API reference

The public API of NONOX Ekonomisystem, an open-source Swedish bookkeeping system.

Authentication. Apps use OAuth 2.0 authorization code with PKCE (S256 is required for every client; implicit, password, client credentials and device grants do not exist). An owner or administrator approves the app on the Swedish consent screen with a passkey and chooses one company. Access tokens live at most 15 minutes; refresh tokens rotate on every use, and a refresh token (or authorization code) used twice revokes the whole grant. Scripts use API keys (nnx_…) created under Anslutningar: one company, chosen scopes, mandatory expiry, optional IP allowlist, shown once and stored hashed. Send either as Authorization: Bearer …; cookies are never accepted.

One company per credential. Every token and key belongs to exactly one company. Another company's ids answer 404. While NONOX Connect is turned off for the company, every call answers 404. An archived company can only be read.

Effective rights. A request may do what its scopes allow AND what the person who granted the app or created the key may do in the company right now, evaluated on every request. A changed role reduces access at once; a person who leaves the company takes the credential's access with them.

Rate limits. Per credential 120 requests/minute, per company 600/minute, and 600/minute per IP address before authentication (operators can change these). Every response carries RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset; 429 adds Retry-After.

Idempotency. Every POST requires an Idempotency-Key, kept 24 hours per credential.

Errors are RFC 9457 application/problem+json with a stable code and a Swedish detail.

Money is integer öre (1 SEK = 100 öre) in fields ending in _ore. Dates are ISO 8601.

Versioning. The version is in the path (/v1). Within v1 changes are additive only (new endpoints, new optional fields, new enum values in responses); anything breaking gets /v2, with v1 kept alongside.

Webhooks (described under webhooks) are set up under Anslutningar by an owner or administrator with a passkey: an https address on the internet, chosen events and a signing secret shown once. Deliveries carry Nonox-Signature: t=<unix>,v1=<hex HMAC-SHA256 of "<t>.<body>"> and Nonox-Event-Id, are sent after the change has committed, and are retried for about a day. Addresses that resolve to private, loopback, link-local, CGNAT or multicast networks are refused.

Booking routes. Issuing an invoice, registering a supplier invoice and registering a payment post a voucher as the person behind the credential, so they need vouchers:create and vouchers:post as well (x-required-scopes).

Revocation. An app revokes its own grant with POST /oauth/revoke (RFC 7009).

Test companies. An operator (php artisan connect:test-company <email>) or an owner under Anslutningar can create a clearly marked test company with demo data to try the API against. It never e-mails documents.

This reference is generated from openapi.yaml (also as openapi.json), the same file the tests check every route against. Load it into Postman, Insomnia or a client generator.