API documentation

# 1. Issue an API key in workspace settings → API keys.
# 2. Export it locally so curl can read it:
export ERI_API_KEY='eri_live_…'

# 3. List the 10 most recent invoices:
curl -s 'https://www.e-rechnung-inbox.de/api/public/v1/invoices?limit=10' \
  -H "Authorization: Bearer $ERI_API_KEY"

// Node 18+ (built-in fetch). No SDK required.
const res = await fetch(
  'https://www.e-rechnung-inbox.de/api/public/v1/invoices?limit=10',
  { headers: { Authorization: `Bearer ${process.env.ERI_API_KEY}` } },
);
if (!res.ok) throw new Error(`HTTP ${res.status}`);
const { data, next_cursor } = await res.json();
console.log(data.length, 'invoices,', next_cursor ? 'more available' : 'end of list');

import os, requests
res = requests.get(
    "https://www.e-rechnung-inbox.de/api/public/v1/invoices",
    params={"limit": 10},
    headers={"Authorization": f"Bearer {os.environ['ERI_API_KEY']}"},
    timeout=10,
)
res.raise_for_status()
print(res.json()["data"])

# Requires a write-scope API key. Reuse the same Idempotency-Key for retries
# of the same upload; use a new key for a different file/body.
export ERI_IDEMPOTENCY_KEY='upload-RE-2026-0142-001'

curl -sS -X POST 'https://www.e-rechnung-inbox.de/api/public/v1/invoices' \
  -H "Authorization: Bearer $ERI_API_KEY" \
  -H "Idempotency-Key: $ERI_IDEMPOTENCY_KEY" \
  -F "file=@./rechnung.xml;type=application/xml"

# Workflow writes are audit-stamped and require their own stable retry key.
export ERI_WORKFLOW_IDEMPOTENCY_KEY='workflow-RE-2026-0142-approve-001'

curl -sS -X PATCH 'https://www.e-rechnung-inbox.de/api/public/v1/invoices/$INVOICE_ID' \
  -H "Authorization: Bearer $ERI_API_KEY" \
  -H "Idempotency-Key: $ERI_WORKFLOW_IDEMPOTENCY_KEY" \
  -H "Content-Type: application/json" \
  --data '{"workflow_status":"approved","decision_note":"Approved after supplier and IBAN check"}'

{
  "id": "evt_01HV0CK7M5W9XGZN2Y9EGZ7T9R",
  "type": "invoice.created",
  "created_at": "2026-05-08T11:42:18.317Z",
  "data": {
    "invoice_id": "f3a3c5e0-3d3a-4f6e-9e9c-2d2dabec3d31",
    "invoice_number": "RE-2026-0142",
    "supplier": { "id": "8a2…", "name": "ACME GmbH" },
    "gross_total": 1428.0,
    "currency": "EUR"
  }
}

{
  "id": "evt_01HV0CK7M5W9XGZN2Y9EGZ7T9S",
  "type": "supplier.iban_changed",
  "created_at": "2026-05-08T11:42:18.317Z",
  "data": {
    "supplier_id": "8a2…",
    "supplier_name": "ACME GmbH",
    "previous_iban_last4": "0145",
    "new_iban_last4": "9921",
    "first_seen_in_invoice_id": "f3a3c5e0-3d3a-4f6e-9e9c-2d2dabec3d31"
  }
}

import crypto from 'node:crypto';

export function verifyEriWebhook(payload, signatureHeader, signingSecret) {
  // signatureHeader format: "t=<unix>,v1=<hex>"
  const parts = Object.fromEntries(
    signatureHeader.split(',').map((p) => p.split('=')),
  );
  const t = Number(parts.t);
  if (!Number.isFinite(t) || Math.abs(Date.now() / 1000 - t) > 300) return false;
  const expected = crypto.createHmac('sha256', signingSecret)
    .update(`${t}.${payload}`)
    .digest('hex');
  const actual = parts.v1 ?? '';
  return actual.length === expected.length && crypto.timingSafeEqual(
    Buffer.from(expected, 'utf8'),
    Buffer.from(actual, 'utf8'),
  );
}

import hashlib, hmac, time

def verify_eri_webhook(payload: bytes, header: str, secret: str) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    t = int(parts.get("t", "0"))
    if abs(int(time.time()) - t) > 300:
        return False
    signed = f"{t}.{payload.decode('utf-8')}"
    expected = hmac.new(secret.encode("utf-8"), signed.encode("utf-8"),
                       hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts.get("v1", ""))