
{
  "type": "urn:nonox:problem:idempotency_key_reused",
  "title": "Unprocessable Content",
  "status": 422,
  "code": "idempotency_key_reused",
  "detail": "Idempotency-Key har redan använts för en annan begäran. Använd en ny nyckel för en ny begäran.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4291 example
Over the limit
{
  "type": "urn:nonox:problem:rate_limited",
  "title": "Too Many Requests",
  "status": 429,
  "code": "rate_limited",
  "detail": "För många anrop. Försök igen om 23 sekunder.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

Correct a posted voucher

POST /vouchers/{voucher}/correct correctVoucher

Creates and posts a correcting voucher (rättelseverifikation) that reverses the original and, if `rows` are given, books those instead. Both vouchers are linked. A voucher can be corrected once. Same Action as the app (CorrectVoucher).

Scope

vouchers:correct

Parameters

  • voucher string (uuid) path required

    Voucher id (UUID).

    Example: 0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e

  • Idempotency-Key string header required

    Required on every POST. A unique value per intended operation (a UUID v4 is ideal), 1–255 visible ASCII characters. Kept 24 hours per credential: the same key with the same request returns the stored response (Idempotent-Replayed: true); with a different request 422 idempotency_key_reused; while the first is still running 409. Server errors (5xx) are not stored, so retry with the same key.

    at least 1 characters · at most 255 characters · Example: 3f6c1b7e-2d4a-4e8b-9c0d-5a1b2c3d4e5f

Request body

application/jsonCorrectionInput required

Why, when, and optionally the rows to book instead.

  • reason string required

    Why the voucher is corrected (kept in the audit trail).

    at most 255 characters

  • date string (date)

    Date of the correcting voucher; defaults to today.

  • rows array<VoucherRowInput>

    Rows to book instead, after the reversal.

    6 fields · each item
    • account integer required

      Account number (must exist and be active).

    • debit_ore integer

      Default: 0 · minimum 0

    • credit_ore integer

      Default: 0 · minimum 0

    • description string nullable

      at most 255 characters

    • cost_center string nullable

      Code; required when the account requires a cost center.

    • project string nullable

      Code; required when the account requires a project.

Responses

201 Created – The correcting voucher.

application/jsonobject

  • data Voucher required
    18 fields
    • id string (uuid)
    • series string
    • number integer nullable

      Assigned at posting; null for a draft.

    • reference string nullable

      Series and number, e.g. A57; null for a draft.

    • status string

      Values: DRAFT, POSTED

    • fiscal_year_id integer
    • voucher_date string (date)
    • description string
    • source string

      Values: MANUAL, INVOICE, PAYMENT, SUPPLIER_INVOICE, VAT, PAYROLL, IMPORT_SIE, IMPORT_FORTNOX, CLOSING, CORRECTION

    • corrects_voucher_id string (uuid) nullable
    • corrected_by_voucher_id string (uuid) nullable
    • posted_at string (date-time) nullable
    • hash string nullable

      SHA-256 in the company's hash chain (ledger integrity).

    • currency string
    • rows array<VoucherRow>
      6 fields · each item
      • account integer required

        Account number.

      • debit_ore integer required

        Debit in öre.

        minimum 0

      • credit_ore integer required

        Credit in öre.

        minimum 0

      • description string nullable

        at most 255 characters

      • cost_center string nullable

        Cost center code (kostnadsställe).

      • project string nullable

        Project code.

    • attachments array<Attachment>
      6 fields · each item
      • id integer
      • name string
      • mime string

        Values: application/pdf, image/jpeg, image/png, image/webp

      • size integer

        Bytes.

      • sha256 string
      • created_at string (date-time)
    • created_at string (date-time)
    • updated_at string (date-time)

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Location, Idempotent-Replayed

400 Bad Request – Bad request: missing or invalid Idempotency-Key, or a body that is not a JSON object.

All error codes · application/problem+json

  • idempotency_key_requiredNo Idempotency-Key on a POST

    Skicka en unik Idempotency-Key (till exempel ett UUID) med varje POST, så att ett nytt försök aldrig bokför två gånger.

  • idempotency_key_invalidIdempotency-Key too long or not visible ASCII

    Idempotency-Key ska vara 1–255 synliga ASCII-tecken.

  • invalid_jsonMalformed JSON

    Kroppen är inte giltig JSON (ett objekt).

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

401 Unauthorized – Missing, invalid, expired or revoked token or API key. Also returned when the person behind the credential has left the company (an OAuth grant is then revoked for good).

