Generated from the API server’s route table. Every route needs a session token (see Authentication) and follows the API conventions. Routes under /api/portal are for supplier users and only ever return that supplier’s own records; all others are for agency staff and check the caller’s permissions on every action. Where a route checks a specific permission before doing anything else, it is named.
Routes outside the table: /api/health, the sign-in routes under /api/auth, /api/session, /api/demo/users, /api/mcp, /api/scim/v2, the inbound channels under /api/inbound, /api/public/bids/<tenant> and /api/admin/export.
363 routes in 72 areas. Jump to: 3D views · Access reviews · Administration · Agents hub · Analytics · Approvals · Audit ledger · Bids · Budgets · Card and early pay · Cases · Catalog · Clause library · Commodity codes · Connected agents (MCP) · Contracts · Current user · Dashboard · Delegations · Documents and capture · E-invoicing · Environmental mandates · Event stream · Expected bills · Expenses · Funds · Funds check · GL coding · Grants · Insights · Integrations · Invoices · My work · Notifications · P-Card · Passkeys · Pay application documents · Pay applications · Payment runs · Payments · Period-end accruals · Plain-words intake · Positions · Price adjustments · Price escalation · Protests · Purchase orders and receipts · Records and legal holds · Reports · Requests · Requirements traceability · Sales and use tax · Saved views · Search · Security events · Sign-in and provisioning · Sourcing · Sourcing workspace · Supplier bank accounts · Supplier campaigns · Supplier compliance · Supplier document requests · Supplier portal · Supplier risk · Supplier scorecards · Supplier statements · Suppliers · Tenant profile · Users · Web Push · Webhooks · Year-end rollover
3D views
| Method | Path | Notes |
GET | /api/visuals/flow | The 3D views: a replay of recent invoices and card charges through every stage, and spend by facility and supplier. |
GET | /api/visuals/spend-map | |
Access reviews
| Method | Path | Notes |
GET | /api/access-reviews | |
POST | /api/access-reviews | |
GET | /api/access-reviews/:id | |
POST | /api/access-reviews/:id/complete | |
POST | /api/access-reviews/:id/decide | |
Administration
| Method | Path | Notes |
GET | /api/admin/roles | |
GET | /api/admin/users | |
POST | /api/admin/users | |
POST | /api/admin/users/:id | |
Agents hub
| Method | Path | Notes |
GET | /api/agent-hub | |
GET | /api/agent-hub/for/:kind/:id | |
POST | /api/agent-hub/proposals/:id | |
POST | /api/agent-hub/run | |
GET | /api/agent-hub/runs/:id | |
Analytics
| Method | Path | Notes |
POST | /api/analytics/ask | |
POST | /api/analytics/query | |
Approvals
| Method | Path | Notes |
GET | /api/approvals/:id/brief | What a phone shows for one approval: the facts, the lines, the document, and whether this person can decide it now. |
POST | /api/approvals/:id/decide | |
POST | /api/approvals/:id/viewed | |
POST | /api/approvals/bulk-decide | |
POST | /api/approvals/timers/run | Needs integration.admin. |
Audit ledger
| Method | Path | Notes |
GET | /api/audit | Needs audit.view. |
GET | /api/audit/verify | Needs audit.view. |
POST | /api/audit/verify | Needs audit.view. |
Bids
| Method | Path | Notes |
POST | /api/bids/:id/scores | |
Budgets
| Method | Path | Notes |
GET | /api/budgets | |
POST | /api/budgets | |
GET | /api/budgets/:id | |
Card and early pay
| Method | Path | Notes |
GET | /api/payment-program | |
POST | /api/payment-program/funding | |
Cases
| Method | Path | Notes |
GET | /api/cases | Needs report.view. |
GET | /api/cases/:id | One case with its comments, the people who can take it, and what the viewer may do. Needs report.view. |
