Coravo ships an intentionally limited Sanctum-authenticated REST API. Use it for integrations that need CRM/catalog sync — not as a full substitute for the web UI.
Scope (what is included)
| Resource | Methods | Notes |
|---|---|---|
GET/POST/PUT/PATCH/DELETE /api/v1/leads |
Full CRUD | Tenant-scoped |
GET/POST/PUT/PATCH/DELETE /api/v1/deals |
Full CRUD | Tenant-scoped |
GET/POST/PUT/PATCH/DELETE /api/v1/invoices |
Full CRUD | Document actions (send/void/pay) remain web-only |
GET/POST/PUT/PATCH/DELETE /api/v1/items |
Full CRUD | Inventory catalog |
GET/POST /api/v1/parties |
Index + create | Customer/vendor records |
Machine-readable catalog: api-openapi.yaml.
Auth
- Create a personal access token under Settings → API Tokens (password confirmation required).
- Send
Authorization: Bearer {token}on every request. - The authenticated user's tenant is resolved the same way as the web app (
resolve.tenant+tenant.active). Suspended tenants cannot use the API.
Explicitly out of scope for v1
Do not expect these via /api/v1 today (use the web app or wait for a later release):
- Quotes, sales orders, shipping, payments, credit notes
- Purchase orders, stock transfers / adjustments
- Accounting journals / reports
- HR / payroll
- AI copilots
- Webhooks are configured in Settings (outbound), separate from this REST surface
Marketing copy and CodeCanyon descriptions should say "REST API v1 for leads, deals, invoices, items, and parties" — not "full ERP API."
Errors and tenancy
- Cross-tenant IDs return 404 (tenant global scopes), not 403.
- Authorization uses the same Spatie permissions as the web UI where API policies apply.
← All Coravo – AI CRM & ERP Software for Growing Businesses documentation