All error codes · application/problem+json

  • unauthenticatedNo valid credential

    Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, WWW-Authenticate

403 Forbidden – The credential may not do this: a scope is missing, the granting person no longer has the permission, the address is not allowed, the company is archived (read-only) or no longer allows the app.

All error codes · application/problem+json

  • insufficient_scopeScope missing or permission lost

    Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.

  • forbiddenThe action refuses (for example changing a posted voucher)

    Behörighet saknas för det här.

  • ip_not_allowedOutside the IP allowlist

    Företaget tillåter inte anrop från den här adressen.

  • company_archivedWrite to an archived company

    Företaget är arkiverat och kan bara läsas.

  • app_not_allowedThe company no longer allows the app

    Företaget tillåter inte längre den här appen.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

404 Not Found – Not found. Also the answer for another company's ids (existence is never revealed) and for every call while NONOX Connect is turned off for the company.

All error codes · application/problem+json

  • not_foundUnknown id, other company's id, or module off

    Det du söker finns inte.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

409 Conflict – A request with the same Idempotency-Key is still running.

All error codes · application/problem+json

  • idempotency_in_progressSame key, first request not finished

    En begäran med samma Idempotency-Key pågår. Vänta och försök igen.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Retry-After

415 Unsupported Media Type – The body is not application/json (or multipart/form-data where a file is accepted).

All error codes · application/problem+json

  • unsupported_media_typeWrong Content-Type

    Skicka JSON (application/json).

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

422 Unprocessable Content – Validation failed, or the Idempotency-Key was already used for a different request.

All error codes · application/problem+json

  • validation_failedField errors

    Uppgifterna kunde inte godtas. Se errors.

  • idempotency_key_reusedSame key, different body

    Idempotency-Key har redan använts för en annan begäran. Använd en ny nyckel för en ny begäran.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

429 Too Many Requests – Rate limit exceeded (per credential, per company or per address). Wait Retry-After seconds.

All error codes · application/problem+json

  • rate_limitedOver the limit

    För många anrop. Försök igen om 23 sekunder.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Retry-After

Code samples

curl
curl -X POST "https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/correct" \
  -H "Authorization: Bearer $NONOX_TOKEN" \
  -H "Accept: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "reason": "Fel konto",
  "date": "2026-03-05"
}'
PHP (Laravel)
use Illuminate\Support\Facades\Http;
use Illuminate\Support\Str;

$response = Http::withToken(config('services.nonox.token'))
    ->acceptJson()
    ->withHeaders(['Idempotency-Key' => (string) Str::uuid()])
    ->post('https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/correct', [
        'reason' => 'Fel konto',
        'date' => '2026-03-05',
    ]);

$response->throw();

$data = $response->json('data');
PHP (Guzzle)
$client = new \GuzzleHttp\Client(['timeout' => 30]);

$response = $client->request('POST', 'https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/correct', [
    'headers' => [
        'Authorization' => 'Bearer '.getenv('NONOX_TOKEN'),
        'Accept' => 'application/json',
        'Idempotency-Key' => bin2hex(random_bytes(16)),
    ],
    'json' => [
        'reason' => 'Fel konto',
        'date' => '2026-03-05',
    ],
]);

$data = json_decode((string) $response->getBody(), true, flags: JSON_THROW_ON_ERROR)['data'];
JavaScript
const response = await fetch('https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/correct', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NONOX_TOKEN}`,
    Accept: 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "reason": "Fel konto",
    "date": "2026-03-05"
  }),
});

if (!response.ok) {
  const problem = await response.json();
  throw new Error(`${problem.code}: ${problem.detail}`);
}

const { data } = await response.json();
Python
import os
import uuid
import requests

response = requests.post(
    "https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/correct",
    headers={
        "Authorization": f"Bearer {os.environ['NONOX_TOKEN']}",
        "Accept": "application/json",
        "Idempotency-Key": str(uuid.uuid4()),
    },
    json={
        "reason": "Fel konto",
        "date": "2026-03-05",
    },
    timeout=30,
)
response.raise_for_status()

data = response.json()["data"]

