Changelog

    Changes to the API are additive. Existing fields and routes keep working.

    Vendor credits, card credits, review queue, and hotel statistics

    • Vendor credits: create (posted on the credit date), apply to bills, record a cash refund, void, list, and read (scopes vendor_credits:read, vendor_credits:write).
    • Card credits: merchant refunds and statement credits such as cashback or disputes, as drafts or posted, with edit, post, void, and delete (scopes expenses:read, expenses:write).
    • GET /review-queue lists bank and card transactions waiting for review, with the suggested category and who categorized it, filtered by status, account, account type, and date (scope transactions:read).
    • Room statistics: PUT daily rooms available and rooms sold, one day or up to 366 at a time, and read or delete them (scopes stats:read, stats:write). Hospitality companies only.
    • GET /reports/hotel-kpis returns occupancy, ADR, and RevPAR by day or month (scope reports:read).
    • The Bookkeeping sync template now includes transactions:read, vendor_credits:write, and stats:write.

    Bookkeeping: vendors, bills, expenses, journal entries, and invoices by ID

    • Vendors: list, read, create, and update (scopes vendors:read, vendors:write).
    • Bills and company-paid expenses: create as a draft or posted, edit, post, void, and delete drafts (scopes bills:write, expenses:write, with matching read scopes).
    • Journal entries: create, edit, post, void, and delete drafts (scope journals:write). Voided entries stay listed with status voided.
    • Invoices by HelloLedger ID: POST /invoices, then PATCH, post, void, or delete by invoice_id (scope invoices:write).
    • Vendors and customers sent by name are matched or created automatically and marked needs_review. Send an Idempotency-Key header to retry creates safely.
    • A write scope now also allows reading that resource. New key template: Bookkeeping sync.
    • Journal entry lists now page correctly past the first page.

    Connect HelloLedger and partner billing

    • Connect HelloLedger: partner apps send users to helloledger.ai/connect to approve a company, then exchange a one-time code at POST /v1/oauth/token for a developer key. Nobody copies a key.
    • Only a company admin or accountant can approve. Users can create a company during Connect.
    • GET /v1/partner/companies lists connected companies, and POST /v1/partner/companies/{company_id}/billing sets whether the partner or the business pays.
    • Keys from Connect show as Connected via the partner app in Profile → Developers and can be revoked there.
    • Partner settings (/app/partner): partner admins manage redirect URIs, contacts, teammates, and the client secret, and see connected companies and this month's bill.

    Credits, refunds, and payouts

    • PUT customer credits for specials, write-offs, and kept security deposits, applied to the charges they cover (scope invoices:write).
    • PUT customer refunds for deposit returns, overpayments, and leftover credits (scope payments:write).
    • PUT payouts to post processor fees out of the clearing account (scope payments:write).
    • Credits, refunds, and payouts can be voided. Payments and credits with refunds can't be voided until the refund is.
    • Customers accept status active or inactive.
    • Payments return refunded_amount.
    • X-Request-Id values you send are checked: 1–128 safe characters, otherwise a new ID is generated.
    • GET /v1/whoami reports the limits for your key, which support can raise for a first upload.
    • Property Management charts include Rent Concessions (4900) and starter items for common charges.

    Receivables API and key security

    • New scopes for developer keys: items:read, customers:write, invoices:write, payments:write.
    • PUT customers, invoices, and customer payments by your own external IDs, with safe retries.
    • Invoices post to the ledger immediately and are never emailed by HelloLedger.
    • Void invoices and payments; invoices can be replaced until a payment is applied.
    • GET /v1/whoami and GET /items.
    • Errors now return a code, message, hint, and request_id, and every response has an X-Request-Id header.
    • Key activity is visible on the Developers page, and keys unused for 90 days are flagged.
    • Developer keys no longer expire by default. Choose 30, 90, or 180 days or 1 year if you want them to.
    • Optional allowed IPs per key; other addresses get 403 ip_not_allowed. GET /v1/whoami returns client_ip.
    • Key owners are emailed when a key is created, rotated, changed, or revoked.
    • Customers, invoices, payments, and items accept Bearer keys only (401 bearer_required for HTTP Basic).

    Daily revenue journals

    • PUT /journals/daily-revenue posts one balanced journal per key, company, and date.