Companies API

POST /companies

Create Company

Create a new company linked to the current user. Returns JWT scoped to new company.

Request body

Responses

Example

curl -X POST http://localhost:8000/companies \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

GET /companies/commercial-state

Commercial State

Return the live commercial state the API process holds from the relay WS push, for the separate UI process to read over an authenticated seam. The UI runs in its own process and cannot see these in-process globals, so it reads them here. Gated at the same permission as the settings pages that consume it, so tab visibility stays consistent with page access. Only non-secret entitlement fields are returned; the co-resident config secrets are never read by this path.

Responses

Example

curl -X GET http://localhost:8000/companies/commercial-state \
  -H "Authorization: Bearer $TOKEN"

POST /companies/import/batch

Batch Import Settings

Request body

Responses

Example

curl -X POST http://localhost:8000/companies/import/batch \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

GET /companies/me

Me

Responses

Example

curl -X GET http://localhost:8000/companies/me \
  -H "Authorization: Bearer $TOKEN"

PATCH /companies/me

Patch Me

Request body

Responses

Example

curl -X PATCH http://localhost:8000/companies/me \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

DELETE /companies/me

Deactivate Company

Soft-delete the current company. Sets is_active=False. Admin only. Does not delete any data. All records (ledger, documents, users) are preserved. Use POST /me/reactivate to restore.

Responses

Example

curl -X DELETE http://localhost:8000/companies/me \
  -H "Authorization: Bearer $TOKEN"

GET /companies/me/base-price-list

Get Base Price List

Responses

Example

curl -X GET http://localhost:8000/companies/me/base-price-list \
  -H "Authorization: Bearer $TOKEN"

PATCH /companies/me/base-price-list

Patch Base Price List

Request body

Responses

Example

curl -X PATCH http://localhost:8000/companies/me/base-price-list \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

POST /companies/me/categories

Create Category

Request body

object

Responses

Example

curl -X POST http://localhost:8000/companies/me/categories \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

PATCH /companies/me/categories/{category_key}

Rename Category

Parameters

Request body

object

Responses

Example

curl -X PATCH http://localhost:8000/companies/me/categories/:category_key \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

DELETE /companies/me/categories/{category_key}

Delete Category

Parameters

Responses

Example

curl -X DELETE http://localhost:8000/companies/me/categories/:category_key \
  -H "Authorization: Bearer $TOKEN"

GET /companies/me/category-display-names

Get Category Display Names

Return display names keyed by category slug.

Responses

Example

curl -X GET http://localhost:8000/companies/me/category-display-names \
  -H "Authorization: Bearer $TOKEN"

GET /companies/me/category-schema/{category}

Get Category Schema

Parameters

Responses

Example

curl -X GET http://localhost:8000/companies/me/category-schema/:category \
  -H "Authorization: Bearer $TOKEN"

PATCH /companies/me/category-schema/{category}

Patch Category Schema

Parameters

Request body

Responses

Example

curl -X PATCH http://localhost:8000/companies/me/category-schema/:category \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

GET /companies/me/category-schemas

Get All Category Schemas

Return all category schemas keyed by category name. Merges module-contributed defaults (category_schema slot) with company overrides. Company overrides take precedence.

Responses

Example

curl -X GET http://localhost:8000/companies/me/category-schemas \
  -H "Authorization: Bearer $TOKEN"

GET /companies/me/column-prefs

Get Column Prefs

Return column visibility prefs keyed by category or '__all__'.

Responses

Example

curl -X GET http://localhost:8000/companies/me/column-prefs \
  -H "Authorization: Bearer $TOKEN"

PATCH /companies/me/column-prefs

Patch Column Prefs

Merge column visibility prefs. Any user (not admin-only) can save their view prefs.

Request body

Responses

Example

curl -X PATCH http://localhost:8000/companies/me/column-prefs \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

GET /companies/me/company-category-schemas

Get Company Category Schemas

Return only company-level category schemas (no module defaults). Used to determine which categories the user explicitly applied.