Responses · 201

application/json
{
  "data": {
    "id": "4e8d2c1b-7f6a-4b3c-8d9e-0a1b2c3d4e5f",
    "series": "A",
    "number": 58,
    "reference": "A58",
    "status": "POSTED",
    "fiscal_year_id": 7,
    "voucher_date": "2026-03-02",
    "description": "Rättelse av A57: fel konto",
    "source": "CORRECTION",
    "corrects_voucher_id": "0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e",
    "corrected_by_voucher_id": null,
    "posted_at": "2026-03-05T08:02:44+01:00",
    "hash": "8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b",
    "currency": "SEK",
    "rows": [
      {
        "account": 1930,
        "debit_ore": 0,
        "credit_ore": 125000,
        "description": null,
        "cost_center": null,
        "project": null
      },
      {
        "account": 3001,
        "debit_ore": 100000,
        "credit_ore": 0,
        "description": null,
        "cost_center": null,
        "project": null
      },
      {
        "account": 2611,
        "debit_ore": 25000,
        "credit_ore": 0,
        "description": null,
        "cost_center": null,
        "project": null
      }
    ],
    "attachments": [],
    "created_at": "2026-03-05T08:02:44+01:00",
    "updated_at": "2026-03-05T08:02:44+01:00"
  }
}

Error

4003 examples
No Idempotency-Key on a POST
{
  "type": "urn:nonox:problem:idempotency_key_required",
  "title": "Bad Request",
  "status": 400,
  "code": "idempotency_key_required",
  "detail": "Skicka en unik Idempotency-Key (till exempel ett UUID) med varje POST, så att ett nytt försök aldrig bokför två gånger.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Idempotency-Key too long or not visible ASCII
{
  "type": "urn:nonox:problem:idempotency_key_invalid",
  "title": "Bad Request",
  "status": 400,
  "code": "idempotency_key_invalid",
  "detail": "Idempotency-Key ska vara 1–255 synliga ASCII-tecken.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Malformed JSON
{
  "type": "urn:nonox:problem:invalid_json",
  "title": "Bad Request",
  "status": 400,
  "code": "invalid_json",
  "detail": "Kroppen är inte giltig JSON (ett objekt).",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4011 example
No valid credential
{
  "type": "urn:nonox:problem:unauthenticated",
  "title": "Unauthorized",
  "status": 401,
  "code": "unauthenticated",
  "detail": "Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4035 examples
Scope missing or permission lost
{
  "type": "urn:nonox:problem:insufficient_scope",
  "title": "Forbidden",
  "status": 403,
  "code": "insufficient_scope",
  "detail": "Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17",
  "required_scopes": [
    "vouchers:post"
  ]
}
The action refuses (for example changing a posted voucher)
{
  "type": "urn:nonox:problem:forbidden",
  "title": "Forbidden",
  "status": 403,
  "code": "forbidden",
  "detail": "Behörighet saknas för det här.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Outside the IP allowlist
{
  "type": "urn:nonox:problem:ip_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "ip_not_allowed",
  "detail": "Företaget tillåter inte anrop från den här adressen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Write to an archived company
{
  "type": "urn:nonox:problem:company_archived",
  "title": "Forbidden",
  "status": 403,
  "code": "company_archived",
  "detail": "Företaget är arkiverat och kan bara läsas.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
The company no longer allows the app
{
  "type": "urn:nonox:problem:app_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "app_not_allowed",
  "detail": "Företaget tillåter inte längre den här appen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4041 example
Unknown id, other company's id, or module off
{
  "type": "urn:nonox:problem:not_found",
  "title": "Not Found",
  "status": 404,
  "code": "not_found",
  "detail": "Det du söker finns inte.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4091 example
Same key, first request not finished
{
  "type": "urn:nonox:problem:idempotency_in_progress",
  "title": "Conflict",
  "status": 409,
  "code": "idempotency_in_progress",
  "detail": "En begäran med samma Idempotency-Key pågår. Vänta och försök igen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4151 example
Wrong Content-Type
{
  "type": "urn:nonox:problem:unsupported_media_type",
  "title": "Unsupported Media Type",
  "status": 415,
  "code": "unsupported_media_type",
  "detail": "Skicka JSON (application/json).",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4222 examples
Field errors
{
  "type": "urn:nonox:problem:validation_failed",
  "title": "Unprocessable Content",
  "status": 422,
  "code": "validation_failed",
  "detail": "Uppgifterna kunde inte godtas. Se errors.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17",
  "errors": {
    "rows": [
      "Verifikationen balanserar inte: debet och kredit skiljer sig åt."
    ],
    "voucher_date": [
      "Det finns inget räkenskapsår som omfattar 2031-01-01."
    ]
  }
}
Same key, different body
{
  "type": "urn:nonox:problem:idempotency_key_reused",
  "title": "Unprocessable Content",
  "status": 422,
  "code": "idempotency_key_reused",
  "detail": "Idempotency-Key har redan använts för en annan begäran. Använd en ny nyckel för en ny begäran.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4291 example
Over the limit
{
  "type": "urn:nonox:problem:rate_limited",
  "title": "Too Many Requests",
  "status": 429,
  "code": "rate_limited",
  "detail": "För många anrop. Försök igen om 23 sekunder.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

List a voucher's attachments

GET /vouchers/{voucher}/attachments listVoucherAttachments

Metadata of the voucher's underlag (not paginated).

