📡 API Reference
Public API Endpoints
Public endpoints that bypass authentication, providing read-only access to shared resources like public invoices, employee profiles, organizations, and teams.
Security Notice
⚠️ Important: Public endpoints use enum-based whitelists for relations to prevent unauthorized data exposure. Only explicitly allowed relations can be loaded. See Public Endpoint Data Exposure for details.
Endpoints
Public Invoice
Retrieve an invoice by a shared token without authentication.
GET /api/public/invoice/:id/:tokenQuery Parameters:
| Parameter | Type | Description |
|---|---|---|
relations | array | Allowed: fromOrganization, toContact, invoiceItems, invoiceItems.product, invoiceItems.expense, invoiceItems.task, invoiceItems.employee |
Response 200 OK:
{
"id": "uuid",
"invoiceNumber": "INV-001",
"totalValue": 5000,
"currency": "USD",
"invoiceDate": "2024-01-15",
"dueDate": "2024-02-15",
"status": "SENT",
"fromOrganization": { "name": "My Company" },
"toContact": { "name": "Client Corp" },
"invoiceItems": [...]
}Public Employee
View a publicly shared employee profile.
GET /api/public/employee/:idPublic Organization
View a publicly shared organization profile.
GET /api/public/organization/:profileLinkPublic Team
View a publicly shared team.
GET /api/public/team/:profileLinkAllowed Relations (Whitelisted)
Each public endpoint has a strict whitelist of allowed relations to prevent information disclosure:
| Endpoint | Allowed Relations |
|---|---|
| Public Invoice | fromOrganization, toContact, invoiceItems, invoiceItems.* |
| Public Employee | skills, user (limited fields) |
| Public Organization | contact, skills, awards |
| Public Team | members, projects |
Related Pages
- Public Endpoint Data Exposure — security analysis
- Invoice Endpoints — full invoice API
- API Security Best Practices — security patterns