Responses

Example

curl -X GET http://localhost:8000/companies/me/company-category-schemas \
  -H "Authorization: Bearer $TOKEN"

GET /companies/me/contact-defaults

Get Contact Defaults

Responses

Example

curl -X GET http://localhost:8000/companies/me/contact-defaults \
  -H "Authorization: Bearer $TOKEN"

PATCH /companies/me/contact-defaults

Patch Contact Defaults

Request body

Responses

Example

curl -X PATCH http://localhost:8000/companies/me/contact-defaults \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

GET /companies/me/contact-tags

Get Contact Tags

Responses

Example

curl -X GET http://localhost:8000/companies/me/contact-tags \
  -H "Authorization: Bearer $TOKEN"

PATCH /companies/me/contact-tags

Patch Contact Tags

Request body

Responses

Example

curl -X PATCH http://localhost:8000/companies/me/contact-tags \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

GET /companies/me/default-price-list

Get Default Price List

Responses

Example

curl -X GET http://localhost:8000/companies/me/default-price-list \
  -H "Authorization: Bearer $TOKEN"

PATCH /companies/me/default-price-list

Patch Default Price List

Request body

Responses

Example

curl -X PATCH http://localhost:8000/companies/me/default-price-list \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

POST /companies/me/demo/reseed

Reseed Demo Items

Re-seed demo items using the company's current vertical setting. Wipes all existing demo items (ledger + projections) before seeding so that a vertical change replaces, rather than appends to, the previous demo set. `vertical` query param overrides the DB lookup (used by setup wizard to avoid a race between the settings PATCH and this call).

Parameters

Responses

Example

curl -X POST http://localhost:8000/companies/me/demo/reseed \
  -H "Authorization: Bearer $TOKEN"

GET /companies/me/item-schema

Get Item Schema

Responses

Example

curl -X GET http://localhost:8000/companies/me/item-schema \
  -H "Authorization: Bearer $TOKEN"

PATCH /companies/me/item-schema

Patch Item Schema

Request body

Responses

Example

curl -X PATCH http://localhost:8000/companies/me/item-schema \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

GET /companies/me/locations

List Locations

Responses

Example

curl -X GET http://localhost:8000/companies/me/locations \
  -H "Authorization: Bearer $TOKEN"

POST /companies/me/locations

Create Location

Request body

Responses

Example

curl -X POST http://localhost:8000/companies/me/locations \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

POST /companies/me/locations/import/batch

Import Locations Batch

Request body

Responses

Example

curl -X POST http://localhost:8000/companies/me/locations/import/batch \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

PATCH /companies/me/locations/{location_id}

Patch Location

Parameters

Request body

Responses

Example

curl -X PATCH http://localhost:8000/companies/me/locations/:location_id \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

DELETE /companies/me/locations/{location_id}

Delete Location

Parameters

Responses

Example

curl -X DELETE http://localhost:8000/companies/me/locations/:location_id \
  -H "Authorization: Bearer $TOKEN"

GET /companies/me/modules

List Modules

List all installed modules with their enabled state. Returns installed modules from the module directory, annotated with whether each is currently enabled in company settings. Loaded (runtime) modules are also flagged as running=True.

Responses

Example

curl -X GET http://localhost:8000/companies/me/modules \
  -H "Authorization: Bearer $TOKEN"

POST /companies/me/modules/buy

Buy Module

Start a purchase: ask the relay for a Stripe Checkout URL for this module. The UI opens it in the browser, then polls the license. Admin only.

Request body

Responses

Example

curl -X POST http://localhost:8000/companies/me/modules/buy \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

POST /companies/me/modules/import

Import Module Upload

Install a module package from an uploaded .zip archive. Admin only. Validation and installation share one code path with every other way a module package arrives (celerp.modules.importer), so the security posture cannot drift between surfaces. The module lands DISABLED; enabling and restarting are separate, deliberate steps in the modules UI. `source` records provenance in the module's sidecar (defaults to a plain sideload); the community-import surface passes "community".

Responses

Example

curl -X POST http://localhost:8000/companies/me/modules/import \
  -H "Authorization: Bearer $TOKEN"

POST /companies/me/modules/import-path

Import Module From Path

Install a module from a local folder path (desktop folder picker). Admin only. The API runs on the user's own machine in desktop mode, so a path is the natural handoff from the native folder picker. Same importer core as the zip upload.

