# Accounting Orbit — API documentation

Multi-tenant double-entry accounting. Every posting is balanced — an entry
whose debits and credits differ is rejected, not stored. The audit trail is
append-only and hash-chained, so tampering with a recorded event is detectable.
Objects are tenant-scoped: a reference to another tenant's object returns 404.

Base URL: `https://api.accountingorbit.com/api/v1`

All pages below are plain markdown, served without authentication and without
JavaScript. Fetch them directly.

## Start here

- [/docs/auth.md](/docs/auth.md) — Get an API key, scopes (`read` / `write` / `admin`), `Authorization: Bearer ao_...`, rotation, revocation, and which routes stay browser-only.
- [/docs/conventions.md](/docs/conventions.md) — Error shape, upload idempotency by content fingerprint, pagination envelope and per-endpoint defaults, rate limits, tenant scoping (`404`, never `403`), date and timestamp formats.

Read both before writing any request. Everything else assumes them.

## By task

- [/docs/receipts.md](/docs/receipts.md) — Upload receipts and documents (multipart and base64), accepted formats, the extraction lifecycle from pending to confirmed ledger entry, duplicate handling, rescan.
- [/docs/invoices.md](/docs/invoices.md) — Accounts receivable: customers, create/send/void invoices, record payments, AR aging.
- [/docs/bills.md](/docs/bills.md) — Accounts payable: vendors, bills, approval and payment, 1099 tracking, AP aging.
- [/docs/bank-imports.md](/docs/bank-imports.md) — Bank statement import (CSV, QIF, PDF), Plaid sync, the transaction matching and confirm flow, unmatched transactions as orphans.
- [/docs/reports.md](/docs/reports.md) — Trial balance, income statement, balance sheet, cash flow, CSV and PDF export, and the balanced-books guarantee.
- [/docs/white-label.md](/docs/white-label.md) — Agencies and firms: client entities, branding, per-entity permissions, provisioning a client programmatically.
- [/docs/review.md](/docs/review.md) — CPA review marketplace: the claim → quote → approve → access lifecycle and what a reviewer may read at each stage.

## Reference

- [/docs/api.md](/docs/api.md) — Generated endpoint reference for the key-authable subset of the API, produced from the live OpenAPI schema. Authoritative on request and response shapes.

## Conventions of this documentation

- URLs are exact and stable. Every page ends in `.md`; an extensionless path
  returns the web app's HTML shell, not documentation.
- Every documented capability exists. If a page describes an endpoint, that
  endpoint is in the live OpenAPI schema.
- Examples are copy-pasteable `curl` with real field names.