---
title: "API Overview"
description: "Every screen in BareLedger runs on the same REST JSON API. See how endpoints are grouped, how organizations are scoped and how to make your first call."
url: "https://bareledger.app/guides/api-overview"
category: "Developers & API"
updated: "2026-10-31"
publisher: "BareLedger (Syneria Technologies OPC)"
---

# API Overview

> Start here to learn which API endpoints are public, how the rest are grouped, and how to make your first call.

Every screen in BareLedger is built on the same JSON API you can call yourself. All endpoints live under `/api/v1/`, and every request is scoped to one organization you are registered in — the API never lists or returns another tenant's data. Start with [API Access](https://bareledger.app/guides/api-access) to create a key, then read [API Conventions](https://bareledger.app/guides/api-conventions) for the request and response shapes.



## Start here

- [API Conventions](https://bareledger.app/guides/api-conventions) — base URL, versioning, pagination, dates/timezones, HTTP status codes, validation/error format, rate limits, idempotency
- [API Authentication](https://bareledger.app/guides/api-authentication) — how to obtain and use a bearer token, MFA, session/token lifecycle
- [Authorization](https://bareledger.app/guides/api-authorization) — the permission/feature/tenant/country gate model, in request-processing order
- [Integration Examples](https://bareledger.app/guides/api-integration-examples) — worked curl examples: login, authenticated requests, pagination, error handling, webhook signature verification
- [API Error Reference](https://bareledger.app/guides/api-errors) — every status code this API returns and what it means here specifically

## Public (unauthenticated) endpoints

| Method & Path | Purpose |
|---|---|
| `POST auth/register` | Register a new user |
| `POST auth/login` | Login, issues bearer token (or a 2FA challenge) |
| `POST auth/password/forgot` / `POST auth/password/reset` | Password reset flow |
| `GET auth/email/verify/{id}/{hash}` / `POST auth/email/resend` | Email verification |
| `GET auth/providers` / `GET auth/{provider}/redirect` / `GET auth/{provider}/callback` / `POST auth/google/exchange` | Google SSO |
| `POST webhooks/paddle` / `POST webhooks/paymongo` | Billing gateway webhooks — verified by HMAC signature instead of a bearer token |
| `GET public/invoices/{token}` | Hosted invoice view, looked up by an unguessable token, no tenant header |
| `GET public/paddle-config` | Publishable Paddle client token only |
| `GET public/environment` | The API's environment name (`APP_ENV`) — the web and mobile apps watermark every non-production server |

Every other endpoint requires a bearer token; most tenant-data endpoints additionally require `tenant:required` + `subscription` + a specific `permission:` key.

## Endpoint groups (child pages)

- [API — Auth & Onboarding](https://bareledger.app/guides/api-auth) — login/register/2FA/sessions, tenant creation
- [API — Tenant, Org & Team](https://bareledger.app/guides/api-tenancy) — tenant settings, branches, departments/cost centers/projects, members & access
- [API — Chart of Accounts & Periods](https://bareledger.app/guides/api-accounting) — accounts, accounting periods, numbering
- [API — Journal Entries](https://bareledger.app/guides/api-journals) — journals + workflow
- [API — Sales & AR](https://bareledger.app/guides/api-sales) — directory (contacts, products — shared master data), quotations/sales orders, invoices, credit/debit notes, recurring invoices
- [API — Purchases & AP](https://bareledger.app/guides/api-purchases) — bills, vendor credits, recurring bills
- [API — Expenses](https://bareledger.app/guides/api-expenses)
- [API — Bank & Reconciliation](https://bareledger.app/guides/api-bank)
- [API — Reports](https://bareledger.app/guides/api-reports)
- [API — Billing & Subscriptions](https://bareledger.app/guides/api-billing)
- [API — Compliance & Tax](https://bareledger.app/guides/api-compliance) — tax rates, filings, WHT certificates/credits
- [API — Attachments](https://bareledger.app/guides/api-attachments)
- [API — Audit & Meta](https://bareledger.app/guides/api-audit) — audit logs, search, notifications, reference/meta data, dashboard
- API — Platform Admin — `/admin/*`
- [API — Webhooks (inbound)](https://bareledger.app/guides/api-webhooks)

Plus [API Authentication](https://bareledger.app/guides/api-authentication) and [API Error Reference](https://bareledger.app/guides/api-errors).