API changelog — SLK Invoices API

Dates are when the change was documented. The API is versioned by path (/v1); backwards-incompatible changes would ship as /v2.

2026-09-29 — developer platform (spec 1.1.0)#

Sandbox accounts: POST /api/developers/sandbox opens a free, isolated test business (30 days) with an API key, demo data and Shopify/Wix hook URLs. Sandbox mode is locked on for these accounts.
Complete OpenAPI 3.1: GET /api/billing/v1/openapi.json now describes every endpoint with full request/response schemas, error responses, examples, security schemes, the six webhook events, the inbound connector receiver, the MCP endpoint and the sandbox. Change: servers is now the bare origin and paths are absolute (/api/billing/v1/create-document); previously servers ended in /api/billing/v1 and paths were relative. Re-import the spec if you generated a client from the old one.
SDKs and Postman: Node, PHP, Python and C# single-file clients and a Postman collection under integrations/sdk/.
Sandbox now covers more entry points: store orders from connector receivers and the refunds that follow them produce SBX- documents in a sandbox account, and the MCP issue_document tool is refused there. (Previously only create-document honoured sandbox mode.)
New developer reference (this wiki).

API keys are stored only as SHA-256 hashes and shown once; existing plaintext keys keep working and are hashed on first use.
Rate limit: 600 requests/minute per key (REST and MCP), 429 above.
Native create-document: integer money within ±₪10bn, VAT 0% or 18% only, issueDate within 30 days back / 1 day ahead; GET /documents limit clamped to 1..1000; error responses are generic, details are logged server-side.

MCP server at /api/mcp (ten tools; read tools always, create_draft_document / issue_document for writes).
Webhooks: outbound signed events with retries (document.issued, document.cancelled, document.paid, customer.created, customer.updated, proposal.approved), plus sandbox mode for create-document.
POST /calculate dry-run totals with per-line (mixed) VAT.
Plan gates on the API: issuing needs API write access and respects the monthly allowance (422 with a Hebrew message).
Connector platform: generic inbound receiver POST /api/billing/ecommerce/{source}/{hookId} for Shopify and Wix (and platforms added later), refunds become credit notes.

POST /create-document in two shapes (native and Invoice4U-compatible), idempotent by apiIdentifier.
GET /documents, GET /customers, POST /customers.
Per-business API key with tenant resolution; dormant accounts refuse writes and allow reads.