POST | /api/cases/:id/assign | |
POST | /api/cases/:id/comment | |
POST | /api/cases/:id/resolve | |
Catalog
| Method | Path | Notes |
GET | /api/catalog | Needs report.view. |
Clause library
| Method | Path | Notes |
GET | /api/clauses | |
POST | /api/clauses | |
Commodity codes
| Method | Path | Notes |
GET | /api/commodity-codes | |
Connected agents (MCP)
| Method | Path | Notes |
GET | /api/agents | |
POST | /api/agents | |
GET | /api/agents/:id | |
POST | /api/agents/:id | |
POST | /api/agents/:id/tokens | |
POST | /api/agents/:id/tokens/:token/revoke | |
Contracts
| Method | Path | Notes |
GET | /api/contracts | Needs report.view. |
GET | /api/contracts/:id | Needs report.view. |
POST | /api/contracts/:id/amend | |
POST | /api/contracts/:id/clause-review | Needs contract.manage. |
POST | /api/contracts/:id/clauses/:clauseId | |
POST | /api/contracts/:id/clauses/:clauseId/fallback | |
POST | /api/contracts/:id/clauses/:clauseId/refresh | |
POST | /api/contracts/:id/comments | Needs report.view. |
GET | /api/contracts/:id/escalation | Needs report.view. |
POST | /api/contracts/:id/escalation | |
POST | /api/contracts/:id/execute | |
POST | /api/contracts/:id/kpis | |
POST | /api/contracts/:id/kpis/:kid | |
GET | /api/contracts/:id/mandates | Needs report.view. |
POST | /api/contracts/:id/mandates | |
POST | /api/contracts/:id/mandates/:mid/reports | |
POST | /api/contracts/:id/obligations | Needs contract.manage. |
POST | /api/contracts/:id/obligations/:oid | |
POST | /api/contracts/:id/price-adjustments | |
POST | /api/contracts/:id/renewals/decline | |
POST | /api/contracts/:id/renewals/exercise | |
POST | /api/contracts/:id/signature | |
POST | /api/contracts/:id/signature/sign | |
POST | /api/contracts/:id/signature/void | |
POST | /api/contracts/:id/submit | Needs contract.draft. |
Current user
| Method | Path | Notes |
GET | /api/me | |
Dashboard
| Method | Path | Notes |
GET | /api/dashboard | Needs report.view. |
Delegations
| Method | Path | Notes |
GET | /api/delegations | Needs user.admin. |
POST | /api/delegations | |
POST | /api/delegations/:id/revoke | |
Documents and capture
| Method | Path | Notes |
POST | /api/documents | Upload invoice files (PDF, image, EDI, cXML, UBL, email or zip). Each invoice found is entered and matched. Needs invoice.enter. |
GET | /api/documents/:id | |
GET | /api/documents/:id/original | The file as received, base64-encoded so it travels over the JSON API with the caller's token. |
E-invoicing
| Method | Path | Notes |
GET | /api/einvoicing | |
GET | /api/einvoicing/messages/:id | Needs report.view. |
POST | /api/einvoicing/settings | |
POST | /api/einvoicing/suppliers/:id/enroll | |
POST | /api/einvoicing/suppliers/:id/verify | |
POST | /api/einvoicing/sync | Needs invoice.resolve. |
Environmental mandates
| Method | Path | Notes |
GET | /api/mandates | Needs report.view. |
GET | /api/mandates/templates | |
Event stream
| Method | Path | Notes |
GET | /api/events | Needs integration.admin. |
Expected bills
| Method | Path | Notes |
GET | /api/recurring | |
POST | /api/recurring/:id/snooze | |
POST | /api/recurring/refresh | |
Expenses
| Method | Path | Notes |
GET | /api/expenses/policy | |
GET | /api/expenses/reports | Needs expense.submit. |
POST | /api/expenses/reports | |
GET | /api/expenses/reports/:id | |
POST | /api/expenses/reports/:id | |
POST | /api/expenses/reports/:id/lines | |
POST | /api/expenses/reports/:id/lines/:lineId | |
GET | /api/expenses/reports/:id/lines/:lineId/receipt | |
POST | /api/expenses/reports/:id/lines/:lineId/remove | |
POST | /api/expenses/reports/:id/mileage | |
POST | /api/expenses/reports/:id/per-diem | |
