Finance and partners

Financial operations use an authenticated admin session. A finance:read token permits only selected vendor and affiliate reads; it does not grant access to invoices, credit notes, settlements, refunds, or credential management.

Invoices

Use the returned invoice ID for later operations. Finalization is a business operation with numbering and accounting effects, rather than a cosmetic status edit.

Credit notes

Create a credit note with POST /api/admin/invoices/:id/credit-note. List with GET /api/admin/credit-notes, finalize with POST /api/admin/credit-notes/:id/finalize, and retrieve the PDF at GET /api/admin/credit-notes/:id/pdf.

SevDesk

Credential setup uses POST /api/admin/credentials/sevdesk/connect; connection checks use POST /api/admin/credentials/test/sevdesk. Per-order actions include POST /api/admin/orders/:id/sevdesk-retry and POST /api/admin/orders/:id/sevdesk-cancel.

These endpoints depend on the configured accounting integration and order state. They are blocked for API tokens, including tokens with finance:read.

Vendors

Administrative reads include /api/admin/vendors, /api/admin/vendors/:id, /api/admin/vendor-earnings, and /api/admin/vendor-analytics. These are among the finance:read routes.

Invitations use POST /api/admin/vendors/invite. Commission-rule changes use POST /api/admin/vendors/:id/commission-rule. Both require an authorized admin session.

Vendor earnings

GET /api/admin/vendor-earnings reads earnings. POST /api/admin/vendor-earnings/release releases them through the administrative workflow; a read token cannot perform that action.

Vendor payouts

GET and POST /api/admin/vendor-payouts list and create payouts. Processing and marking paid use POST /api/admin/vendor-payouts/:id/process and /:id/mark-paid.

The current hard-deny policy blocks the collection path even for GET with a token. Use a session to list payouts despite its presence in the read allowlist.

Vendor statements

Use GET and POST /api/admin/vendor-statements, GET /api/admin/vendor-statements/:id, and POST /api/admin/vendor-statements/:id/finalize. These accounting routes require a session.

Vendor portal

Partner sessions use /api/vendor/me, /api/vendor/dashboard, /api/vendor/products, /api/vendor/orders, /api/vendor/earnings, /api/vendor/ledger, /api/vendor/payouts, and /api/vendor/statements for self-service reads.

Affiliates

Admin reads include /api/admin/affiliates, /api/admin/affiliates/:id, /api/admin/affiliate-earnings, and /api/admin/affiliate-payouts. The token policy allows these with finance:read.

Create affiliates with POST /api/admin/affiliates, invite with POST /api/admin/affiliates/invite, and update with PATCH /api/admin/affiliates/:id using an admin session.

Affiliate earnings and payouts

Release earnings through POST /api/admin/affiliate-earnings/release. Administrative payout actions are POST /api/admin/affiliate-payouts/:id/mark-paid and /:id/cancel. Financial mutations are unavailable to API tokens.

Affiliate portal

Affiliate sessions use /api/affiliate/me, /api/affiliate/earnings, /api/affiliate/payouts, and /api/affiliate/content. A payout request is POST /api/affiliate/payouts/request.