# Public API Endpoints {#public-api-endpoints}


Public endpoints that bypass authentication, providing read-only access to shared resources like public invoices, employee profiles, organizations, and teams.


## Security Notice {#security-notice}


> ⚠️ **Important**: Public endpoints use enum-based whitelists for relations to prevent unauthorized data exposure. Only explicitly allowed relations can be loaded. See [Public Endpoint Data Exposure](https://sourcey-gauzy.pages.dev/security/public-endpoint-data-exposure/index.md) for details.


## Endpoints {#endpoints}



### Public Invoice {#public-invoice}


Retrieve an invoice by a shared token without authentication.

```
GET /api/public/invoice/:id/:token
```

**Query Parameters:**

| Parameter   | Type  | Description                                                                                                                                            |
| ----------- | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `relations` | array | Allowed: `fromOrganization`, `toContact`, `invoiceItems`, `invoiceItems.product`, `invoiceItems.expense`, `invoiceItems.task`, `invoiceItems.employee` |

**Response** `200 OK`:

```json
{
  "id": "uuid",
  "invoiceNumber": "INV-001",
  "totalValue": 5000,
  "currency": "USD",
  "invoiceDate": "2024-01-15",
  "dueDate": "2024-02-15",
  "status": "SENT",
  "fromOrganization": { "name": "My Company" },
  "toContact": { "name": "Client Corp" },
  "invoiceItems": [...]
}
```


### Public Employee {#public-employee}


View a publicly shared employee profile.

```
GET /api/public/employee/:id
```


### Public Organization {#public-organization}


View a publicly shared organization profile.

```
GET /api/public/organization/:profileLink
```


### Public Team {#public-team}


View a publicly shared team.

```
GET /api/public/team/:profileLink
```


## Allowed Relations (Whitelisted) {#allowed-relations-whitelisted}


Each public endpoint has a strict whitelist of allowed relations to prevent information disclosure:

| Endpoint            | Allowed Relations                                                 |
| ------------------- | ----------------------------------------------------------------- |
| Public Invoice      | `fromOrganization`, `toContact`, `invoiceItems`, `invoiceItems.*` |
| Public Employee     | `skills`, `user` (limited fields)                                 |
| Public Organization | `contact`, `skills`, `awards`                                     |
| Public Team         | `members`, `projects`                                             |


## Related Pages {#related-pages}


- [Public Endpoint Data Exposure](https://sourcey-gauzy.pages.dev/security/public-endpoint-data-exposure/index.md) — security analysis
- [Invoice Endpoints](https://sourcey-gauzy.pages.dev/api/invoice-endpoints/index.md) — full invoice API
- [API Security Best Practices](https://sourcey-gauzy.pages.dev/security/api-security-best-practices/index.md) — security patterns