POST | /api/expenses/reports/:id/receipts | A photo or PDF of a receipt: read by document intelligence into a new line, or attached to an existing one. |
POST | /api/expenses/reports/:id/reimbursement | A reimbursement made outside the ERP sync: a manual check, or payroll. Needs expense.admin. |
POST | /api/expenses/reports/:id/retry-posting | Needs expense.admin. |
POST | /api/expenses/reports/:id/submit | |
Funds
| Method | Path | Notes |
GET | /api/funds/:kind/:id | What a requisition, PO or invoice holds against budgets, and its funds check. |
Funds check
| Method | Path | Notes |
POST | /api/funds-check | A funds check on lines that are not saved yet, such as a requisition being written. |
GL coding
| Method | Path | Notes |
GET | /api/coding/stats | How well the coding model is doing: share of non-PO lines it coded alone, and how often people kept its suggestions. Needs report.view. |
Grants
| Method | Path | Notes |
GET | /api/grants | |
POST | /api/grants/:id/drawdowns | |
Insights
| Method | Path | Notes |
GET | /api/insights | Needs report.view. |
GET | /api/insights/categories | |
GET | /api/insights/categories/:id | |
GET | /api/insights/category-rules | |
POST | /api/insights/category-rules | |
GET | /api/insights/cycle-times | |
GET | /api/insights/diversity | |
GET | /api/insights/workflow-suggestions | Needs report.view. |
Integrations
| Method | Path | Notes |
GET | /api/integrations | Needs report.view. |
GET | /api/integrations/feeds | Needs audit.view. |
POST | /api/integrations/field-maps | |
POST | /api/integrations/field-maps/preview | |
POST | /api/integrations/field-maps/suggest | |
Invoices
| Method | Path | Notes |
GET | /api/invoices | |
POST | /api/invoices | |
GET | /api/invoices/:id | |
GET | /api/invoices/:id/coding | |
POST | /api/invoices/:id/coding | |
POST | /api/invoices/:id/comments | |
POST | /api/invoices/:id/exceptions/:code/resolve | |
POST | /api/invoices/:id/hold | Needs invoice.resolve. |
POST | /api/invoices/:id/release | Needs invoice.resolve. |
GET | /api/invoices/stats | Headline numbers for the AP queue. |
My work
| Method | Path | Notes |
GET | /api/inbox | |
Notifications
| Method | Path | Notes |
GET | /api/notifications | |
POST | /api/notifications/read | |
P-Card
| Method | Path | Notes |
POST | /api/pcard/audit/sample | Draws this period's audit sample: every flagged charge plus a reproducible random share of the rest. |
GET | /api/pcard/cards | Needs pcard.admin. |
POST | /api/pcard/cards/:id/exceptions | |
POST | /api/pcard/cards/:id/status | |
GET | /api/pcard/feeds | Issuer files: Visa VCF, Mastercard CDF3 or a CSV export, from the bank's SFTP drop or uploaded here. Needs pcard.admin. |
POST | /api/pcard/feeds | Needs pcard.admin. |
POST | /api/pcard/journal | Needs pcard.admin. |
GET | /api/pcard/journal/preview | What the next GL journal would book: approved charges not yet exported, by coding. Needs pcard.admin. |
GET | /api/pcard/transactions | Needs pcard.reconcile. |
GET | /api/pcard/transactions/:id | One card charge with its card, receipt, approval and history. Cardholders see only their own. |
POST | /api/pcard/transactions/:id/audit | |
GET | /api/pcard/transactions/:id/receipt | |
POST | /api/pcard/transactions/:id/receipt | The cardholder uploads a receipt photo or PDF; it is read and checked against the charge. |
POST | /api/pcard/transactions/:id/reconcile | |
GET | /api/pcard/trends | Program trends for the coordinator, approvers and auditors: months, departments, categories, rule hits and a watch list. |
Passkeys
| Method | Path | Notes |
GET | /api/passkeys | |
POST | /api/passkeys/:id/remove | |
POST | /api/passkeys/register/options | |
POST | /api/passkeys/register/verify | |
Pay application documents
| Method | Path | Notes |
GET | /api/pay-app-documents/:id/file | |
Pay applications
| Method | Path | Notes |
GET | /api/pay-apps | |
POST | /api/pay-apps | |
GET | /api/pay-apps/:id | |
POST | /api/pay-apps/:id/certify | |
POST | /api/pay-apps/:id/return | |
Payment runs
| Method | Path | Notes |
GET | /api/payment-runs | |
POST | /api/payment-runs | |
GET | /api/payment-runs/:id | |
POST | /api/payment-runs/:id/cancel | |
GET | /api/payment-runs/:id/files/:kind | The bank files of a released run. ACH files carry account numbers, so only treasury may fetch them. Needs payment.release. |
POST | /api/payment-runs/:id/release | |
POST | /api/payment-runs/:id/submit | Needs payment.prepare. |
GET | /api/payment-runs/preview | What a run on this date would pay, before anything is reserved. Needs payment.prepare. |
Payments
| Method | Path | Notes |
GET | /api/payments | |
POST | /api/payments/:id/return | A bank return (R01 insufficient funds, R03 no account...) reopens the invoices on hold. Needs payment.release. |
Period-end accruals
| Method | Path | Notes |
GET | /api/accruals | Accruals |
POST | /api/accruals/batches | |
GET | /api/accruals/batches/:id | |
GET | /api/accruals/journal.csv | |
Plain-words intake
| Method | Path | Notes |
GET | /api/intake | |
POST | /api/intake | Needs requisition.create. |
GET | /api/intake/:id | |
POST | /api/intake/:id | |
POST | /api/intake/:id/discard | |
POST | /api/intake/:id/submit | |
Positions
| Method | Path | Notes |
GET | /api/positions | |
POST | /api/positions | |
POST | /api/positions/:id/assign | |
Price adjustments
| Method | Path | Notes |
POST | /api/price-adjustments/:id/decide | |
Price escalation
| Method | Path | Notes |
GET | /api/escalation | Price escalation |
POST | /api/escalation/refresh | |
Protests
| Method | Path | Notes |
POST | /api/protests/:id/decide | |
Purchase orders and receipts
| Method | Path | Notes |
GET | /api/purchase-orders | |
GET | /api/purchase-orders/:id | |
GET | /api/purchase-orders/:id/construction | |
POST | /api/purchase-orders/:id/construction | |
POST | /api/purchase-orders/:id/construction/completion | |
POST | /api/purchase-orders/:id/construction/documents | |
POST | /api/purchase-orders/:id/construction/release | |
POST | /api/purchase-orders/:id/receipts | |
Records and legal holds
| Method | Path | Notes |
POST | /api/records/dispositions | |
POST | /api/records/dispositions/:id/approve | |
POST | /api/records/dispositions/:id/cancel | |
GET | /api/records/holds | |
POST | /api/records/holds | |
POST | /api/records/holds/:id/release | |
GET | /api/records/retention | |
Reports
| Method | Path | Notes |
GET | /api/reports/ap-cycle | AP cycle times, touchless rate and approval aging for the reporting dashboard. |
GET | /api/reports/board-pack | Needs report.view. |
GET | /api/reports/diversity | Needs report.view. |
GET | /api/reports/expense-register | Needs report.view. |
Requests
| Method | Path | Notes |
GET | /api/requisitions | |
POST | /api/requisitions | |
GET | /api/requisitions/:id | |
POST | /api/requisitions/:id/comments | |
POST | /api/requisitions/:id/convert | |
GET | /api/requisitions/:id/sourcing | The requester's way in: the sourcing events raised from their request, with each one's workspace. |
POST | /api/requisitions/:id/submit | |
POST | /api/requisitions/catalog | A request made from catalog items: prices come from the catalog and the contract. |
Requirements traceability
| Method | Path | Notes |
GET | /api/rtm | Needs report.view. |
Sales and use tax
| Method | Path | Notes |
GET | /api/tax | Needs report.view. |
GET | /api/tax/1099 | |
POST | /api/tax/1099/iris | |
