Identity

Get the authenticated principal

Returns the user, active organization, role, raw token scopes, and effective permissions (token scopes ∩ role permissions).

Example request

curl "https://invoice.avscorp.in/api/v1/me" \
  -H "Authorization: Bearer YOUR_API_KEY"

Example response

{
  "user": {
    "id": "clx2usr001000000000000001",
    "email": "you@example.com",
    "name": "Karthik"
  },
  "organization": {
    "id": "clx2org001000000000000001",
    "name": "AVS Textiles",
    "slug": "avs-textiles"
  },
  "role": "ADMIN",
  "tokenType": "oauth",
  "scopes": [
    "invoices",
    "paymentsReceived.read",
    "customers.read"
  ],
  "effectivePermissions": [
    "invoices.read",
    "invoices.create",
    "invoices.update",
    "invoices.delete",
    "paymentsReceived.read",
    "customers.read"
  ]
}

List the authenticated user's organizations

Bare array, not paginated — use for an organization switcher.

Example request

curl "https://invoice.avscorp.in/api/v1/me/organizations" \
  -H "Authorization: Bearer YOUR_API_KEY"

Example response

[
  {
    "id": "clx2org001000000000000001",
    "name": "AVS Textiles",
    "slug": "avs-textiles",
    "roleKey": "ADMIN"
  },
  {
    "id": "clx2org002000000000000001",
    "name": "Sunrise Apparel",
    "slug": "sunrise-apparel",
    "roleKey": "VIEWER"
  }
]

Get the active organization's business profile

The seller info that appears on invoices: name, legal name, GSTIN, address, phone, email, state code, and base currency. Org-scoped via the token only — no request parameter.

Example request

curl "https://invoice.avscorp.in/api/v1/me/organization" \
  -H "Authorization: Bearer YOUR_API_KEY"

Example response

{
  "name": "AVS Textiles",
  "legalName": "AVS Textiles Private Limited",
  "gstin": "27AAAAA0000A1Z5",
  "address": "12 Industrial Estate, Sector 5, Navi Mumbai, 400701",
  "phone": "9876500000",
  "email": "accounts@avstextiles.in",
  "stateCode": "27",
  "currency": "INR"
}

Get the live scope catalog

Public — no authentication required. The authoritative, always-current list of group/module/granular scopes.

Example request

curl "https://invoice.avscorp.in/api/v1/scopes" \
  -H "Authorization: Bearer YOUR_API_KEY"

Example response

{
  "groups": [
    "read",
    "write",
    "full"
  ],
  "modules": [
    "customers",
    "quotes",
    "salesOrders",
    "invoices",
    "paymentsReceived",
    "vendors",
    "expenses",
    "purchaseOrders",
    "bills",
    "paymentsMade",
    "items",
    "taxes",
    "currencies",
    "paymentTerms",
    "numberSeries",
    "accounts",
    "priceLists",
    "reports",
    "settings",
    "users",
    "roles",
    "inventory",
    "whatsapp"
  ],
  "granular": [
    "customers.read",
    "customers.create",
    "customers.update",
    "customers.delete",
    "customers.approve",
    "customers.send",
    "invoices.read",
    "invoices.create",
    "invoices.update",
    "invoices.delete",
    "invoices.approve",
    "invoices.send"
  ]
}

Issue an OAuth2 token (password or refresh_token grant)

First-party mobile client only — the password grant means sending the end user's own credentials, which is not an appropriate pattern for a third-party integration. Third-party integrations should use a Personal Access Token instead (see Authentication). Response is the raw OAuth2 token payload, not the standard envelope.

Example request

curl -X POST "https://invoice.avscorp.in/api/v1/oauth/token" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "grant_type": "password",
  "username": "you@example.com",
  "password": "••••••",
  "client_id": "avs-mobile",
  "scope": "invoices.read customers.read"
}'

Example response

{
  "access_token": "avs_at_9x7f2h1kQmZ...",
  "refresh_token": "avs_rt_3jf82hDkqLp...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "invoices.read paymentsReceived.read customers.read"
}

Revoke an OAuth2 access or refresh token

Always returns 200 regardless of whether the token existed (RFC 7009 semantics). Response is not the standard envelope.

Example request

curl -X POST "https://invoice.avscorp.in/api/v1/oauth/revoke" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "token": "avs_at_9x7f2h1kQmZ..."
}'

Example response

{
  "success": true
}