API Reference

REST API

Getting Started Authorization Best Practices

MCP (AI Assistants)

MCP Overview MCP Authentication

General

Status Get Business Identity Get Business Details

Contacts

List Contacts

Jobs

List Jobs

Estimates

List Estimates

Invoices

List Invoices

Offerings

List Offerings

Equipment

List Equipment

Events

List Events

List Invoices

GET https://backend.localbusiness.pro/api/v1/invoices

Returns a paginated list of invoices for the authenticated business, sorted by creation date (newest first).

Header Parameters

X-Public-Key string required

Your business public key. Used to identify which business is making the request.

X-Timestamp string required

Current Unix timestamp in seconds. Requests older than 5 minutes are rejected.

X-Signature string required

HMAC-SHA256 signature of the signing string: {timestamp}\n{METHOD}\n{path}\n{body}, using your private key as the secret.

Query Parameters

page integer

Page number (1-indexed).

per_page integer

Items per page (max 100). Default: 25.

status string

Filter by invoice status (e.g., draft, sent, viewed, paid, overdue, voided).

Responses

200 Paginated list of invoices.

{
  "invoices": [
    {
      "id": "c3d4e5f6-a7b8-9012-cdef-123456789012",
      "invoice_number": "INV-00078",
      "title": "HVAC System Installation - Final Payment",
      "status": "sent",
      "subtotal": "8750.00",
      "discount_type": null,
      "discount_value": null,
      "tax_rate": "8.25",
      "tax_amount": "721.88",
      "total_amount": "9471.88",
      "paid_amount": "0.00",
      "due_at": "2026-04-01T00:00:00.000000Z",
      "issued_at": "2026-03-01T00:00:00.000000Z",
      "sent_at": "2026-03-01T12:30:00.000000Z",
      "paid_at": null,
      "created_at": "2026-03-01T10:00:00.000000Z",
      "updated_at": "2026-03-01T12:30:00.000000Z"
    }
  ],
  "pagination": {
    "current_page": 1,
    "per_page": 25,
    "total_items": 78,
    "total_pages": 4
  }
}

401 Missing credentials, expired timestamp, or invalid signature.

{
  "error": "Invalid API credentials",
  "code": "INVALID_CREDENTIALS"
}

403 Business account exists but is not active.

{
  "error": "Business account is not active",
  "code": "ACCOUNT_INACTIVE"
}

429 Rate limit exceeded (60 requests/minute per key).

{
  "message": "Too Many Attempts."
}

Authentication — HMAC-SHA256

Every authenticated request requires three headers:

X-Public-KeyYour business public key

X-TimestampUnix timestamp (seconds)

X-SignatureHMAC-SHA256 of signing string

Signing string: {timestamp}\n{METHOD}\n{path}\n{body}

Request

GET https://backend.localbusiness.pro/api/v1/invoices

Rate Limits

With X-Public-Key: 60 req/min per key

Without: 10 req/min per IP

Code Examples

PUBLIC_KEY="pk_live_..."
PRIVATE_KEY="sk_live_..."
TIMESTAMP=$(date +%s)
PATH_URI="/api/v1/invoices?status=overdue"

SIGNATURE=$(printf '%s\n%s\n%s\n' "$TIMESTAMP" "GET" "$PATH_URI" \
  | openssl dgst -sha256 -hmac "$PRIVATE_KEY" | awk '{print $2}')

curl -H "X-Public-Key: $PUBLIC_KEY" \
     -H "X-Timestamp: $TIMESTAMP" \
     -H "X-Signature: $SIGNATURE" \
     "https://backend.localbusiness.pro$PATH_URI"

const crypto = require("crypto");

const publicKey = "pk_live_...";
const privateKey = "sk_live_...";
const timestamp = Math.floor(Date.now() / 1000).toString();
const method = "GET";
const path = "/api/v1/invoices?status=overdue";
const body = "";

const signingString = `${timestamp}\n${method}\n${path}\n${body}`;
const signature = crypto
  .createHmac("sha256", privateKey)
  .update(signingString)
  .digest("hex");

const response = await fetch("https://backend.localbusiness.pro/api/v1/invoices?status=overdue", {
  headers: {
    "X-Public-Key": publicKey,
    "X-Timestamp": timestamp,
    "X-Signature": signature,
  },
});

const data = await response.json();
console.log(data);

import hmac, hashlib, time, requests

public_key = "pk_live_..."
private_key = "sk_live_..."
timestamp = str(int(time.time()))
method = "GET"
path = "/api/v1/invoices?status=overdue"
body = ""

signing_string = f"{timestamp}\n{method}\n{path}\n{body}"
signature = hmac.new(
    private_key.encode(), signing_string.encode(), hashlib.sha256
).hexdigest()

response = requests.get(
    "https://backend.localbusiness.pro/api/v1/invoices?status=overdue",
    headers={
        "X-Public-Key": public_key,
        "X-Timestamp": timestamp,
        "X-Signature": signature,
    },
)
print(response.json())

<?php
$publicKey = 'pk_live_...';
$privateKey = 'sk_live_...';
$timestamp = time();
$method = 'GET';
$path = '/api/v1/invoices?status=overdue';
$body = '';

$signingString = $timestamp . "\n" . $method . "\n" . $path . "\n" . $body;
$signature = hash_hmac('sha256', $signingString, $privateKey);

$ch = curl_init('https://backend.localbusiness.pro/api/v1/invoices?status=overdue');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "X-Public-Key: $publicKey",
    "X-Timestamp: $timestamp",
    "X-Signature: $signature",
]);

$response = curl_exec($ch);
curl_close($ch);
print_r(json_decode($response, true));