Schemas

IP addresses or CIDR blocks permitted to present the key; empty means unrestricted.

The key's kind, which its workspace's environment decides. The key starts with this value and an underscore.

The permissions the key carries, always an explicit list.

Whether the key was revoked. An active key past expires_at no longer authenticates.

Who minted the key: the person's id, name and email. Absent for a key the system minted. Sent without include=created_by until 2026-11-30; after that only with include=created_by, and without display (the object is a UserRef).

The user who minted the key. Absent for a key the system minted, and for one whose creator's account is gone.

When the key stops authenticating. Absent for a key that does not expire.

The last four characters of the key, kept for recognizing it. Absent for a key minted before identifiers were kept.

When the key last authenticated a request, to the minute. Absent when it never has.

The key a rotation minted to replace this one; this key stops at expires_at.

The key this one was minted to replace.

FULL_ACCESS when the key carries exactly the default grant, READ_ONLY when exactly its read permissions, CUSTOM otherwise.

The person's email address.

The person's name. Absent when the user has not set one: show the email.

IP addresses or CIDR blocks permitted to present the key; empty means unrestricted.

The key. Returned this once and never stored: record it now.

The key's kind, which its workspace's environment decides. The key starts with this value and an underscore.

The permissions the key carries, always an explicit list.

Whether the key was revoked. An active key past expires_at no longer authenticates.

Who minted the key: the person's id, name and email. Absent for a key the system minted. Sent without include=created_by until 2026-11-30; after that only with include=created_by, and without display (the object is a UserRef).

The user who minted the key. Absent for a key the system minted, and for one whose creator's account is gone.

When the key stops authenticating. Absent for a key that does not expire.

The last four characters of the key, kept for recognizing it. Absent for a key minted before identifiers were kept.

When the key last authenticated a request, to the minute. Absent when it never has.

The key a rotation minted to replace this one; this key stops at expires_at.

The key this one was minted to replace.

The change's kind, which names its shape.

The permission, by its catalog name (GET /v1/permissions).

The change's kind, which names its shape.

The role, by its id and the name it had when the change was made.

The change's kind, which names its shape.

The text after the change; absent when there is none.

The text before the change; absent when there was none.

When the export ran.

The export run; the X-Audit-Id header of the download that produced it.

Number of invoices included in the export.

Artifact kind produced: bookings, master_data, or invoices_pdf.

Number of booking lines produced.

Provider id the export ran against.

User who ran the export.

Non-fatal issues found during the export (e.g. missing VAT IDs); empty when there were none.

SHA-256 of the generated file, for tamper-evidence and dedup.

The invoice-issue dates exported, both included; absent when unbounded.

File extension of the produced file (without the dot).

Artifact kind this descriptor produces: bookings, master_data, or invoices_pdf.

Human-readable name of the export shown on its card.

MIME type of the produced file.

User-tunable options for this export (e.g. grouping, posting_mode).

Longer explanation of what the export contains.

First invoice-issue date exported.

Last invoice-issue date exported.

Number of invoices included in the export.

Number of booking lines produced across all invoices.

Non-fatal issues surfaced during export (e.g. missing VAT IDs).

Provider-specific configuration; GET /accounting/integrations lists each provider's settings schema.

Human-readable name for this integration.

Registered accounting provider id (e.g. datev, lexware, sage).

active: exports may run against this integration. disabled: they are refused with a hint to enable it in Settings.

Per config key that overrides an organization fact: the value that applies and its source. Sent with include=layered; absent for a provider with no such key.

What the change is about: the name, the switch, or one setting.

The value after the act, a text as it is and any other value as its compact JSON; absent when there is none.

The value before the act, a text as it is and any other value as its compact JSON; absent when there was none.

For enabled: the switch before and after the act.

For a setting: its key in the provider's settings schema, a nested one dotted (accounts.revenue_de).

The switch after the act.

The switch before the act; absent for an integration the act configured first.

The organization's integration with this provider, in the shape GET /accounting/integrations/{provider}/settings answers. Absent until it is first saved.

Stable identifier of the config field, used as the JSON key in the stored config.

Human-readable label rendered next to the input.

Whether the field must be supplied for a valid config.

Input type: string, number, bool, select, account, or custom_field_ref.

Default value applied when the field is left unset.

Visual grouping the field belongs to (e.g. "Mandantendaten").

Longer help text explaining the field.

The organisation fact an empty value inherits (e.g. default_currency); the integration's layered block says what applies.

Selectable options; present only when type is select.

Placeholder text shown in an empty input.

Human-readable label shown for the option.

Value stored in the config when this option is chosen.

Ordered config fields the provider exposes; the settings UI renders them in order.

Who acted: user, api_key, system, job, webhook, customer or unknown. A customer is the organization's customer acting on their own account in the customer portal.

The customer who acted, when type is customer.

The host your customers will see, e.g. pay.example.com. Not the bare domain your website runs on.

The recipient address to suppress. Added with reason "manual".

Product to attach to the plan.

How often a subscription sold from the plan bills this line: every_period (the default when omitted) or once, on the first paid invoice.

Quantity a new subscription seeds for this product when the caller passes no explicit item; omit to seed 1.

Quantity bundled into the base price before per-unit billing applies (the included allowance/seat floor); null means none.

Highest quantity a buyer may pick for this product; omit for no plan-level ceiling.

Lowest quantity a buyer may pick for this product; omit for 1.

How this membership tracks the product version: latest (auto-follow head) or pinned; omitted seeds from the org default.

Plan-level default allowance-refresh cadence count; null (with refresh_unit) means one whole-period pool.

Unit for the refresh cadence: day, week, month, year or billing_cycle.

When true, unused included allowance carries forward into later periods.

Number of periods after which rolled-over allowance expires; null means it never expires.

Cap on accumulated rolled-over allowance; null means uncapped.

Ceiling on a POOL's unit balance; POOL only.

What this offer does to the subscription: create it (new), or cut its live revision and offer the follow-on (renegotiation).

Bind the subscription's open draft to this offer as it is, instead of cutting the live revision or minting an empty subscription. Renegotiation: refused with cut_at. New: needs subscription_id naming a subscription that was never activated.

When the renegotiation takes effect. Omit for now.

Name for the subscription this offer creates. Ignored when renegotiating.

The subscription being renegotiated, or the never-activated one a new offer adopts. Required for kind=renegotiation and for kind=new with adopt_draft, refused otherwise.

The tags to add. Each must be a tag for this kind of record.

The amount, {value, currency}, in the wallet's currency: positive on a debit, signed (and never zero) on an adjustment.

What originates the movement: one of PAYMENT, REFUND, PROMOTION, INVOICE, CHARGE, FEE, MANUAL, TRANSFER.

Requests also accept the new spelling: each value in lower case (charge for CHARGE). The listed spelling is deprecated in requests and accepted until 2026-11-30.

Optional free-text explanation stored on the ledger entry.

Optional external reference; a repeated (source, reference) is treated as an idempotent replay.

The name drawn into every signature field the signer applies, in Dancing Script.

The initials drawn into every initials field the signer applies. Required when one is applied.

The instant to advance the clock to. It must be after the clock's frozen_at.

Of those, the units forfeited again at once because the lot had lapsed and been forfeited; zero when the lot keeps them.

The entitlement grant (the allowance lot) the units came back to.

The product the lot holds units of.

The units that came back to the lot.

The correcting document (credit note or corrective) that took them back.

When the units came back, on the billing clock.

The issued document whose allowance draws came back.

Every allowance lot that got units back.

The organization whose allowance came back.

The subscription whose allowance came back.

The workspace that owns the subscription.

The invoice the roll-over was computed against.

The end of the billing period the allowance carried into.

The start of the billing period the allowance carried into.

The metered product the allowance belongs to.

The unused allowance quantity carried forward.

The subscription whose allowance rolled over.

When the rolled-over allowance expires; omitted when it never does.

The workspace that owns the subscription.

Per-product allowance state for the subscription.

The subscription this allowance snapshot is for.

The billing period the snapshot covers. Absent when the subscription has no billing period now (a trial before its first paid phase, a deal with no paid phase); products is then empty.

ISO 4217 codes this workspace has analytics data in, ascending. Read from the data — an organization bills in whatever currencies its charges, invoices and payments carry — so it cannot go stale. EMPTY is a real answer: a workspace that has billed nothing has no books.

The window the tiles describe, half-open: start included, end not.

The immediately preceding window of equal length: what each tile's previous value is reduced over.

False when this metric is declared but not yet servable. The tile is still returned, with a reason — a missing number that says why is more useful than a plausible wrong one.

The same reduction over the immediately preceding window of equal length (previous_period).

Decimal string.

Why the tile is unavailable.

Whether the caller may approve or reject this request right now.