Scope

vouchers:view

Parameters

  • voucher string (uuid) path required

    Voucher id (UUID).

    Example: 0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e

Responses

200 OK – The attachments.

application/jsonobject

  • data array<Attachment> required
    6 fields · each item
    • id integer
    • name string
    • mime string

      Values: application/pdf, image/jpeg, image/png, image/webp

    • size integer

      Bytes.

    • sha256 string
    • created_at string (date-time)

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

401 Unauthorized – Missing, invalid, expired or revoked token or API key. Also returned when the person behind the credential has left the company (an OAuth grant is then revoked for good).

All error codes · application/problem+json

  • unauthenticatedNo valid credential

    Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, WWW-Authenticate

403 Forbidden – The credential may not do this: a scope is missing, the granting person no longer has the permission, the address is not allowed, the company is archived (read-only) or no longer allows the app.

All error codes · application/problem+json

  • insufficient_scopeScope missing or permission lost

    Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.

  • forbiddenThe action refuses (for example changing a posted voucher)

    Behörighet saknas för det här.

  • ip_not_allowedOutside the IP allowlist

    Företaget tillåter inte anrop från den här adressen.

  • company_archivedWrite to an archived company

    Företaget är arkiverat och kan bara läsas.

  • app_not_allowedThe company no longer allows the app

    Företaget tillåter inte längre den här appen.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

404 Not Found – Not found. Also the answer for another company's ids (existence is never revealed) and for every call while NONOX Connect is turned off for the company.

All error codes · application/problem+json

  • not_foundUnknown id, other company's id, or module off

    Det du söker finns inte.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

429 Too Many Requests – Rate limit exceeded (per credential, per company or per address). Wait Retry-After seconds.

All error codes · application/problem+json

  • rate_limitedOver the limit

    För många anrop. Försök igen om 23 sekunder.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Retry-After

Code samples

curl
curl "https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/attachments" \
  -H "Authorization: Bearer $NONOX_TOKEN" \
  -H "Accept: application/json"
PHP (Laravel)
use Illuminate\Support\Facades\Http;

$response = Http::withToken(config('services.nonox.token'))
    ->acceptJson()
    ->get('https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/attachments');

$response->throw();

$data = $response->json('data');
PHP (Guzzle)
$client = new \GuzzleHttp\Client(['timeout' => 30]);

$response = $client->request('GET', 'https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/attachments', [
    'headers' => [
        'Authorization' => 'Bearer '.getenv('NONOX_TOKEN'),
        'Accept' => 'application/json',
    ],
]);

$data = json_decode((string) $response->getBody(), true, flags: JSON_THROW_ON_ERROR)['data'];
JavaScript
const response = await fetch('https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/attachments', {
  headers: {
    Authorization: `Bearer ${process.env.NONOX_TOKEN}`,
    Accept: 'application/json',
  },
});

if (!response.ok) {
  const problem = await response.json();
  throw new Error(`${problem.code}: ${problem.detail}`);
}

const { data } = await response.json();
Python
import os
import requests

response = requests.get(
    "https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/attachments",
    headers={
        "Authorization": f"Bearer {os.environ['NONOX_TOKEN']}",
        "Accept": "application/json",
    },
    timeout=30,
)
response.raise_for_status()

data = response.json()["data"]

Responses · 200

application/json
{
  "data": [
    {
      "id": 311,
      "name": "kvitto-kontorsmaterial.pdf",
      "mime": "application/pdf",
      "size": 48213,
      "sha256": "9f2b5c1d7e3a4b6c8d0e1f2a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e",
      "created_at": "2026-03-02T10:41:07+01:00"
    }
  ]
}

