Password change and reset are session or public-auth routes, not API-key operations. Bearer API keys receive 401 on POST /api/v1/user/password. Keys stay valid after a password write — rotate them under Settings → API Keys.
Method
Path
Notes
POST
/api/v1/user/password
Signed-in session only. Current password required when a hash exists; OAuth-only users may set a first password. TOTP/backup code required if 2FA is enabled. Always re-authenticate after 200.
POST
/api/auth/forgot-password
Public. Valid email always returns the same 200 body: If an account exists for that email, we sent a reset link. Does not say whether the address is registered.
POST
/api/auth/reset-password
Public. Consumes a single-use token. Does not create a session and does not skip 2FA.
GET/PATCH
/api/v1/user/profile
Includes hasPassword (boolean). Never returns a hash. PATCH still does not accept a password field.
Agents can read hasPassword via MCP get_password_status (or WebMCP anchor_get_context). There is no MCP tool that accepts a password or reset token. User guide: Password. Likewise get_email_change_status (or user.emailChange in anchor_get_context) reports a sign-in email change in progress, masked; no tool requests, approves or confirms one (Sign-in email).
format=pdf is the tax invoice. variant=pod is a proof of delivery (not a tax invoice; does not post). variant=with-pod is one PDF (tax invoice, then proof of delivery) and only with format=pdf
List entries (page, limit up to 200; optional source = manual or all, status, q, from, to, sort = created:desc (default), date:asc/desc, number:asc/desc, amount:asc/desc). Returns total, counts per status and totalPosted for every match
List transactions (page, limit up to 1000; optional status, startDate, endDate; include=raw adds each line's imported row and dedupe hash; summary=1 adds counts per status and money in/out in cents)
Spend on expense accounts for a period (accountIds, from, to; cents)
GET
/api/v1/search/documents
Search invoices, bills, quotes and credit notes by meaning (q; optional types, from, to, amountCents, toleranceCents, status, limit)
GET
/api/v1/search/contacts
Search contacts by meaning (q; optional type, limit)
GET
/api/v1/help/search
Search the help pages (q; optional limit)
GET
/api/v1/aria/status
Whether ARIA can answer for this member (enabled, reason)
POST
/api/v1/aria/ask
Ask ARIA (question; optional threadId, intent, context.accountIds, context.bankTransactionId). 404 while ARIA is off
GET
/api/v1/reports/aged-receivables
Aged Receivables
GET
/api/v1/reports/aged-payables
Aged Payables
GET
/api/v1/reports/general-ledger
General Ledger (startDate, endDate, optional accountId, costCenterId/projectId). format=pdf|xlsx downloads every line in the period; with accountId, just that account
Inventory CRUD. GET includes quantityReserved and quantityAvailable (on-hand minus reserved)
POST
/api/v1/inventory/:id/adjust
Adjust stock
POST
/api/v1/inventory/images/presign
Product picture upload: send fileName, mimeType, fileSize (PNG, JPEG, WebP or GIF, up to 2 MB); returns uploadUrl and fileKey. PUT the file to uploadUrl, then pass fileKey as imageUrl when creating or updating the item (null removes the picture). Items return imagePreviewUrl, a short-lived link