List invoices

GEThttps://<your-url>/api/v2/invoices

MCP id invoices.indexAlso on this path: POST Create an invoice

Returns the legacy per-project invoices, newest invoice date first.

Token scope: api:read:invoices
Without it: 403 insufficient-token-scope.
Permission: invoices::read
Without it: 403 insufficient-permission.
Feature: Needs the billing feature on your organisation.
Without it: 404 endpoint-not-found.
Rate cost: 1 unit, read bucket. view=detail makes it 3. Adds: each include +1, q +2.
Also: If-None-Match answers 304 when nothing changed. Never cached: private, no-store. Unknown query parameters are refused, never ignored.

Both are checked, scope first. A token never does more than its user. How access is checked

Request

Example: One quarter of a project's invoices

curl -G \
  'https://<your-url>/api/v2/invoices' \
  --data-urlencode 'filter[project_id]=1' \
  --data-urlencode 'filter[date][gte]=2026-01-01' \
  --data-urlencode 'filter[date][lte]=2026-03-31' \
  --data-urlencode 'sort=-date' \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/json'

const response = await fetch('https://<your-url>/api/v2/invoices?filter[project_id]=1&filter[date][gte]=2026-01-01&filter[date][lte]=2026-03-31&sort=-date', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer <token>',
    'Accept': 'application/json',
  },
});

use Illuminate\Support\Facades\Http;

$response = Http::withToken('<token>')
    ->acceptJson()
    ->get('https://<your-url>/api/v2/invoices?filter[project_id]=1&filter[date][gte]=2026-01-01&filter[date][lte]=2026-03-31&sort=-date');

import requests
response = requests.request(
    'GET',
    'https://<your-url>/api/v2/invoices?filter[project_id]=1&filter[date][gte]=2026-01-01&filter[date][lte]=2026-03-31&sort=-date',
    headers={'Authorization': 'Bearer <token>', 'Accept': 'application/json'},
)

Response

The shape of the response, with sample values.

{
  "data": [
    {
      "id": 1,
      "project_id": 1,
      "project": {
        "id": 1
      },
      "user_id": 1,
      "user": null,
      "description": "Sprint 14: portal rebuild",
      "date": "2026-03-31",
      "hourly_rate": "85.00",
      "created_at": "2026-03-04T09:15:00Z",
      "updated_at": "2026-03-04T09:15:00Z",
      "links": {
        "…": "1 field of InvoiceLinks"
      }
    }
  ],
  "meta": {
    "page": {
      "per_page": 1,
      "next_cursor": "…",
      "prev_cursor": "…",
      "total": 1,
      "current_page": 1,
      "last_page": 1
    }
  },
  "links": {
    "self": "https://<your-url>/api/v2/work-items/1",
    "next": "https://<your-url>/api/v2/work-items/1",
    "prev": "https://<your-url>/api/v2/work-items/1"
  }
}

Every invoice in the organisation is visible to any caller holding invoices::read; there is no per-record rule. Scope to one project with filter[project_id], to a period with filter[date][gte] and filter[date][lte], and search with q= over the description. Defaults to the summary view; view=detail carries the same fields on this resource (none of them is detail-only) and costs three read units instead of one. Line items are not published, so no total appears here.

Query parameters

Unknown parameters are refused with 400, naming the parameter.

21 parameters in 6 groups

Views

viewstring

Which field set to render.

summarydefaultdetail

Pagination

per_pageinteger1 to 100

Rows per page. At most 25 when include names a to-many relation; a larger value is 400 invalid-query-parameter.

Default: 25

cursorstring

Opaque keyset cursor from a previous page's links.next. Never construct one by hand.

pageinteger1 to 1000

Opt in to page-number paging: 1-based, at most 1000. Omit it, the default, to page by opaque cursor, which is what links.next hands you. Cannot be combined with cursor. Published only on collections that count their rows on every request.

Filters

=: equals
[in]: any of a comma-separated list
[null]: true or false: whether it is empty
[gte][lte][lt]: at least, at most, less than

filter[created_at]timestamp (YYYY-MM-DDThh:mm:ssZ)=[gte][lt]

Creation timestamp. Pair with sort=id for a stable full export.

filter[date]date (YYYY-MM-DD)=[gte][lte]

Invoice date. Combine gte and lte to select a period, e.g. one quarter.

filter[project_id]integer=[in]

Project the invoice was raised for. This is how you list one project's invoices: there is no nested path for them.

A comma-separated list of at most 100 values.

filter[updated_at]timestamp (YYYY-MM-DDThh:mm:ssZ)=[gte][lt]

Last-write timestamp. Use for incremental sync.

filter[user_id]integer=[in][null]

Employee the invoice is attributed to. null selects the invoices whose recorder has since been deleted.

A comma-separated list of at most 100 values.

Search

qstring

Free-text search over description. At most one substring match per request: q together with a contains filter is 400 invalid-query-parameter.

Sorting

sortstring

Up to three keys, comma-separated, each optionally prefixed with - for descending.

Default: date

Key	Sorts by
`date`	Invoice date, newest first.
`id`	Id, ascending. An id never changes, so use this for a stable full export.
`updated_at`	Last-write timestamp; pair with the id tiebreaker for sync.

Prefix a key with - for descending.

Includes

includestring

Comma-separated names to inline, at most five.

Path	Adds	Cost
`project`	The project this invoice was raised for, with its title and customer. Requires the `projects::read` permission and a token scope covering the projects prefix.	+1
`user`	The employee this invoice is attributed to, with their name. Requires the `users::read` permission and a token scope covering the users prefix.	+1

Request headers

X-Request-Idstringpattern

A correlation id of your own. It is recorded in our logs next to the server's request id but never returned: the response header always carries the server's id. A value that does not match the pattern is discarded silently, never rejected.

If-None-Matchstring

The ETag a read is conditional on. A match is answered 304 with no body.

Response 200

Returns a page of InvoiceList rows.

dataarray of InvoiceList

The rows, each a InvoiceList.

meta.pagePage

per_page, next_cursor, prev_cursor, total, current_page, last_page.

linksPageLinks

self, next, prev.

Each row is a InvoiceList: 11 fields.

Headers

ETag: A weak validator (W/"…") of the rendered page.
RateLimit: The IETF httpapi-ratelimit-headers form of your remaining allowance on the tightest bucket this request touched.
RateLimit-Policy: The ceiling and window of that bucket, as <limit>;w=<seconds>.
X-Request-Id: The server-generated ULID correlating this response with our logs.

Every response also carries Cache-Control, Vary, X-Content-Type-Options, X-Plnnrly-Api-Version, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset. Headers and versioning