Developers

API and webhooks

Every CursusOffice space exposes a JSON REST API and sends signed webhooks when something happens. Use it to connect your website, another system or an automation tool, staying in control.

What you can do

Read customers, products, VAT rates, quotes, invoices, payments and projects, with filters and pagination.

Create and update customers; create DRAFT quotes and invoices with the same checks as the interface.

Receive a notice (webhook) for customer created or updated, quotes sent and accepted, invoices issued and delivered, payments, projects and products created, website requests.

Subscribe and unsubscribe webhooks through the API too, for automations that register themselves.

How it works

From Management → API and webhooks you create a token with the permissions you need: it is shown only once and only its fingerprint is stored.
You call the API with the Authorization: Bearer header and the token, on the address of your space.
To receive events you add an https address: every delivery is signed with a secret you see only once and is retried on failure.

Example

curl https://<your-space>/api/v1/invoices?per_page=5 \
  -H "Authorization: Bearer co_..."

# Verifying a webhook signature (header Cursus-Signature: t=<time>,v1=<signature>):
# signature = HMAC-SHA256( "<time>.<received body>", webhook secret )

What you need

An API token with the right permissions.
For webhooks, a public https address that answers with a 2xx code.

Limits to know

The API never issues documents: quotes and invoices are born as drafts, issuing stays with a person.
Up to 120 requests per minute per token; amounts are always decimal strings.
In POSTs use the Idempotency-Key header for retries: the same key with the same body within 24 hours returns the answer already given.
Webhooks: delivered at least once, in no guaranteed order; up to 6 attempts (after 1 minute, 5 minutes, 30 minutes, 2 hours, 12 hours); internal-network addresses are rejected.
For now access is through personal tokens with permissions: OAuth authorisation for third-party applications is not available yet.

Frequently asked questions

Where is the full documentation?

In Management → API and webhooks and in the "API and webhooks" guide in the CursusOffice Help, with examples, error codes and signature checking.

How secure are the tokens?

They have limited permissions, an optional expiry and can be revoked instantly. Only the fingerprint is stored, not the token. Repeated wrong tokens are slowed down.

Can I connect my website contact form?

Yes, with the "Website requests" feature: see the dedicated page.

More integrations

All integrations

Related features

Integrations — Connectors, API and webhooks to link your tools.

Try it with CursusOffice

Try free for 30 days: no credit card needed to start.

Try free for 30 days