Create, update, and delete

Request structure

Base URL: https://api.godaily.co.il/v1.

Every request uses Authorization: Bearer $DAILY_API_KEY. Requests with a body use Content-Type: application/json. פעולות הנתונים משתמשות ב־snake_case, גם באובייקטים מקוננים. החריג: פעולות ניהול Platform, חיבורים וקישורי תשלום משתמשות ב־camelCase; לדוגמה businessNameHe ו־documentId. אין להמיר שמות באופן אוטומטי; השתמשו בחוזה הפעולה. Fields outside the contract are rejected with 400 invalid_body. Do not send business_id, ownership, or system fields. העסק נגזר מהמפתח. מפתח Platform ראשי עם platform:manage יכול לבחור עסק שמנוהל אצלו באמצעות X-Daily-Business-ID; מפתח עסק אינו יכול לבחור עסק אחר.

Complete field definitions

The complete reference contains request schemas generated from the system DTOs: required fields, types, allowed values, constraints, nested objects, and arrays. The examples show only a subset of the available fields.

For established resources, GET /customers/{id}/details, GET /suppliers/{id}/details, GET /leads/{id}/details, GET /products/{id}/details, GET /tasks/{id}/details, and GET /documents/{id}/details return expanded details. Existing read routes remain available for compatibility. For expenses, drafts, tags, categories, and raw materials, GET /{resource}/{id} returns full details.

draft_data is a free-form object. Its nested keys are preserved as sent; they do not determine permissions or business ownership.

Value types

• Amounts in write operations and expanded detail responses are decimal strings in major currency units, such as "125.50".
• Legacy fields ending in _minor remain integers in minor currency units. Do not pass them directly to a write price field.
• Inventory quantities are strings with up to three decimal places.
• Enum values in requests and expanded details must match the schema exactly and are usually uppercase. Task status is פתוח, בוצע, or מבוטל; the legacy read response continues to return its public status in English.
• During an update, omitted fields remain unchanged. null is allowed only where the schema explicitly permits it. Sent arrays replace the collection according to entity rules; [] clears an editable collection.
• IDs, creation dates, calculated balances, document numbers, and audit data are managed by the server. Secrets, payment tokens, and internal storage details are excluded from public responses.

Example: customer lifecycle

The key needs both customers:write and customers:read.

For a single create request with cURL, use a shell environment key and inspect the returned data.id before another attempt. This operation has no general idempotency token:

set -euo pipefail
: "${DAILY_API_KEY:?DAILY_API_KEY is required}"
curl --fail-with-body --silent --show-error \
  'https://api.godaily.co.il/v1/customers' \
  --request POST \
  --header "Authorization: Bearer ${DAILY_API_KEY}" \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --data '{"name":"Integration customer","contact_person":"Purchasing team","currency":"ILS","notes":"Created through the integration","address":{"city":"Tel Aviv","country_code":"IL"}}'

const apiKey = process.env.DAILY_API_KEY;
if (!apiKey) throw new Error('DAILY_API_KEY is required');
const base = 'https://api.godaily.co.il/v1';
async function request(path: string, method = 'GET', data?: unknown) {
  const response = await fetch(`${base}${path}`, {
    method,
    headers: { Authorization: `Bearer ${apiKey}`, 'Content-Type': 'application/json' },
    body: data === undefined ? undefined : JSON.stringify(data),
  });
  const result = await response.json();
  if (!response.ok) throw new Error(`${response.status}: ${result.error?.code}; ${result.request_id}`);
  return result.data;
}
const customer = await request('/customers', 'POST', {
  name: 'Integration customer',
  contact_person: 'Purchasing team',
  currency: 'ILS',
  notes: 'Created through the integration',
  address: { city: 'Tel Aviv', country_code: 'IL' },
});
await request(`/customers/${customer.id}`, 'PATCH', { notes: 'Customer details updated' });
const details = await request(`/customers/${customer.id}/details`);
if (details.notes !== 'Customer details updated') throw new Error('Update was not returned');
await request(`/customers/${customer.id}`, 'DELETE');
await request(`/customers/${customer.id}/restore`, 'POST');

Permissions for combined operations

A :write permission does not automatically grant :read, and existing keys do not automatically receive new permissions.

• Changing inventory or recipe fields through a product or raw material also requires inventory:write.
• Creating a new product from a document line also requires products:write.
• Creating a task with a document also requires tasks:write.
• Saving customer defaults from a document also requires customers:write.
• Applying an inventory movement through a document also requires inventory:write.
• Converting a lead to a customer requires both leads:write and customers:write.

The subscription, business settings, and business service validation also apply in addition to key permissions.

Idempotency and concurrent edits

Creating a document requires a UUID client_request_id. Retry the same creation with the same ID; do not reuse it for a different document.

All expense, category, and expense payment writes require an Idempotency-Key header of 16–100 characters containing English letters, digits, hyphens, or underscores. The key is scoped to the business, API key, and operation. Repeating a request with the same key and body returns the stored result; using a different body returns 409. Choose a new key for each new operation.

Editing, approving, voiding, or deleting an expense requires the record's expected_revision. Payment allocations and categories also use the version fields specified in their schemas. On 409, fetch the record again and review the change before retrying.

POST /platform/businesses דורש גם הוא Idempotency-Key של 16–100 אותיות אנגליות, ספרות, מקפים או קווים תחתונים. המזהה משויך לחשבון הפלטפורמה ולפעולת ההקמה; ניסיון חוזר עם אותו גוף מחזיר את אותו עסק, וגוף שונה מחזיר 409. שמרו אותו לפני השליחה. הפקת מפתח, סיבוב מפתח, שינוי webhook ויצירת קישור תשלום אינם מקבלים הבטחת replay כללית.

POST /customer-drafts דורש customers:write ו־Idempotency-Key באותו מבנה. המזהה מבודד לפי עסק ומשותף למפתחותיו. בקשות חוזרות ומקבילות עם אותם פרטים מחזירות את תוצאת היצירה המקורית; שינוי פרטים מחזיר 409 idempotency_conflict. ראו טיוטת לקוח.

Other creation operations have no general Idempotency-Key mechanism. After a network interruption, locate the record before trying to create it again. Do not apply a GET retry policy blindly to POST.

Deletion and finalized documents

Deletion follows entity rules: customers, suppliers, products, tags, and tasks use soft deletion. Deleting a lead that has not been converted also deletes its activities and product interests; its tasks remain but are detached from the lead. A converted lead cannot be deleted.

Issued documents, recorded payments, and inventory movements linked to documents are accounting records. Correct them with a linked document, credit, or the appropriate reversal action. Drafts can be edited and deleted. Updating an issued document changes only its handling note, not its amounts.

חריגי Platform ומדריך חיבור ראשון.