POST | /api/tax/1099/payer | |
Saved views
| Method | Path | Notes |
GET | /api/views | |
POST | /api/views | |
POST | /api/views/:id/delete | |
Search
| Method | Path | Notes |
GET | /api/search | |
Security events
| Method | Path | Notes |
GET | /api/security/events | Needs audit.view. |
Sign-in and provisioning
| Method | Path | Notes |
GET | /api/identity | |
GET | /api/identity/group-roles | |
POST | /api/identity/group-roles | |
POST | /api/identity/scim-tokens | |
POST | /api/identity/scim-tokens/:id/revoke | |
Sourcing
| Method | Path | Notes |
GET | /api/solicitations | Needs evaluation.score. |
POST | /api/solicitations | |
GET | /api/solicitations/:id | |
POST | /api/solicitations/:id/addenda | |
GET | /api/solicitations/:id/auction | |
POST | /api/solicitations/:id/auction | |
POST | /api/solicitations/:id/auction/close | |
POST | /api/solicitations/:id/coi | |
POST | /api/solicitations/:id/contract | |
GET | /api/solicitations/:id/distribution | |
POST | /api/solicitations/:id/distribution/retry | Needs solicitation.publish. |
POST | /api/solicitations/:id/evaluators | |
POST | /api/solicitations/:id/finalize | Needs award.recommend. |
GET | /api/solicitations/:id/lines | |
GET | /api/solicitations/:id/negotiation | |
POST | /api/solicitations/:id/negotiation | |
POST | /api/solicitations/:id/negotiation/bafo | |
POST | /api/solicitations/:id/negotiation/close | |
POST | /api/solicitations/:id/negotiation/messages | |
POST | /api/solicitations/:id/notice | Needs award.recommend. |
POST | /api/solicitations/:id/open | Public opening needs two officials. The first asks to open; a different official with bid.open confirms as witness, and only then are the envelopes unsealed. Needs bid.open. |
POST | /api/solicitations/:id/plan-holders | |
POST | /api/solicitations/:id/publish | |
POST | /api/solicitations/:id/questions/:qid/answer | |
POST | /api/solicitations/:id/recommend | |
POST | /api/solicitations/:id/rfi/close | |
GET | /api/solicitations/:id/workspace | |
POST | /api/solicitations/:id/workspace/posts | |
POST | /api/solicitations/:id/workspace/tasks | |
POST | /api/solicitations/:id/workspace/tasks/:taskId/done | |
Sourcing workspace
| Method | Path | Notes |
GET | /api/workspace/mine | |
Supplier bank accounts
| Method | Path | Notes |
GET | /api/bank-accounts | Bank accounts that need a decision or are on watch: changes waiting for callback, failed checks, prenotes out. |
POST | /api/bank-accounts/prenotes | Needs payment.prepare. |
GET | /api/bank-accounts/prenotes/:id/file | Needs payment.prepare. |
Supplier campaigns
| Method | Path | Notes |
GET | /api/campaigns | |
POST | /api/campaigns | |
GET | /api/campaigns/:id | |
POST | /api/campaigns/:id/close | |
POST | /api/campaigns/:id/remind | |
POST | /api/campaigns/:id/send | |
POST | /api/campaigns/audience | |
Supplier compliance
| Method | Path | Notes |
GET | /api/supplier-compliance | Every compliance issue across suppliers: the vendor admin's work list. |
Supplier document requests
| Method | Path | Notes |
POST | /api/supplier-requests/:id/close | |
Supplier portal
| Method | Path | Notes |
GET | /api/portal/auctions | |
POST | /api/portal/auctions/:solId/bids | |
POST | /api/portal/bank-accounts | |
GET | /api/portal/bids | |
POST | /api/portal/bids/:id/withdraw | |
GET | /api/portal/campaigns | |
POST | /api/portal/campaigns/:id/acknowledge | |
POST | /api/portal/campaigns/:id/read | |
POST | /api/portal/certifications | |
GET | /api/portal/commodities | |
POST | /api/portal/commodities | |
GET | /api/portal/compliance | |
GET | /api/portal/contracts | |
GET | /api/portal/contracts/:id | |
POST | /api/portal/contracts/:id/decline | |
