Flow API
Issue legally-compliant Israeli invoices and receipts by API: real-time ITA allocation numbers, gapless numbering, signed PDFs, מבנה אחיד exports and webhooks. Test everything in a full sandbox before going live.
Your first invoice in two calls
# 1. Exchange your API key for a JWT
curl -X POST https://api.flow.example/api/v1/auth/token \
-H 'Content-Type: application/json' \
-d '{"key_id": "fk_sbx_...", "secret": "..."}'
# 2. Issue a tax invoice (amounts in agorot; VAT computed server-side)
curl -X POST 'https://api.flow.example/api/v1/businesses/{id}/documents?issue=true' \
-H 'Authorization: Bearer <token>' \
-H 'Idempotency-Key: inv-2026-001' \
-H 'Content-Type: application/json' \
-d '{
"doc_type": 305,
"issue_date": "2026-08-07",
"customer_name": "לקוח בע\u0022מ",
"customer_tax_id": "123456782",
"lines": [{"description": "ייעוץ", "quantity": 1, "unit_price_agorot": 600000}]
}'Authentication
Create an API key in Settings → API (key_id + one-time secret). POST /api/v1/auth/token exchanges it for a 30-minute Bearer JWT with embedded scopes. Accountant-created keys are capped to read-only scopes server-side.
Allocation numbers (מספר הקצאה)
Tax invoices above the statutory threshold (₪5,000 pre-VAT, B2B) get a real-time allocation number from the Israel Tax Authority during issuance. HTTP 201 → approved with allocation_number. HTTP 202 → the ITA held the invoice: the response carries allocation_decision_required and you must POST /documents/{id}/allocation-decision with one of: cancel, continue, reverse_charge, object. On ITA outage the invoice is issued and retroactive allocation is retried automatically (up to one year).
Sandbox triggers
In sandbox, the pre-VAT amount's last two agorot digits select the ITA outcome deterministically: …60 → held with code 460 (exercise the 4-way flow), …61 → code 461, …03 → simulated technical failure, anything else → approved.
Receipts & withholding
Receipt payments must sum to the document total. Withholding tax (ניכוי מס במקור) is a payment line: {method: "withholding", amount_agorot: ...}. Close invoices fully or partially with linked_invoices — over-closing beyond the open balance is rejected.
Webhooks
Register endpoints with events like document.issued and allocation.rejected. Deliveries are signed with X-Flow-Signature: t=<ts>,v1=HMAC_SHA256(secret, "<ts>.<body>").
מבנה אחיד export
POST /exports/unified-format with a date range returns the closing report and an OPENFRMT ZIP (INI.TXT + BKMVDATA.TXT, spec v1.31) — the statutory bookkeeping export your accountant needs.
Errors & idempotency
Errors are application/problem+json with a stable code plus detail (English) and detail_he (Hebrew). Send Idempotency-Key on document creation — replays return the original response; reuse with a different body fails with FLOW-IDEM-001.
Full OpenAPI schema: /api/openapi.json · Interactive reference: /api/docs