Skip to content

Endpoint Index

Applies to: All subscriptions

Purpose

Give a complete inventory of the API surface, and — more usefully — mark clearly which parts are supported integration contracts and which exist to serve the product's own interface.

Audience

Integration developers, architects scoping an integration.

Prerequisites

Reference

Read this first

The platform exposes several hundred endpoints. Most serve the web application and follow its needs.

Category Stability Use it?
Integration contracts — ingest, write-back, mapping templates Versioned and stable Yes
Administrative Follows the admin console For provisioning and bulk work
Application Follows the user interface No. Not an integration contract

Building an integration against application endpoints is the most common cause of an integration breaking on an upgrade that was not intended to affect it.

Integration contracts

Area Base path Documented in
Document ingest /api/v1/ingest Ingest API
TDS ingest /api/v1/ingest/tds Ingest API
Write-back /api/v1/integration Write-back API
Mapping templates /api/admin/mapping-templates Mapping Templates API
Complifly Agent gateway (Mode A ingress) /api/v1/agent ../../contracts/openapi/agent-api.v1.yaml — behind AGENT_ENABLED, not yet reachable in production: nginx client-certificate termination for this route is a pending deployment step. The gateway answers as contract 1.0; contract 1.1 (configuration, reconciliation, enrolment status, renewal) is specified in contracts/agent-api/v1.1/README.md and none of its additions is live

Administrative

Area Base path Documented in
Users (including ending a user's sessions), audit, fiscal calendar /api/admin Administration API
Approval role ladder /api/admin/approval-roles Administration API
Operational Controls — feature configuration (company defaults, GSTIN overrides, effective view, history) /api/admin/feature-definitions, /api/admin/companies/..., /api/admin/gstins/..., /api/admin/features/toggle Administration API
Machine credentials /api/admin/api-keys Administration API
Provider configuration /api/gsp, /api/admin/gsp Administration API
Document routing /api/admin/doc-type-routing Administration API
Onboarding, and company status (activate, suspend, archive) /api/admin/onboarding Administration API — Super Admin only
Usage (IRNs, e-way bills, cancellations, uploads, prints, ERP events; read-only), including the usage statement (/api/usage/statement, JSON or CSV; not an invoice) /api/usage Usage API — gated by admin.view; a company sees only its own
Commercial (your company's plan, licence, programmes and usage against limits; read only) /api/commercial, /api/admin/commercial Commercial API — own view gated by admin.view; administration Super Admin only
Go-live readiness (your company's stage, readiness figure and checklist; read only) /api/onboarding/readiness, /api/admin/go-live Go-Live Readiness API — own view gated by admin.view; administration Super Admin only
Integration visibility (every connection, credential, agent and subscription; read-only) /api/admin/integration-visibility Administration API — Super Admin only
Integration policies (global, company and connection limits) /api/admin/policies Integration Policies
Support Investigation (document search and timeline, read-only) /api/admin/support Administration API — gated by support.investigate
Write-back operations /api/v1/integration/admin Administration API
Write-back subscriptions /api/admin/writeback-subscriptions Administration API
ERP connection onboarding /api/admin/erp-connections Administration API
Observability dashboards and the support-readiness check (read-only) /api/admin/observability Administration API, Support Readiness — gated by observability.platform
Housekeeping legal hold (place/release/list) /api/housekeeping Administration API — gated by housekeeping.legalhold.manage
Operations Control Tower summary (read-only) /api/admin/ops-control-tower Administration API
Access: the "why can't they?" explanation, the controls matrix and the quarterly access-review export (read-only) /api/admin/access Administration API — gated by admin.view
Entra consent callback (public) /api/erp-consent/callback Administration API
Organization theme, branding, and change history/restore /api/theme Theme API
Theme/branding — public endpoints (public) /api/theme/public, /api/theme/assets (GET) Theme API

Application surface — for reference only

Listed so architects can see the shape of the system. Not integration contracts.