Error

4011 example
No valid credential
{
  "type": "urn:nonox:problem:unauthenticated",
  "title": "Unauthorized",
  "status": 401,
  "code": "unauthenticated",
  "detail": "Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4035 examples
Scope missing or permission lost
{
  "type": "urn:nonox:problem:insufficient_scope",
  "title": "Forbidden",
  "status": 403,
  "code": "insufficient_scope",
  "detail": "Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17",
  "required_scopes": [
    "vouchers:post"
  ]
}
The action refuses (for example changing a posted voucher)
{
  "type": "urn:nonox:problem:forbidden",
  "title": "Forbidden",
  "status": 403,
  "code": "forbidden",
  "detail": "Behörighet saknas för det här.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Outside the IP allowlist
{
  "type": "urn:nonox:problem:ip_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "ip_not_allowed",
  "detail": "Företaget tillåter inte anrop från den här adressen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Write to an archived company
{
  "type": "urn:nonox:problem:company_archived",
  "title": "Forbidden",
  "status": 403,
  "code": "company_archived",
  "detail": "Företaget är arkiverat och kan bara läsas.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
The company no longer allows the app
{
  "type": "urn:nonox:problem:app_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "app_not_allowed",
  "detail": "Företaget tillåter inte längre den här appen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4041 example
Unknown id, other company's id, or module off
{
  "type": "urn:nonox:problem:not_found",
  "title": "Not Found",
  "status": 404,
  "code": "not_found",
  "detail": "Det du söker finns inte.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4291 example
Over the limit
{
  "type": "urn:nonox:problem:rate_limited",
  "title": "Too Many Requests",
  "status": 429,
  "code": "rate_limited",
  "detail": "För många anrop. Försök igen om 23 sekunder.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

Add an attachment

POST /vouchers/{voucher}/attachments addVoucherAttachment

Uploads underlag as multipart/form-data in the field `file`: a PDF or an image (JPG, PNG, WebP), at most 10 MB; the type is detected from the content, not the name. Allowed on drafts and on posted vouchers; an attachment is never removed from a posted voucher.

Scope

vouchers:create

Parameters

  • voucher string (uuid) path required

    Voucher id (UUID).

    Example: 0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e

  • Idempotency-Key string header required

    Required on every POST. A unique value per intended operation (a UUID v4 is ideal), 1–255 visible ASCII characters. Kept 24 hours per credential: the same key with the same request returns the stored response (Idempotent-Replayed: true); with a different request 422 idempotency_key_reused; while the first is still running 409. Server errors (5xx) are not stored, so retry with the same key.

    at least 1 characters · at most 255 characters · Example: 3f6c1b7e-2d4a-4e8b-9c0d-5a1b2c3d4e5f

Request body

multipart/form-dataobject required

  • file string (binary) required

    PDF, JPG, PNG or WebP, max 10 MB.

Responses

201 Created – The attachment.

application/jsonobject

  • data Attachment required
    6 fields
    • id integer
    • name string
    • mime string

      Values: application/pdf, image/jpeg, image/png, image/webp

    • size integer

      Bytes.

    • sha256 string
    • created_at string (date-time)

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Idempotent-Replayed

400 Bad Request – Bad request: missing or invalid Idempotency-Key, or a body that is not a JSON object.

All error codes · application/problem+json

  • idempotency_key_requiredNo Idempotency-Key on a POST

    Skicka en unik Idempotency-Key (till exempel ett UUID) med varje POST, så att ett nytt försök aldrig bokför två gånger.

  • idempotency_key_invalidIdempotency-Key too long or not visible ASCII

    Idempotency-Key ska vara 1–255 synliga ASCII-tecken.

  • invalid_jsonMalformed JSON

    Kroppen är inte giltig JSON (ett objekt).

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

401 Unauthorized – Missing, invalid, expired or revoked token or API key. Also returned when the person behind the credential has left the company (an OAuth grant is then revoked for good).

All error codes · application/problem+json

  • unauthenticatedNo valid credential

    Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, WWW-Authenticate

403 Forbidden – The credential may not do this: a scope is missing, the granting person no longer has the permission, the address is not allowed, the company is archived (read-only) or no longer allows the app.

All error codes · application/problem+json

  • insufficient_scopeScope missing or permission lost

    Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.

  • forbiddenThe action refuses (for example changing a posted voucher)

    Behörighet saknas för det här.

  • ip_not_allowedOutside the IP allowlist

    Företaget tillåter inte anrop från den här adressen.

  • company_archivedWrite to an archived company

    Företaget är arkiverat och kan bara läsas.

  • app_not_allowedThe company no longer allows the app

    Företaget tillåter inte längre den här appen.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

404 Not Found – Not found. Also the answer for another company's ids (existence is never revealed) and for every call while NONOX Connect is turned off for the company.

