API Reference

Every Orbit instance — cloud or self-hosted — exposes a stable, curated public API for external integrations, separate from the full internal API the Orbit web app itself calls.

Base URL

Your own instance’s domain, e.g. https://orbit.kuzium.com on Orbit Cloud, or your own domain if self-hosted (e.g. https://orbit.example-corp.com) — the public API spec always advertises the instance’s own real domain, not a shared one.

Authentication

Generate a key from Settings → API Keys → Create. The raw key is shown exactly once at creation — copy it immediately, since it can’t be revealed again afterward (only revoked and replaced with a new one).

Send it on every request as:

X-Api-Key: <your key>

This is separate from the session token the web app itself uses when you’re logged in — API keys are specifically for external integrations and scripts.

Interactive reference

Each instance publishes its own live, interactive API reference — generated straight from its running code, so it’s always exactly in sync with the version you’re actually calling (rather than reading documentation for a version that might be ahead of or behind your instance):

Docs UI: <your instance>/scalar/public-v1 — browse every public endpoint, see request/ response shapes, and try a call directly with your key.
OpenAPI spec: <your instance>/openapi/public-v1.json — the raw machine-readable spec, useful for generating a client SDK in your language of choice (e.g. via openapi-generator).

This page intentionally doesn’t duplicate that endpoint-by-endpoint reference — it would drift out of sync the moment either side changed. Use the links above as the source of truth.

What’s covered

The public API is a deliberately curated subset — the modules with broad external-integration demand (accounting export, e-commerce sync, and similar), kept smaller and more stable than Orbit’s full internal surface:

CRM
Sales (orders, invoices, customer advances)
Purchase (orders, invoices, supplier advances)
Products & Inventory
Payment Receipts
Your own account/identity (/me)

More modules are added to the public surface over time as integration demand comes up.

Rate limits

API-key-authenticated requests are limited to 120 requests/minute per key. Exceeding it returns 429 Too Many Requests with a Retry-After: 60 header. Logged-in web-app usage isn’t affected by this limit.

Revoking a key

Delete it from Settings → API Keys — it stops working immediately.