API
Status, shape and scope of the HTTP API.
Not yet published as a stable interface
Suvi has a large internal HTTP API that the dashboard and mobile client use. It is not currently offered as a supported public integration surface, and it has no stability guarantee. This page describes the state honestly rather than documenting endpoints that may move.
Current state
The backend exposes roughly 424 distinct routes. A large share are internal: control-plane, operations and webhook receivers that are not meaningful to an integrator.
Formal OpenAPI coverage stands at about 7 percent of routes, across one of eight planned domain specifications. The domain that is specified covers accounting, inventory and sites, and it is high quality: it names its backing handlers, flags unimplemented paths, and documents real behaviours such as tax rate being a percentage rather than a fraction.
The most active area of the product, the warehouse and inventory endpoints, has no specification yet.
Authentication
Session-cookie based, issued through Google sign-in. There is no public API key scheme today, which is the main reason this is not yet an integration surface: an integrator would have to hold a user session.
What is planned
The remaining seven domain specifications, then a published reference generated from them, then an API key scheme with scopes. That order matters: publishing a reference before the auth story exists would produce documentation nobody can act on.
In the meantime
If you need programmatic access, the practical routes are:
- Google Sheets sync, which is bidirectional and needs no code. See Sheets.
- Workflows with an HTTP action, for pushing data out on a trigger.
- Ask us. Several integrations are simpler to add on our side than to work around on yours.