All error codes · application/problem+json

  • not_foundUnknown id, other company's id, or module off

    Det du söker finns inte.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

409 Conflict – A request with the same Idempotency-Key is still running.

All error codes · application/problem+json

  • idempotency_in_progressSame key, first request not finished

    En begäran med samma Idempotency-Key pågår. Vänta och försök igen.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Retry-After

415 Unsupported Media Type – The body is not application/json (or multipart/form-data where a file is accepted).

All error codes · application/problem+json

  • unsupported_media_typeWrong Content-Type

    Skicka JSON (application/json).

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

422 Unprocessable Content – Validation failed, or the Idempotency-Key was already used for a different request.

All error codes · application/problem+json

  • validation_failedField errors

    Uppgifterna kunde inte godtas. Se errors.

  • idempotency_key_reusedSame key, different body

    Idempotency-Key har redan använts för en annan begäran. Använd en ny nyckel för en ny begäran.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

429 Too Many Requests – Rate limit exceeded (per credential, per company or per address). Wait Retry-After seconds.

All error codes · application/problem+json

  • rate_limitedOver the limit

    För många anrop. Försök igen om 23 sekunder.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Retry-After

Code samples

curl
curl -X POST "https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/attachments" \
  -H "Authorization: Bearer $NONOX_TOKEN" \
  -H "Accept: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -F "file=@kvitto.pdf;type=application/pdf"
PHP (Laravel)
use Illuminate\Support\Facades\Http;
use Illuminate\Support\Str;

$response = Http::withToken(config('services.nonox.token'))
    ->acceptJson()
    ->withHeaders(['Idempotency-Key' => (string) Str::uuid()])
    ->attach('file', file_get_contents('kvitto.pdf'), 'kvitto.pdf')
    ->post('https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/attachments');

$response->throw();

$data = $response->json('data');
PHP (Guzzle)
$client = new \GuzzleHttp\Client(['timeout' => 30]);

$response = $client->request('POST', 'https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/attachments', [
    'headers' => [
        'Authorization' => 'Bearer '.getenv('NONOX_TOKEN'),
        'Accept' => 'application/json',
        'Idempotency-Key' => bin2hex(random_bytes(16)),
    ],
    'multipart' => [
        ['name' => 'file', 'contents' => fopen('kvitto.pdf', 'r'), 'filename' => 'kvitto.pdf'],
    ],
]);

$data = json_decode((string) $response->getBody(), true, flags: JSON_THROW_ON_ERROR)['data'];
JavaScript
import { readFile } from 'node:fs/promises';

const form = new FormData();
form.append('file', new Blob([await readFile('kvitto.pdf')], { type: 'application/pdf' }), 'kvitto.pdf');

const response = await fetch('https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/attachments', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NONOX_TOKEN}`,
    Accept: 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
  },
  body: form,
});

if (!response.ok) {
  const problem = await response.json();
  throw new Error(`${problem.code}: ${problem.detail}`);
}

const { data } = await response.json();
Python
import os
import uuid
import requests

response = requests.post(
    "https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/attachments",
    headers={
        "Authorization": f"Bearer {os.environ['NONOX_TOKEN']}",
        "Accept": "application/json",
        "Idempotency-Key": str(uuid.uuid4()),
    },
    files={"file": ("kvitto.pdf", open("kvitto.pdf", "rb"), "application/pdf")},
    timeout=30,
)
response.raise_for_status()

data = response.json()["data"]

Responses · 201

application/json
{
  "data": {
    "id": 311,
    "name": "kvitto-kontorsmaterial.pdf",
    "mime": "application/pdf",
    "size": 48213,
    "sha256": "9f2b5c1d7e3a4b6c8d0e1f2a3b4c5d6e7f8091a2b3c4d5e6f708192a3b4c5d6e",
    "created_at": "2026-03-02T10:41:07+01:00"
  }
}