True when can_decide is true only because the caller holds the permission approval.self_decide and raised this request themselves. The decision is then recorded as a self-approval override, and a comment is required (422 SELF_APPROVAL_REASON_REQUIRED without one).

Why not, as the code the decision endpoint would answer with (SELF_APPROVAL, MISSING_DOMAIN_PERMISSION, …). Show it next to a disabled control.

The permission a decider must hold to decide these requests. An approver must be able to perform the operation themselves.

How many people may decide under the approver role this workspace resolves.

Whether the checkpoint is switched on for the caller's workspace, as the settings ladder resolves approval..enabled. Read-only here; the switch is written through PUT /organization/settings.

How long a request stays decidable. Zero under EXPIRE_HOLD, where another system owns the clock.

How many eligible deciders enabling requires. Two, because nobody may decide their own request.

AMOUNT_THRESHOLD offers the operator an amount + currency; NO_THRESHOLD gates every command while enabled.

What enabling this checkpoint means for API-key callers. Show it next to the switch before it is turned on. Sent with include=display; until 2026-11-30 also without being asked.

domain_permission as a label for people, followed by the permission. Sent with include=display; until 2026-11-30 also without being asked.

Up to five of the eligible deciders, by name. Sent with include=display; until 2026-11-30 also without being asked.

The expiry rule as a sentence, to show verbatim. Sent with include=display; until 2026-11-30 also without being asked.

What this checkpoint does not intercept, in words. Sent with include=display; until 2026-11-30 also without being asked.

The domain's reference axis. On wallet.adjust it is the operator's own external reference; on invoice.refund it is that attempt's dedup token and must NOT be reused on a resubmission.

Refund only: what the approved refund takes back. whole reverses the document: its supply comes back, what was paid is returned and the unpaid rest comes off what the buyer owes — the request's amount is the paid part, the most it may return. amount returns the request's amount as a stated figure. A refund by named lines is never parked. Absent on every other checkpoint.

Refund only: the credit note was to be issued inline instead of calling the payment provider.

Domain-owned enum the operator chose: a wallet transaction source, or a refund's refunds_reason_check classification. Prefill a resubmission from it.

User id of the decider, as text. From 2026-11-30 decided_by is the person as a UserRef {id, name, email}, sent with include=decisions.decided_by: read the id from decided_by_id.

True when the decider was the requester and the decision was permitted only by the break-glass permission approval.self_decide. Such a row always carries a comment. Render it as an override, never as an ordinary approval.

The decider's own words. Always present when self_approval_override is true.

The user who decided.

Message key for the left-hand side. Always copy: there is no such thing as a data label.

True for the things that should stop a fast approver — a full refund, a quote far below list, the consequence of an expiry.

Message key for a value that is prose the product wrote.

A value somebody ELSE wrote — a reason note, a reference, an id, a date. Rendered verbatim; never translated.

NOT_APPLICABLE while the job does not apply to the request, PENDING while it runs, DONE when it succeeded, FAILED when it ran out of attempts.

When the job succeeded.

Why the job failed. Present only when status is FAILED.

Catalog list price captured when the line was authored. Display only — it is not a discount threshold. Absent on manually authored lines, which have no list price by construction.

Decimal number encoded as a string to preserve precision.

The checkpoint that parked the operation.

The id of the subject the request parked.

The kind of subject the request parked.

The organization the request belongs to.

The approval request.

Which half the fact is about: the approved operation's apply, or the release of what the request had parked.

How the request closed: APPROVED for the apply; REJECTED, CANCELLED or EXPIRED for the release.

The customer the subject belongs to, where it has one.

On a failure: what the run reported. The request keeps it until a retry succeeds.

On a retry: the person who re-armed the run.

The workspace that owns the approval request.

True when a request for this subject was already waiting: the call raised nothing new and the id is the existing request's. A double-clicked button lands here, which is a no-op rather than a conflict — the partial unique index on (organization, checkpoint, subject) settles it in the database.

The parked approval request. Read it whole with GET /v1/approvals/{id}, or wait for the approval.* webhook event (approval.applied, approval.request_rejected, approval.request_expired, …) whose request_id is its id.

Always approval_pending. The operation has NOT been carried out: no money moved, no ledger row was written, no document was sent, and none of it will happen unless a person approves the request.

Zero-based index of the first station the subject is standing at, or -1 when none is. A flow is a graph and can have two branches running at once, which is why this and gate_step are separate.

Zero-based index of the station this checkpoint gates. For "where is this blocked", use this — not current_step. -1 when the process has no gate station: the checkpoint does not apply to this subject and did not take it through the gate (a refused request on a subject that went on without approval), so its gate stations are left out.

True when the position was just read from the subject (detail view). False when it was derived from the approval request alone (list view), which is exact for a PENDING request — the subject is at the gate by construction — and is why the queue omits a process for anything else.

True when the steps are authored per subject (a schedule flow's own steps): render label verbatim. False when the steps are compiled in, in which case key is a stable translation axis.

The subject's stations, in the order they happen.

Stable identity of the station. A translation axis when per_subject is false; an author's own step key when it is true.

Server rendering, always usable. The fallback whenever key means nothing to the reader.

CURRENT on the gated step of a pending request is the thing the operator came to see. FAILED is a rejection or an apply that did not succeed.

The durable job that carries out an approved operation. A failed apply can be retried and is never silent.

The compiled-in checkpoint that parked this operation.

Dotted path into the dashboard message catalogue, from its root, e.g. "approvalsPage.summary.invoiceRefund.headline". Render it with headline_args.

User id of the person who raised the request, as text. They may not decide it unless they hold the break-glass permission approval.self_decide, in which case actions.can_decide is true, actions.self_decide_override is true and the decision is recorded as an override. From 2026-11-30 initiated_by is the person as a UserRef {id, name, email}, sent with include=initiated_by: read the id from initiated_by_id.

The record the operation acts on. Link to it with subject.type and subject.id, and subject.parent_id where the type needs one.

DEGRADED means the summary could not be built when the request was raised; the gate still applied. Open the linked record before deciding.

The durable job that releases whatever the request parked, for a request closed without approval (rejected, canceled or expired). While it is FAILED the subject is still parked; it can be retried.

What the caller may do with this request right now. Sent only with include=actions.

The value the checkpoint's threshold was compared against. Absent for checkpoints with no money axis.

The parameters the requester submitted, for prefilling a corrected resubmission. Not what an approver decides on — that is facts. Absent when the checkpoint's command has none of these fields.

Who decided and why: the whole trail, oldest first, so the last entry is the decision that closed the request. Empty when nobody decided (pending, expired, canceled). Sent with include=decisions; until 2026-11-30 also without being asked.

When the request closes undecided. Nothing is ever approved by expiry.

The typed statements the decision turns on. Sent with include=facts; a single request also sends them without being asked until 2026-11-30.

Why the checkpoint parked the operation, recorded at the raise: EVERY_COMMAND, it requires approval for every one; AT_THRESHOLD, the amount is at or above threshold; UNCOMPARABLE, the amount cannot be compared with threshold (another currency, or none). Absent on a request raised before this was recorded and on an author-placed gate — say the threshold was not recorded, never substitute today's setting.

The data the headline is rendered with, by argument name. Text (names, dates, ids) is substituted verbatim and never translated; money is formatted by the reader in their own locale.

The user who raised the request. The list filter initiated_by matches it. Absent on a request no person raised.

The money lines behind the request. Sent with include=lines; a single request also sends them without being asked until 2026-11-30.

Where the subject stands in its own lifecycle, with the gated step marked. On a list row it is derived from the request alone and sent only for a PENDING request (live is false); on a single request it is read from the subject (live is true). Absent when it cannot be derived: render the row without a stepper. Sent with include=process; until 2026-11-30 also without being asked.

The requester's own words, where the underlying operation has them — wallet.adjust's ledger reason, invoice.refund's free-text note. A refund's five-value classification is NOT this; it travels in command.source.

Message key for the secondary line, or absent when there is none.

The threshold in force when the request was raised. Absent under EVERY_COMMAND and wherever gate_reason is absent.

The checkpoint that parked the operation.

The person who approved. Never a machine: an API key cannot decide.

The id of the subject that was approved.

The kind of subject that was approved.

The organization the request belongs to.

The approval request that was approved.

True when the approver was the requester, permitted only by the break-glass permission approval.self_decide. Such a decision always carries a comment — the API refuses one without.

The approver's own words. Optional on approve — REQUIRED when self_approval_override is true.

The customer the subject belongs to, where it has one: a quote's, an invoice's or a wallet's customer, or the customer of the subscription a gated change acts on.

The person who raised the request. Present so a subscriber can check self_approval_override against the two ids rather than trusting the flag alone.

The workspace that owns the approval request.

Why the request closed: the requester withdrew it, or its subject retired (a voided quote, an ended change) or changed under the approver, so there was nothing left to decide.

