Conventions

The same rules hold on every endpoint, so once you know them you can read any page of the API reference.

Requests and answersCopy Anchor Link

• Base URL: https://app.skuflow.ai/api.
• Format: JSON in and out. Send Content-Type: application/json with a body.
• Methods: GET reads and never changes anything. POST creates or runs an action, PATCH changes some fields of a record, PUT replaces a setting, DELETE deletes.
• Inputs: path parameters in the URL, everything else in the query string for GET and in the JSON body otherwise. You never send organizationId in the body; it is in the path.
• Partial updates: a PATCH changes only the fields you send. Send null to clear a field that can be empty.
• Request size: up to 40 MB per request. Larger bodies answer 413 PAYLOAD_TOO_LARGE.
• Request id: every answer has an X-Request-Id header. Send your own X-Request-Id to tie your logs to ours, and quote it if you contact support.

MoneyCopy Anchor Link

Money is always an integer number of cents in the business's currency, in fields ending in Cents: totalCents, amountCents, unitPriceCents. 12500 is $125.00. Negative amounts appear where they make sense (discount lines, a customer in credit).

Dates and timesCopy Anchor Link

• Calendar dates (an invoice's due date, an order's in-hands date, report ranges) are strings YYYY-MM-DD in your business's own calendar (its time zone in SKUFlow), not UTC. "Today" means today where your business is.
• Times of day are HH:MM, 24-hour, also in the business's time zone ("09:00").
• Moments (when something was created, sent or paid) are ISO 8601 timestamps in UTC (2026-11-03T15:00:00.000Z), in fields such as createdAt.

Ids and numbersCopy Anchor Link

• Every record has an opaque string id. Store it as text; don't parse it.
• Records people talk about also have a number that is unique in your business: Q-7, INV-40, ORD-12, REQ-3, PAY-9, PO-5, SO-21 (store orders), SHP-4 (shipments). Use the id in API paths.
• Ids you send in a body (a customer, a product, a vendor, a business unit) must belong to your business, or the call is refused.

Hidden and masked fieldsCopy Anchor Link

• Costs and margins are removed from every answer unless your role has costing.read (owners and admins). The field is missing, not zero.
• Sensitive custom fields (account numbers, private notes) read as •••• unless your role may see them and your key has Full access. Reading one value on purpose is its own call, which is logged.

Retry safely with Idempotency-KeyCopy Anchor Link

Network calls fail. To retry a write without doing it twice (a payment recorded twice, two quotes), send an Idempotency-Key header with a unique value per action, such as a UUID:

curl -X POST "https://app.skuflow.ai/api/organizations/$ORGANIZATION_ID/invoices/$INVOICE_ID/payments" \
  -H "Authorization: Bearer $SKUFLOW_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 0b6f2c1e-4d1a-4e8b-9a43-2f6c1d7e8a90" \
  -d '{"amountCents":12500,"method":"CHECK"}'

• The first successful answer is kept for a week. Repeating the call with the same key returns that answer again and does nothing new.
• If the first call failed, nothing is remembered: the retry runs normally.
• The same key on a different endpoint answers 409, and so does a retry while the first call is still running (try again a moment later).
• Keys are per person, up to 200 characters. Reads ignore the header.

RelatedCopy Anchor Link

• Pagination
• Errors
• Authentication