Error

4003 examples
No Idempotency-Key on a POST
{
  "type": "urn:nonox:problem:idempotency_key_required",
  "title": "Bad Request",
  "status": 400,
  "code": "idempotency_key_required",
  "detail": "Skicka en unik Idempotency-Key (till exempel ett UUID) med varje POST, så att ett nytt försök aldrig bokför två gånger.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Idempotency-Key too long or not visible ASCII
{
  "type": "urn:nonox:problem:idempotency_key_invalid",
  "title": "Bad Request",
  "status": 400,
  "code": "idempotency_key_invalid",
  "detail": "Idempotency-Key ska vara 1–255 synliga ASCII-tecken.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Malformed JSON
{
  "type": "urn:nonox:problem:invalid_json",
  "title": "Bad Request",
  "status": 400,
  "code": "invalid_json",
  "detail": "Kroppen är inte giltig JSON (ett objekt).",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4011 example
No valid credential
{
  "type": "urn:nonox:problem:unauthenticated",
  "title": "Unauthorized",
  "status": 401,
  "code": "unauthenticated",
  "detail": "Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4035 examples
Scope missing or permission lost
{
  "type": "urn:nonox:problem:insufficient_scope",
  "title": "Forbidden",
  "status": 403,
  "code": "insufficient_scope",
  "detail": "Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17",
  "required_scopes": [
    "vouchers:post"
  ]
}
The action refuses (for example changing a posted voucher)
{
  "type": "urn:nonox:problem:forbidden",
  "title": "Forbidden",
  "status": 403,
  "code": "forbidden",
  "detail": "Behörighet saknas för det här.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Outside the IP allowlist
{
  "type": "urn:nonox:problem:ip_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "ip_not_allowed",
  "detail": "Företaget tillåter inte anrop från den här adressen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Write to an archived company
{
  "type": "urn:nonox:problem:company_archived",
  "title": "Forbidden",
  "status": 403,
  "code": "company_archived",
  "detail": "Företaget är arkiverat och kan bara läsas.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
The company no longer allows the app
{
  "type": "urn:nonox:problem:app_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "app_not_allowed",
  "detail": "Företaget tillåter inte längre den här appen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4041 example
Unknown id, other company's id, or module off
{
  "type": "urn:nonox:problem:not_found",
  "title": "Not Found",
  "status": 404,
  "code": "not_found",
  "detail": "Det du söker finns inte.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4091 example
Same key, first request not finished
{
  "type": "urn:nonox:problem:idempotency_in_progress",
  "title": "Conflict",
  "status": 409,
  "code": "idempotency_in_progress",
  "detail": "En begäran med samma Idempotency-Key pågår. Vänta och försök igen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4151 example
Wrong Content-Type
{
  "type": "urn:nonox:problem:unsupported_media_type",
  "title": "Unsupported Media Type",
  "status": 415,
  "code": "unsupported_media_type",
  "detail": "Skicka JSON (application/json).",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4222 examples
Field errors
{
  "type": "urn:nonox:problem:validation_failed",
  "title": "Unprocessable Content",
  "status": 422,
  "code": "validation_failed",
  "detail": "Uppgifterna kunde inte godtas. Se errors.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17",
  "errors": {
    "rows": [
      "Verifikationen balanserar inte: debet och kredit skiljer sig åt."
    ],
    "voucher_date": [
      "Det finns inget räkenskapsår som omfattar 2031-01-01."
    ]
  }
}
Same key, different body
{
  "type": "urn:nonox:problem:idempotency_key_reused",
  "title": "Unprocessable Content",
  "status": 422,
  "code": "idempotency_key_reused",
  "detail": "Idempotency-Key har redan använts för en annan begäran. Använd en ny nyckel för en ny begäran.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4291 example
Over the limit
{
  "type": "urn:nonox:problem:rate_limited",
  "title": "Too Many Requests",
  "status": 429,
  "code": "rate_limited",
  "detail": "För många anrop. Försök igen om 23 sekunder.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}

Download an attachment

GET /vouchers/{voucher}/attachments/{attachment}/content downloadVoucherAttachment

The file itself, as stored. X-Content-SHA256 lets you verify it against the sha256 in the metadata.

Scope

vouchers:view

Parameters

  • voucher string (uuid) path required

    Voucher id (UUID).

    Example: 0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e

  • attachment integer path required

    Attachment id.

    Example: 311

Responses

200 OK – The file.

application/pdfstring

image/jpegstring

image/pngstring

image/webpstring

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, X-Content-SHA256, Content-Disposition

401 Unauthorized – Missing, invalid, expired or revoked token or API key. Also returned when the person behind the credential has left the company (an OAuth grant is then revoked for good).

All error codes · application/problem+json

  • unauthenticatedNo valid credential

    Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, WWW-Authenticate

403 Forbidden – The credential may not do this: a scope is missing, the granting person no longer has the permission, the address is not allowed, the company is archived (read-only) or no longer allows the app.

All error codes · application/problem+json

  • insufficient_scopeScope missing or permission lost

    Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.

  • forbiddenThe action refuses (for example changing a posted voucher)

    Behörighet saknas för det här.

  • ip_not_allowedOutside the IP allowlist

    Företaget tillåter inte anrop från den här adressen.

  • company_archivedWrite to an archived company

    Företaget är arkiverat och kan bara läsas.

