Base URL
All endpoints are served under:Authentication
Every request to the Invoice Auditing API must be authenticated with an Opereit API key using HTTP Basic Auth. An API key is a pair of values:- A key ID: a public identifier for the key.
- A key secret: the password component, prefixed with
opr_live_. The secret is shown only once, at creation time, and cannot be retrieved later. Store it in a secrets manager.
Authorization header as base64-encoded key_id:key_secret:
Unauthenticated requests
Requests without a validAuthorization header receive 401 Unauthorized along with a WWW-Authenticate: Basic realm="Obsydian API" response header:
Conventions
- All request and response bodies are JSON, except for file uploads which use
multipart/form-data. - Field names are
snake_case. - Timestamps are ISO 8601 (
2026-04-29T10:15:00Z); date-only fields useYYYY-MM-DD. - Monetary amounts, weights, and rates are returned as decimal strings to preserve precision.
- List endpoints are cursor-paginated with
?limit=50&cursor=<opaque_string>query parameters. Response format:{ data, pagination: { cursor, has_more } }.
Errors
Errors return a JSON body with a singleerror field describing what went wrong: