The accounting API — the routes the pages use, for anyone who signs in
Every screen of the ledger, receivables, payables, bank, tax and connectors is a versioned REST route under /api with a capability; the same routes serve an integration that holds a session or an integration key.
The pages are the API. Each route is guarded by the capability its screen needs; sign in as a user with that capability (a session cookie) or, for the two machine doors, present an integration key in X-Asar-Token. Machine doors (no session): POST /api/postings/event (an events key: {property, event_type, reference, payload:{business_date, narration, lines:[{account, debit, credit, memo}]}} → stored, applied or rejected with a reason); GET /api/bridge/tally/next, POST /api/bridge/tally/ack, POST /api/bridge/tally/ledgers (a bridge key). Ledger: /api/gl/journal (post), /api/gl/reverse, /api/gl/lock, /api/gl/tally, /api/gl/warehouse, /api/report?name=gl_trial_balance|gl_journal|gl_balance_sheet|…. Receivables: /api/ar/* — invoices, receipts, allocations, reminders, write-offs. Payables: /api/ap/* — vendors, bills, approval, runs, advances, debit notes. Bank: /api/bank/* — accounts, cash, cheques, statement import and matching, position; /api/gateway/*; /api/ota/*. Tax: /api/tax/* — registrations, returns, 2B, e-invoices, TDS. Connectors: /api/connectors/* — mapping, batches, send, keys, webhooks. Every read is GET with query parameters; every write is POST with a JSON body; every refusal is a 4xx with {error, hint} in words. The demo accounts (10099, 10088) are the sandbox. Reports come from /api/report?name=…&property=… with from/to or date as the report takes.