Area Base path What it serves
Authentication /api/auth Sign-in, password reset, one-time codes, session management (logout, logout-all, active sessions)
e-Invoice /api/irn, /api/irn/workbench Generation, cancellation, details, printing. The workbench list returns extra columns on request, and, where ENTERPRISE_GRID_V2 is on, a paged, server-filtered form with grid=2 — see List Columns and Saved Layouts API
e-Way Bill /api/ewb, /api/ewb-doc Both pipelines, Part-B, extension, multi-vehicle
Consolidated e-Way Bill /api/cewb Trip sheets and lookups
Upload /api/invoices/upload, /api/jobs File upload and job monitoring. POST /api/jobs/{jobId}/kill ends an active job: it needs admin.manage_users and a job of the caller's own company (anything else is 404 Job not found); only a Super Admin acts across companies
Correction /api/correction The Correction Cockpit
Validation utilities /api/validations Registration, identity and enterprise verification
Masters /api/masters Reference data
Launchpad /api/launchpad Per-user favorites for the tile launchpads (Admin & Audit, Master Data, Validations, Reports)
Saved layouts /api/layouts Each user's Layout Management column layout per screen — see List Columns and Saved Layouts API
Work queues /api/queues The IRN stage lists (Ready for IRN, In Doubt) and their counts for one registration; read-only, behind WORK_QUEUES — see Work Queues API
Documents /api/documents One paged list of a registration's invoices and e-way bill documents together (with a kind filter), and one document's detail; read-only, behind DOCUMENTS_WORKSPACE — see Documents API
Personal views /api/views A user's own saved views of the IRN Workbench (filters, financial year, sort, density), one default per screen, up to 20; behind PERSONAL_VIEWS — see Personal Views API
Dashboard /api/dashboard Summaries, and the Attention Center's compliance alerts with the documents behind each — see Compliance Alerts API
Global search /api/search Backend for the top-bar search (Documents/Masters) — Invoice No, IRN, Ack No, EWB No, GSTIN and party name, scoped to the active GSTIN. Its own per-user rate limit
Attention Center /api/attention Compliance findings: grouped alerts, the documents behind each, the acknowledge / assign / decide lifecycle, finding history, a cross-registration overview, and notification profiles (/api/attention/notification-profiles, plus two no-login links under /api/attention/notifications) — see Attention API
Compliance Profiles /api/admin/…/compliance-profile, /api/admin/gstins/{gstin}/registration-class, /api/admin/companies/{companyId}/onboarding-tasks How Tally vouchers are read for IRN and e-way bill: a company's profile (including the export port, the ship-to of export e-way bills) as numbered revisions (validate, save, roll back, compare, audit), each GSTIN's turnover class, and the onboarding tasks. Writes need a Complifly Super Admin — see Compliance Profile API
Analytics /api/intelligence Findings and analysis
Notifications /api/notifications In-product notifications
Complifly Compass /api/compass In-product Q&A over the documentation, scoped to the signed-in user. Behind COMPASS_ENABLED; its own per-user and per-org rate limits
Compass Agent /api/compass/agent The tool-using troubleshooting loop — investigates docs and (for staff) the codebase, chaining tool calls. Behind COMPASS_AGENT_ENABLED and a configured model credential; write/execute tools require an explicit human Confirm/Reject. Tighter rate limits than /api/compass
Printing /api/invoice-print, /api/print-config Rendering and print configuration, including the registration's print bank accounts (/api/print-config/bank-accounts, see Print configuration)
Invoice Generation /api/v1/igm Masters, documents, numbering, approvals
General ledger /api/v1/gl Accounts, journals, periods, reports
TDS /api/tds Module root — configuration and shared lookups
TDS deductions /api/tds/deductions Deduction entries
TDS challans /api/tds/challans Challan records and payment detail
TDS returns /api/tds/returns Quarterly return preparation and FVU output
TDS certificates /api/tds/certificates Form 16/16A issuance
TDS notices /api/tds/notices TRACES notices and responses
TDS rates /api/tds/rates Section rate masters
Data privacy /api/privacy, /api/vendor Notices, consent, grievances, evidence
Help /api/help In-product help registry
Health /api/health Liveness probe

Authentication by surface

Surface Credential Registration header
/api/v1/ingest, /api/v1/integration Machine credential Not used — scope comes from the credential
/api/admin/* User token, administrative role Usually required
/api/* application User token Required
/api/health None Not used

Rate limiting by surface

Surface Limit
/api/auth 20 requests per 15 minutes
/api/v1/ingest, /api/v1/integration 200 requests per minute
/api/compass 10 questions per minute and 60 per hour per user; 40 per minute per organisation; 4 concurrent per organisation
/api/compass/agent 4 runs per minute and 30 per hour per user; 12 per minute per organisation; concurrent runs capped per user by persona (1 / 2 / 4)
/api/search 60 requests per minute per user
Other surfaces See Rate Limits and Errors

The authentication limit is deliberately strict. A sign-in loop in a script will hit it quickly, and that is the intended behaviour.

Validation

Check Method Pass condition
Your integration uses only contract endpoints Review every call your integration makes All within ingest, write-back or mapping templates
No dependency on application endpoints Same review None. Any dependency is upgrade risk
Correct credential per surface Review your headers Machine credential for ingest and write-back; user token for administration
Rate limits respected Measure your call rate at peak Below the limit, with headroom
Authentication not called repeatedly Inspect your client Tokens cached

Troubleshooting

Symptom Cause Action
An integration broke after an upgrade It depends on application endpoints Move to the contract endpoints
403 on an administrative call Machine credential used where a user token is required Use the correct credential for the surface
429 while authenticating Sign-in called per request instead of caching a token Cache it
An endpoint exists but is undocumented It serves the application Do not build against it. Raise a request if the capability is genuinely needed as a contract
No endpoint for a needed capability It may not be exposed as a contract Ask before improvising against an application endpoint