The checkpoint that parked the operation.

The id of the subject whose request was cancelled.

The kind of subject whose request was cancelled.

The organization the request belongs to.

The approval request that was cancelled.

The person who withdrew the request. Absent when it was retired with its subject.

Their own words, if they gave any.

The customer the subject belongs to, where it has one: a quote's, an invoice's or a wallet's customer, or the customer of the subscription a gated change acts on.

The workspace that owns the approval request.

The checkpoint that parked the operation (quote.send, invoice.refund, wallet.adjust, schedule_flow.gate).

The id of the subject awaiting approval.

The kind of subject awaiting approval (QUOTE, REFUND, WALLET_ADJUSTMENT, SCHEDULE_FLOW_STEP).

The organization the request belongs to.

The approval request that was created.

The customer the subject belongs to, where it has one: a quote's, an invoice's or a wallet's customer, or the customer of the subscription a gated change acts on.

Deadline. Absent when the checkpoint holds without a deadline of its own.

The data the headline is rendered with, by argument name. A text argument (a customer name, an id) is never translated: a name is a name in every language. A money argument is an amount with its currency, for the reader to format in their own locale.

Message key for the one line describing what needs deciding, as the approver sees it. A dotted path into the dashboard's message catalogue; render it in your own copy or ignore it and use headline_args.

The operator whose action was parked. Empty only for a flow gate the reconciler healed back into existence.

The workspace that owns the approval request.

The checkpoint that parked the operation.

The id of the subject whose request expired.

The kind of subject whose request expired.

Instant the request was resolved EXPIRED.

The organization the request belongs to.

The approval request that expired undecided.

The customer the subject belongs to, where it has one: a quote's, an invoice's or a wallet's customer, or the customer of the subscription a gated change acts on.

The workspace that owns the approval request.

The checkpoint that parked the operation (for example invoice.refund, wallet.adjust, quote.send).

The checkpoint that parked the operation.

Why it was rejected. Always present: a rejection with no reason is refused at the API.

The person who rejected.

The id of the subject that was rejected.

The kind of subject that was rejected.

The organization the request belongs to.

The approval request that was rejected.

True when the decider was the requester, permitted only by the break-glass permission approval.self_decide.

The customer the subject belongs to, where it has one: a quote's, an invoice's or a wallet's customer, or the customer of the subscription a gated change acts on.

The person who raised the request. Present so a subscriber can check self_approval_override against the two ids rather than trusting the flag alone.

The workspace that owns the approval request.

The record's id.

The kind of record the operation acts on.

The record the subject lives under, for the kinds that need one to be addressed: the customer of a wallet (/customers/{parent_id}/wallets/{id}). Absent for a quote, an invoice and a change, which are addressable by id alone, and on a request whose parent could not be determined: render no link then, never a guess.

Why assembly produced no document, as the oracle's own stable token.

Developer-readable explanation. Not for display: a client words its sentence from code and the identifiers beside it.

The price key the refusal is about, beside product_id.

The product the refusal is about; absent when it is about the document or an entry naming no product.

Hash of the canonical rule document. Two definitions that select the same population share it, so re-typing "de" as "DE" or reordering the values inside a rule is correctly recognised as no change.

When the audience was created.

The saved rule set: either match_all, or a root rule group. Never both, and never neither.

Audience UUID.

Operator-facing name. Unique within the workspace.

Owning organization.

Which surfaces may point at this audience. Never empty. "email" is both mail tiers, "schedule" is a scheduled change's scope, "rollout" is the e-invoice rollout target, "documents" is a document-template block gated on the recipient (visible_when.audience_id). "promotion" is a promotion whose enrolment this audience decides.

Bumped on every rule write whose canonical content hash actually moved. A rename never bumps it, and neither does a rules write that changes nothing — the broadcast re-fire confirm compares (revision, count), so a spurious bump would refuse a send for a population that never moved.

When the audience was last written, by either a rename or a rules write.

Owning workspace. An audience is workspace-scoped, so a sandbox audience and a live one never see each other.

What this population is for. Optional.

What the change is about: the name, the description, the match-all switch, a condition, the grouping or a purpose.

For the name or the description: its value after the act; absent when it was cleared.

For the name or the description: its value before the act; absent when there was none.

For a condition added or removed: the condition.

For a regrouping: the whole definition before the act and after it.

For the match-all switch: before the act and after it.

For a purpose added or removed: the surface.

Which fact the condition tests.

How it compares.