GET | /api/portal/contracts/:id/mandates | |
POST | /api/portal/contracts/:id/mandates/:mid/reports | |
POST | /api/portal/contracts/:id/sign | |
POST | /api/portal/early-pay/:id/accept | |
POST | /api/portal/early-pay/:id/decline | |
GET | /api/portal/einvoicing | |
POST | /api/portal/einvoicing | |
POST | /api/portal/insurance | |
GET | /api/portal/invoices | |
POST | /api/portal/invoices | |
GET | /api/portal/invoices/:id | |
GET | /api/portal/invoices/:id/early-pay | |
POST | /api/portal/invoices/:id/early-pay/quote | |
POST | /api/portal/invoices/:id/reply | |
GET | /api/portal/me | |
GET | /api/portal/negotiations | |
POST | /api/portal/negotiations/:solId/bafo | |
POST | /api/portal/negotiations/:solId/messages | |
GET | /api/portal/opportunities | |
GET | /api/portal/pay-apps | |
POST | /api/portal/pay-apps | |
GET | /api/portal/payments | |
POST | /api/portal/profile | |
GET | /api/portal/purchase-orders | |
GET | /api/portal/purchase-orders/:id | |
POST | /api/portal/purchase-orders/:id/acknowledge | |
POST | /api/portal/purchase-orders/:id/pay-app-documents | |
POST | /api/portal/solicitations/:id/bids | |
POST | /api/portal/solicitations/:id/follow | |
POST | /api/portal/solicitations/:id/questions | |
Supplier risk
| Method | Path | Notes |
GET | /api/risk-signals | The vendor team's watch list: every finding that is not clear, plus checks that failed. |
POST | /api/risk-signals/run | Needs vendor.maintain. |
Supplier scorecards
| Method | Path | Notes |
GET | /api/supplier-scorecards | |
Supplier statements
| Method | Path | Notes |
GET | /api/statements | |
POST | /api/statements | A statement keyed in, uploaded as CSV, or read from a statement PDF already in the document inbox. |
GET | /api/statements/:id | |
POST | /api/statements/:id/ask-supplier | |
POST | /api/statements/:id/lines/:lineNo/resolve | |
POST | /api/statements/:id/rerun | |
Suppliers
| Method | Path | Notes |
GET | /api/suppliers | Needs report.view. |
GET | /api/suppliers/:id | Needs report.view. |
POST | /api/suppliers/:id/bank-accounts/:bid/ownership-check | |
POST | /api/suppliers/:id/bank-accounts/:bid/prenote-return | Needs payment.prepare. |
POST | /api/suppliers/:id/bank-accounts/:bid/verify | |
POST | /api/suppliers/:id/card-acceptance | |
POST | /api/suppliers/:id/certifications/verify | |
GET | /api/suppliers/:id/compliance | |
POST | /api/suppliers/:id/insurance | Needs vendor.maintain. |
POST | /api/suppliers/:id/insurance/review | |
POST | /api/suppliers/:id/requests | Needs vendor.maintain. |
POST | /api/suppliers/:id/reviews | |
GET | /api/suppliers/:id/scorecard | |
GET | /api/suppliers/:id/signals | |
POST | /api/suppliers/:id/signals/:kind/dismiss | |
POST | /api/suppliers/:id/signals/screen | |
GET | /api/suppliers/:id/summary | Needs report.view. |
Tenant profile
| Method | Path | Notes |
GET | /api/tenant/assets | |
GET | /api/tenant/geo | |
GET | /api/tenant/profile | The pitch tenants' profile (sites, storylines, synthetic-data notice), supplier locations and asset tree, for maps and visuals. |
Users
| Method | Path | Notes |
GET | /api/users | People who hold a permission, for pickers such as an evaluation panel. Names only. |
Web Push
| Method | Path | Notes |
GET | /api/push/key | |
GET | /api/push/subscriptions | |
POST | /api/push/subscriptions | |
POST | /api/push/subscriptions/remove | |
POST | /api/push/test | |
Webhooks
| Method | Path | Notes |
GET | /api/webhooks | |
POST | /api/webhooks | |
GET | /api/webhooks/:id | |
POST | /api/webhooks/:id | |
POST | /api/webhooks/:id/delete | |
POST | /api/webhooks/deliver | |
Year-end rollover
| Method | Path | Notes |
GET | /api/budgets-rollover | |
POST | /api/budgets-rollover | |