  • app_not_allowedThe company no longer allows the app

    Företaget tillåter inte längre den här appen.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

404 Not Found – Not found. Also the answer for another company's ids (existence is never revealed) and for every call while NONOX Connect is turned off for the company.

All error codes · application/problem+json

  • not_foundUnknown id, other company's id, or module off

    Det du söker finns inte.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset

429 Too Many Requests – Rate limit exceeded (per credential, per company or per address). Wait Retry-After seconds.

All error codes · application/problem+json

  • rate_limitedOver the limit

    För många anrop. Försök igen om 23 sekunder.

Response headers: X-Request-Id, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Retry-After

Code samples

curl
curl "https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/attachments/311/content" \
  -H "Authorization: Bearer $NONOX_TOKEN" \
  -H "Accept: application/json" \
  -o kvitto.pdf
PHP (Laravel)
use Illuminate\Support\Facades\Http;

$response = Http::withToken(config('services.nonox.token'))
    ->acceptJson()
    ->get('https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/attachments/311/content');

$response->throw();

file_put_contents('kvitto.pdf', $response->body());
PHP (Guzzle)
$client = new \GuzzleHttp\Client(['timeout' => 30]);

$response = $client->request('GET', 'https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/attachments/311/content', [
    'headers' => [
        'Authorization' => 'Bearer '.getenv('NONOX_TOKEN'),
        'Accept' => 'application/json',
    ],
    'sink' => 'kvitto.pdf',
]);
JavaScript
const response = await fetch('https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/attachments/311/content', {
  headers: {
    Authorization: `Bearer ${process.env.NONOX_TOKEN}`,
    Accept: 'application/json',
  },
});

if (!response.ok) {
  const problem = await response.json();
  throw new Error(`${problem.code}: ${problem.detail}`);
}

const file = Buffer.from(await response.arrayBuffer());
Python
import os
import requests

response = requests.get(
    "https://nonox.app/api/v1/vouchers/0b9f3c1e-6a2d-4f7b-9c8e-1d2a3b4c5d6e/attachments/311/content",
    headers={
        "Authorization": f"Bearer {os.environ['NONOX_TOKEN']}",
        "Accept": "application/json",
    },
    timeout=30,
)
response.raise_for_status()

with open("kvitto.pdf", "wb") as file:
    file.write(response.content)

Error

4011 example
No valid credential
{
  "type": "urn:nonox:problem:unauthenticated",
  "title": "Unauthorized",
  "status": 401,
  "code": "unauthenticated",
  "detail": "Nyckeln eller token saknas, är ogiltig, har gått ut eller har återkallats.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4035 examples
Scope missing or permission lost
{
  "type": "urn:nonox:problem:insufficient_scope",
  "title": "Forbidden",
  "status": 403,
  "code": "insufficient_scope",
  "detail": "Nyckeln eller appen saknar behörigheten vouchers:post, eller så har personen som gav den inte längre den behörigheten i företaget.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17",
  "required_scopes": [
    "vouchers:post"
  ]
}
The action refuses (for example changing a posted voucher)
{
  "type": "urn:nonox:problem:forbidden",
  "title": "Forbidden",
  "status": 403,
  "code": "forbidden",
  "detail": "Behörighet saknas för det här.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Outside the IP allowlist
{
  "type": "urn:nonox:problem:ip_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "ip_not_allowed",
  "detail": "Företaget tillåter inte anrop från den här adressen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
Write to an archived company
{
  "type": "urn:nonox:problem:company_archived",
  "title": "Forbidden",
  "status": 403,
  "code": "company_archived",
  "detail": "Företaget är arkiverat och kan bara läsas.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
The company no longer allows the app
{
  "type": "urn:nonox:problem:app_not_allowed",
  "title": "Forbidden",
  "status": 403,
  "code": "app_not_allowed",
  "detail": "Företaget tillåter inte längre den här appen.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4041 example
Unknown id, other company's id, or module off
{
  "type": "urn:nonox:problem:not_found",
  "title": "Not Found",
  "status": 404,
  "code": "not_found",
  "detail": "Det du söker finns inte.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}
4291 example
Over the limit
{
  "type": "urn:nonox:problem:rate_limited",
  "title": "Too Many Requests",
  "status": 429,
  "code": "rate_limited",
  "detail": "För många anrop. Försök igen om 23 sekunder.",
  "instance": "urn:nonox:request:7f3c2a9e-4b1d-4c8e-9a51-2d6f0e8b3c17"
}