Request body

Responses

Example

curl -X POST http://localhost:8000/companies/me/modules/import-path \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

GET /companies/me/modules/licenses

Module Licenses

Slugs this instance holds an active license for (for buy/install CTAs).

Responses

Example

curl -X GET http://localhost:8000/companies/me/modules/licenses \
  -H "Authorization: Bearer $TOKEN"

POST /companies/me/modules/marketplace-download

Marketplace Download

Stage a marketplace module for install: fetch it from the relay and hold the archive on disk, ready for a following Install. Admin only. The relay enforces the gates at token issuance: a paid module needs an active license, third-party code needs a passed security scan. Never-stuck by design: every Download requests a FRESH one-time token, so any failure - relay down, download interrupted - is fully recoverable by clicking Download again. The bytes land in the staging area only; nothing is installed until Install.

Request body

Responses

Example

curl -X POST http://localhost:8000/companies/me/modules/marketplace-download \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

POST /companies/me/modules/marketplace-install

Marketplace Install

Install a staged marketplace module through the shared importer. Admin only. Reads the archive Download staged (and the trust flags the server recorded beside it) and installs it exactly like every other module package. The module lands DISABLED; enabling and restarting are the same deliberate steps in the Installed tab that a community module uses - the two tabs behave the same way once the package is on disk. A name mismatch is rejected and nothing is left behind, so Install can always be retried.

Request body

Responses

Example

curl -X POST http://localhost:8000/companies/me/modules/marketplace-install \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

POST /companies/me/modules/{module_name}/delete

Delete Module

Delete a disabled, non-default module, freeing its name for re-import. Admin only. Refused for default modules (bundled, undeletable) and for any module that is still enabled or running - a running module is disabled first, from the same row. Removing the folder frees the name so the same package can be imported again later.

Parameters

Responses

Example

curl -X POST http://localhost:8000/companies/me/modules/:module_name/delete \
  -H "Authorization: Bearer $TOKEN"

POST /companies/me/modules/{module_name}/disable

Disable Module

Disable a module. Requires admin. A restart is required for changes to take effect.

Parameters

Responses

Example

curl -X POST http://localhost:8000/companies/me/modules/:module_name/disable \
  -H "Authorization: Bearer $TOKEN"

POST /companies/me/modules/{module_name}/enable

Enable Module

Enable a module. Requires admin. A restart is required for changes to take effect.

Parameters

Responses

Example

curl -X POST http://localhost:8000/companies/me/modules/:module_name/enable \
  -H "Authorization: Bearer $TOKEN"

POST /companies/me/modules/{module_name}/purge-data

Purge Module Data

Drop every table carrying the module's declared prefix, in one transaction. Admin only. Refused while the module is still enabled or running: its data must be quiet before it is dropped, so the admin disables and restarts first, from the same row. The drop list is re-derived from the manifest prefix server-side; no client-sent preview is trusted. A module with no matching tables is a clean no-op success. A table outside the module still depending on one of these tables blocks the whole drop, which rolls back with a plain explanation. Deleting the module folder is a separate action and does not touch these tables.

Parameters

Responses

Example

curl -X POST http://localhost:8000/companies/me/modules/:module_name/purge-data \
  -H "Authorization: Bearer $TOKEN"

GET /companies/me/payment-terms

Get Payment Terms

Responses

Example

curl -X GET http://localhost:8000/companies/me/payment-terms \
  -H "Authorization: Bearer $TOKEN"

PATCH /companies/me/payment-terms

Patch Payment Terms

Request body

Responses

Example

curl -X PATCH http://localhost:8000/companies/me/payment-terms \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

POST /companies/me/payment-terms/import/batch

Import Payment Terms Batch

Batch import payment terms into company.settings.payment_terms. Deterministic behavior: - Key: name - If name exists (case-insensitive): skipped - Else: created

Request body

Responses

Example

curl -X POST http://localhost:8000/companies/me/payment-terms/import/batch \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

