Developers
Every Kroniz workspace can expose its data to your own systems through a REST API and signed webhooks. Keys are issued per workspace by the Kroniz team — ask your account manager or write to info@kroniz.com.
Send your key as a bearer token. The key identifies your workspace — there is no workspace or company parameter to pass, and a key can never read another organisation's data.
curl https://erp.kroniz.com/api/v1/invoices \
-H "Authorization: Bearer krz_xxxxxxxx_………"All endpoints are GET and return JSON as {"data": [ … ]}. Use ?limit= (1–100, default 50).
| Endpoint | Returns | Requires |
|---|---|---|
/api/v1/ping | Workspace name and the scopes your key holds | — |
/api/v1/companies | Customers, prospects, suppliers and partners | CRM |
/api/v1/invoices | Invoices with totals, tax and balance due | Finance |
/api/v1/payments | Received payments and their method | Finance |
/api/v1/products | Products with pricing and units | Inventory |
/api/v1/employees | Employee records | HR |
A key only reaches the modules on your plan, and can be narrowed further when it is issued. Asking for a module you don't have returns 403 with a clear message.
Each key allows 1,000 requests per hour; going over returns 429. A missing, wrong, revoked or expired key returns 401. Errors always look like {"error": "…"}, never an HTML page.
Kroniz can call your endpoint when something happens in your workspace — currently invoice.posted and payment.recorded. Each call is a JSON POST carrying:
X-Kroniz-Event: invoice.posted
X-Kroniz-Delivery: 1234
X-Kroniz-Signature: sha256=<hmac of the raw body, using your signing secret>
{"event":"invoice.posted","tenant":"your-workspace","occurred_at":"…","data":{…}}Verify the signature before trusting a delivery — recompute the HMAC-SHA256 of the raw request body with your signing secret and compare. Reply with any 2xx status; anything else is retried after 2, 4, 8 and 16 minutes, then reported as failed in the Kroniz console.
Contact us and tell us which modules your integration needs. We issue the key, the scopes and (optionally) an expiry date, and you can have it revoked at any time.