The Zanix API and webhooks

This page isn't translated yet; here it is in English.

Other programs, like an online shop, a delivery app or your own scripts, can work with your Zanix data through the API, and be told about changes through webhooks. A developer can use this page together with the full documentation inside Zanix (your menu → API tokens → API documentation), which always includes your own custom fields.

API tokens

A token lets a program act as you, with exactly your permissions: it sees what you can see and can do what you can do. Open your menu → API tokens → Create token, give it a name (for example "Online shop") and an expiry, and copy the token. It's shown only once.

Keep tokens secret. Revoke any you no longer use. Creating and revoking tokens is recorded in the Security log.

Using the API

Your company's API address is https://<your company>.zanixtechnologies.com/api/v1. Send the token in every request:

Authorization: Bearer <token>
Accept: application/json
Accept-Language: ckb      (or en, ar: messages come back in that language)

Request	Does
`GET /doctypes`	Lists the kinds of records you can see, with their fields
`GET /{type}`	Lists records: `?search=`, `?filter[status]=Paid`, `?filter[posting_date][gte]=2026-01-01`, `?filter[company_id][in]=1,2`, `?sort=-posting_date`, `?per_page=50&page=2`
`GET /{type}/{id}`	One record with its lines
`POST /{type}`	Creates one (JSON body with the fields; lines as a list)
`PATCH /{type}/{id}`	Changes a draft (send only what changes; send a line's `id` to keep it)
`DELETE /{type}/{id}`	Deletes a draft
`POST /{type}/{id}/submit`, `/cancel`, `/amend`	Moves a document through its stages
`GET /{type}/{id}/activity`	Its activity log
`GET /{type}/{id}/attachments`, `POST …/attachments` (file in a `file` field)	Its files
`GET /{type}/{id}/pdf?lang=ar`	The PDF in any language

Amounts are exact decimal text ("1500.250"), dates are YYYY-MM-DD, and links are record ids. Errors use the same clear messages as the screens, per field (for example items.1.qty). Filters and sorting work on fields that have an index, which keeps big lists fast. A program can make up to 120 requests a minute per token.

Webhooks (administrators)

A webhook makes Zanix call another system's address whenever a document is created, changed, submitted, cancelled or deleted. Settings → Webhooks → New:

Give it a name and the receiving address (a public https:// address).
Choose one document type or all, and the events.
Save. The page then shows the signing secret: give it to the receiving system.

Each call is a JSON message with the event, the document type and id, the document's data and, for changes, what changed. The header X-Zanix-Signature: sha256=… is an HMAC-SHA256 of the message made with the secret, so the receiver can check that the call really came from Zanix.

If the receiver is down, Zanix tries again after 1 minute, 5 minutes, 30 minutes and 2 hours. Deliveries at the bottom of the webhook's page lists every call with its result; failed ones can be retried. Send a test checks the connection right away.

For safety, webhooks can only call public internet addresses, never internal ones.