GET /companies/me/price-lists

Get Price Lists

Responses

Example

curl -X GET http://localhost:8000/companies/me/price-lists \
  -H "Authorization: Bearer $TOKEN"

PATCH /companies/me/price-lists

Patch Price Lists

Request body

Responses

Example

curl -X PATCH http://localhost:8000/companies/me/price-lists \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

GET /companies/me/purchasing-payment-terms

Get Purchasing Payment Terms

Responses

Example

curl -X GET http://localhost:8000/companies/me/purchasing-payment-terms \
  -H "Authorization: Bearer $TOKEN"

PATCH /companies/me/purchasing-payment-terms

Patch Purchasing Payment Terms

Request body

Responses

Example

curl -X PATCH http://localhost:8000/companies/me/purchasing-payment-terms \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

POST /companies/me/purchasing-payment-terms/import/batch

Import Purchasing Payment Terms Batch

Request body

Responses

Example

curl -X POST http://localhost:8000/companies/me/purchasing-payment-terms/import/batch \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

GET /companies/me/purchasing-taxes

Get Purchasing Taxes

Responses

Example

curl -X GET http://localhost:8000/companies/me/purchasing-taxes \
  -H "Authorization: Bearer $TOKEN"

PATCH /companies/me/purchasing-taxes

Patch Purchasing Taxes

Request body

Responses

Example

curl -X PATCH http://localhost:8000/companies/me/purchasing-taxes \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

POST /companies/me/purchasing-taxes/import/batch

Import Purchasing Taxes Batch

Request body

Responses

Example

curl -X POST http://localhost:8000/companies/me/purchasing-taxes/import/batch \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

POST /companies/me/reactivate

Reactivate Company

Reactivate a previously deactivated company. Admin only.

Responses

Example

curl -X POST http://localhost:8000/companies/me/reactivate \
  -H "Authorization: Bearer $TOKEN"

PATCH /companies/me/role-permissions

Patch Role Permissions

Toggle one (permission, role) cell from the matrix. Owner-only (manage_permissions is a fixed owner row, so no owner can revoke their own ability to edit permissions). A toggle names a (permission, role) cell and whether that role should now hold the permission; only that role's membership changes - every other role keeps the grant it already had.

Request body

Responses

Example

curl -X PATCH http://localhost:8000/companies/me/role-permissions \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

GET /companies/me/taxes

Get Taxes

Responses

Example

curl -X GET http://localhost:8000/companies/me/taxes \
  -H "Authorization: Bearer $TOKEN"

PATCH /companies/me/taxes

Patch Taxes

Request body

Responses

Example

curl -X PATCH http://localhost:8000/companies/me/taxes \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

POST /companies/me/taxes/import/batch

Import Taxes Batch

Batch import tax rates into company.settings.taxes. Deterministic behavior: - Key: name - If name exists (case-insensitive): skipped - Else: created NOTE: This remains the legacy settings-import format (records are raw dicts).

Request body

Responses

Example

curl -X POST http://localhost:8000/companies/me/taxes/import/batch \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

GET /companies/me/terms-conditions

Get Terms Conditions

Responses

Example

curl -X GET http://localhost:8000/companies/me/terms-conditions \
  -H "Authorization: Bearer $TOKEN"

PATCH /companies/me/terms-conditions

Patch Terms Conditions

Request body

Responses

Example

curl -X PATCH http://localhost:8000/companies/me/terms-conditions \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

GET /companies/me/units

Get Units

Responses

Example

curl -X GET http://localhost:8000/companies/me/units \
  -H "Authorization: Bearer $TOKEN"

PUT /companies/me/units

Put Units

Request body

Responses

Example

curl -X PUT http://localhost:8000/companies/me/units \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

GET /companies/me/users

List Users

Responses

Example

curl -X GET http://localhost:8000/companies/me/users \
  -H "Authorization: Bearer $TOKEN"

POST /companies/me/users

Create User

Request body

Responses

Example

curl -X POST http://localhost:8000/companies/me/users \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

PATCH /companies/me/users/{user_id}

Patch User

Parameters

Request body

Responses

Example

curl -X PATCH http://localhost:8000/companies/me/users/:user_id \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ ... }'