REST API

ERP DLM exposes a complete REST API under the /api prefix. The interactive reference is available at Swagger: https://erp.ovlicuo.com/api/docs.

Authentication

User JWT

Most endpoints require a JWT token obtained after login:

curl -X POST https://erp.ovlicuo.com/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"admin@erpdlm.com","password":"admin"}'

Response:

{
  "access_token": "eyJ...",
  "refresh_token": "eyJ...",
  "expires_in": 1800
}

Use the token on every request:

curl https://erp.ovlicuo.com/api/agents \
  -H "Authorization: Bearer eyJ..."

API tokens (api_tokens)

For external integrations or the MCP server you can create API tokens with scopes:

• api_tokens.key_hash stores the SHA-256 hash of the token.
• api_tokens.company_id restricts the token to one company in multi-tenant environments.
• api_access.resource_name defines the scope (api_access, mcp, mcp:invoices, etc.).

The token is sent as Authorization: Bearer <token>.

Routing conventions

• All endpoints start with /api.
• Auto-discovered modules are mounted at /api/{hyphenated-name}.
• Never include /api twice; internal APIRouter routes use prefix="".

Module	Real prefix
sales	/api/sales
purchases	/api/purchases
accounting	/api/accounting
treasury	/api/treasury
clients	/api/clients
products	/api/products
bank_reconciliation	/api/bank-reconciliation (manual registration)

Endpoint examples

Sales (/api/sales)

Method	Route	Description
GET	/api/sales/estimates	List estimates
POST	/api/sales/estimates	Create estimate
PATCH	/api/sales/estimates/{id}	Update estimate
POST	/api/sales/estimates/{id}/convert-to-order	Convert to order
GET	/api/sales/orders	List orders
GET	/api/sales/delivery-notes	List delivery notes
GET	/api/sales/invoices	List sales invoices
POST	/api/sales/invoices	Create sales invoice
POST	/api/sales/invoices/{id}/generate-accounting-entry	Generate accounting entry
GET	/api/sales/invoices/{id}/pdf	Download PDF
GET	/api/sales/reports/modelo-347	Modelo 347 (sales)

Purchases (/api/purchases)

Method	Route	Description
GET	/api/purchases/estimates	List purchase estimates
POST	/api/purchases/orders	Create purchase order
GET	/api/purchases/delivery-notes	List purchase delivery notes
GET	/api/purchases/invoices	List purchase invoices
POST	/api/purchases/invoices/{id}/approve	Approve purchase invoice
POST	/api/purchases/invoices/{id}/reject	Reject purchase invoice

Accounting (/api/accounting)

Method	Route	Description
GET	/api/accounting/fiscal-years	Fiscal years
GET	/api/accounting/journals	Journals
GET	/api/accounting/accounts	Chart of accounts
GET	/api/accounting/subaccounts	Subaccounts
GET	/api/accounting/entries	Accounting entries
POST	/api/accounting/entries	Create entry
GET	/api/accounting/entries/{id}	Entry detail

Treasury (/api/treasury)

Method	Route	Description
GET	/api/treasury/customer-receipts	Customer receipts
POST	/api/treasury/customer-receipts	Create receipt
GET	/api/treasury/supplier-payments	Supplier payments
GET	/api/treasury/budgets	Treasury budgets

Pagination and filtering

Most list endpoints return an object with this shape:

{
  "data": [...],
  "total": 142,
  "skip": 0,
  "limit": 50
}

Common parameters:

Parameter	Type	Description
skip	integer	Offset (default 0)
limit	integer	Page size (default 50, max 10000)
search	string	Text search
include_inactive	boolean	Include inactive records

Example:

curl "https://erp.ovlicuo.com/api/agents?search=pedro&limit=10&skip=0" \
  -H "Authorization: Bearer eyJ..."

CORS and environments

The backend allows origins configured in backend/app/core/config.py:

CORS_ORIGINS = [
    "http://localhost:5173",
    "http://localhost:42210",
    "https://erp.ovlicuo.com",
]

For production, add your domain in the corresponding .env.

Multi-tenant

In SaaS environments always send the correct Host (e.g. acme-sl.erp.ovlicuo.com). The backend routes the request to the tenant database; a token with company_id further restricts results to one company within that database.