O
    OrbitCashFlow     Home

    Developers / API

    Read-only REST API reference for integrating Orbit CashFlow.

    Introduction

    The Orbit CashFlow public API is a read-only REST API for pulling your company's financial data into external systems. Every request is scoped to the company/tenant tied to the API key.

    Base URLhttps://orbitcashflow.com/api/v1

    Authentication

    Send your API key in the x-api-key header on every request.

    x-api-key: orbit_live_xxx

    Company admins can create and revoke keys under Settings → Company → API Keys.

    • The full key is shown only once at creation. Copy and store it securely immediately.
    • Current keys are read-only (read scope).

    Example key

    orbit_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

    Endpoints

    All endpoints are GET requests and return JSON. Append the paths below to the base URL.

    MethodPathDescriptionQuery parameters
    GET/public-api/accountsList accounts
    • pageparams.accounts.page
    • limitparams.accounts.limit
    • sortByparams.accounts.sortBy
    • sortOrderparams.accounts.sortOrder
    • searchparams.accounts.search
    • typeFilter by account type.
    • isActivetrue to return only active accounts.
    • currencyFilter by currency code (e.g. TRY, USD, EUR).
    GET/public-api/categoriesList categories
    • pageparams.categories.page
    • limitparams.categories.limit
    • sortByparams.categories.sortBy
    • sortOrderparams.categories.sortOrder
    • searchparams.categories.search
    • typeFilter by category type (income or expense).
    • parentIdFilter by parent category ID.
    • rootOnlytrue to return only top-level categories.
    • isActivetrue to return only active categories.
    • includeSystemtrue to include system categories.
    GET/public-api/contactsList contacts
    • pageparams.contacts.page
    • limitparams.contacts.limit
    • sortByparams.contacts.sortBy
    • sortOrderparams.contacts.sortOrder
    • searchparams.contacts.search
    • typeFilter by contact type (customer or supplier).
    • isActivetrue to return only active contacts.
    • cityFilter by city name.
    GET/public-api/budgetsList budgets
    • pageparams.budgets.page
    • limitparams.budgets.limit
    • sortByparams.budgets.sortBy
    • sortOrderparams.budgets.sortOrder
    • searchSearch by budget name.
    • periodTypeFilter by budget period type.
    • statusFilter by budget status.
    • startDateFromFilter by start date (from), ISO 8601.
    • startDateToFilter by start date (to), ISO 8601.
    GET/public-api/budget-plansLister les plans budgétaires d'entreprise (V2)—
    GET/public-api/budget-plans/:planId/linesExporter les lignes d'un plan budgétaire par période et par département
    • versionIdUne version de plan spécifique ; la dernière version est utilisée si omise.
    GET/public-api/invoicesList customer invoices
    • skipNumber of records to skip.
    • takeMaximum number of records to return.
    • statusFilter by invoice status.
    GET/public-api/transactionsList transactions
    • pageparams.transactions.page
    • limitparams.transactions.limit
    • sortByparams.transactions.sortBy
    • sortOrderparams.transactions.sortOrder
    • searchparams.transactions.search
    • accountIdFilter by account ID.
    • categoryIdFilter by category ID.
    • contactIdFilter by contact ID.
    • typeFilter by transaction type.
    • statusFilter by transaction status.
    • statusesFilter by multiple statuses (comma-separated).
    • startDateFilter by start date, ISO 8601.
    • endDateFilter by end date, ISO 8601.
    • minAmountMinimum amount.
    • maxAmountMaximum amount.
    • tagsFilter by tags (comma-separated or repeated).
    • isRecurringtrue to return only recurring transactions.
    • orgUnitIdsFilter by department IDs (comma-separated).
    GET/public-api/transactions/:idGet a single transaction by ID—

    Error responses

    The API returns standard HTTP status codes.

    StatusMeaning
    401Missing, invalid or revoked API key.
    403API key lacks the required scope.
    404Resource not found in the key's company/tenant.

    Example requests

    Copy-paste the commands below. Replace orbit_live_xxx with your own API key.

    List accounts

    curl -H "x-api-key: orbit_live_xxx" https://orbitcashflow.com/api/v1/public-api/accounts

    List transactions (paginated)

    curl -H "x-api-key: orbit_live_xxx" "https://orbitcashflow.com/api/v1/public-api/transactions?page=1&limit=50"

    Get a single transaction

    curl -H "x-api-key: orbit_live_xxx" https://orbitcashflow.com/api/v1/public-api/transactions/00000000-0000-0000-0000-000000000000

    Webhooks

    Webhooks send real-time event notifications to endpoints you register. Company admins can create and manage webhooks under Settings → Company → Webhooks.

    Event types

    Select one or more event types when registering a webhook:

    • transaction.created Sent when a transaction is created.
    • invoice.created Sent when an invoice is created.
    • budget.created Sent when a budget is created.

    Payload

    Each delivery is a JSON POST with this shape:

    {
  "id": "00000000-0000-0000-0000-000000000000",
  "event": "transaction.created",
  "createdAt": "2026-01-01T00:00:00.000Z",
  "data": {}
}

    Headers

    Each request includes the following headers:

    X-Orbit-Event: transaction.createdX-Orbit-Signature: sha256=...

    Signature verification

    Verify deliveries by computing an HMAC-SHA256 of the raw request body using your webhook secret.

    const crypto = require('crypto');

const signature = crypto
  .createHmac('sha256', secret)
  .update(rawBody)
  .digest('hex');

// Compare signature with the value after "sha256=" in X-Orbit-Signature

    Compare the hex digest to the value after sha256= in the X-Orbit-Signature header.