Skip to content
Documentation
Guide API Demo
English
Open the app

API overview

Introduction to the NovaFisko REST API v1, its environments, its formats and the tools provided to connect your solution.

Updated on 10/05/2026 Edit this page

The NovaFisko API is the interface the application itself uses on the web, on desktop and on mobile. Everything you see in the Entries, Documents, Bank, VAT, Exports or Peppol tabs goes through it. Your integration therefore has exactly the same capabilities: create a company, push an invoice with its PDF, read the general ledger, download the full dossier of a fiscal year or follow changes continuously.

At a glance

Item Value
Base URL https://api.novafisko.com/v1
Style REST, JSON bodies in UTF-8
Authentication Bearer token (Authorization: Bearer ...)
Version v1, carried in the path
Message languages fr, nl, en, de
Specification OpenAPI 3.1

A minimal call, without authentication, lets you check that the service is responding:

curl https://api.novafisko.com/v1/status

{
  "ok": true,
  "time": "2026-10-05T08:12:44+00:00"
}

GET /v1/ping returns the same information in the form {"ok": true, "server_time": "..."} without touching the database. Use it as a connectivity probe.

Environments

Environment Base URL Usage
Production https://api.novafisko.com/v1 Real firm data
Demo https://api.novafisko.com/v1 with a demo token Sandbox, fictitious data reset every night

There is no separate test host. The sandbox is a demo firm hosted on the same API: you get a token in one call, without creating an account.

curl -X POST https://api.novafisko.com/v1/auth/demo \
  -H "Content-Type: application/json" \
  -d '{"locale": "fr", "device_name": "integration-sandbox"}'

{
  "token": "412|Qm9uam91ciBsZSBtb2RlIGTDqW1v",
  "user": {
    "id": 9034,
    "name": "Visiteur démo",
    "email": "demo-7f3a9c@demo.novafisko.com",
    "locale": "fr",
    "is_platform_admin": false,
    "is_demo": true,
    "firms": [
      {"public_token": "Fd7hQ2mN8sXa", "name": "Fiduciaire Démo", "role": "manager"}
    ],
    "managed_firms": [
      {"public_token": "Fd7hQ2mN8sXa", "name": "Fiduciaire Démo"}
    ]
  },
  "demo": {
    "firm": {"public_token": "Fd7hQ2mN8sXa", "name": "Fiduciaire Démo"},
    "companies": [
      {"public_token": "k3Jd9fPq2LmX", "code": "COMPTOIR", "name": "Le Comptoir Montois SRL"},
      {"public_token": "Pw8sTz4YbN1c", "code": "PIXELWERK", "name": "Pixelwerk SRL"},
      {"public_token": "Lb5vRe7HuK2d", "code": "LAMBERT", "name": "Lambert Électricité"},
      {"public_token": "Sc2oUv9XaM6e", "code": "SCENES", "name": "Scènes Ouvertes ASBL"}
    ],
    "expires_at": "2026-10-06T08:12:44+00:00",
    "resets_at": "2026-10-06T03:15:00+02:00"
  }
}

The demo firm contains four fictitious Belgian companies with two fiscal years, entries, bank statements, VAT returns and documents to validate. You can write to it freely.

Warning

In demo mode, any external effect is blocked with a 403 response and the demo_mode code: Peppol registration, sending to Novadesko, emails, integrations, licence keys, webhooks and company deletion. The data is reset every night at 03:15 (Brussels time) and a demo token lives no longer than 24 hours.

If the demo firm is temporarily unavailable, the call responds 503 with the demo_unavailable code.

Formats

  • Request bodies are JSON (Content-Type: application/json), except file uploads, which use multipart/form-data.
  • Responses are always JSON, including errors, except exports (PDF, XLSX, CSV, ZIP, XML), which return the file.
  • Dates use the ISO 8601 format, amounts are decimal strings with a dot. The details are in Conventions.
  • Errors follow a single shape, {message, code, errors}, described in Errors and limits.

Tools provided

Tool Address
OpenAPI 3.1 specification (JSON) https://docs.novafisko.com/openapi/novafisko-v1.json
OpenAPI 3.1 specification (YAML) https://docs.novafisko.com/openapi/novafisko-v1.yaml
Postman collection https://docs.novafisko.com/openapi/novafisko-v1.postman_collection.json
Interactive reference API reference

The specification describes every route with its parameters, its schemas and examples. You can import it into Postman, Insomnia or Bruno, or generate a client with the tool of your choice.

Tip

In the Postman collection, set the base_url and token variables once. All requests reuse them.

What the API covers

Area Example routes
Authentication auth/login, auth/me, auth/tokens, auth/demo
Firm firms/{firm}, team, licence, activity, webhooks
Companies companies, settings, integrity
Reference data accounts, journals, third parties, VAT codes, fiscal years and periods
Entries entries, entries/invoice, reversal
Documents documents, document-imports (PDF, images, XML, ZIP)
Bank transactions, reconciliation, rules, CODA files
VAT returns, Intervat XML, listings
Closing and statements trial balance, general ledger, annual accounts, fixed assets
Exports books as PDF, XLSX, CSV and the full dossier as ZIP
Peppol registration, transport, directory, third-party status
History revisions, revert, recycle bin, activity
Synchronisation sync/bootstrap, sync/pull, sync/push

Where to start

  1. Get a token: read Authentication.
  2. Go through the Conventions to avoid format pitfalls.
  3. Follow a use case, for example Push a purchase invoice.
  4. Set up webhooks to be notified of changes instead of polling the API.

See also