API Documentation

1. Create an account at app.vlasterp.com (free tier available).
2. Obtain credentials — either log in via POST /api/v1/auth/login to get a JWT, or generate an API key from Settings → API Keys.
3. Make requests — pass your token as Authorization: Bearer <token> or your API key as X-API-Key: <key>.

curl -X POST https://api.vlasterp.com/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "[email protected]", "password": "your-password"}'

const res = await fetch("https://api.vlasterp.com/api/v1/invoices", {
  headers: {
    "Authorization": "Bearer YOUR_ACCESS_TOKEN",
    "Content-Type": "application/json",
  },
});
const { data, pagination } = await res.json();

import requests

headers = {"Authorization": "Bearer YOUR_ACCESS_TOKEN"}
resp = requests.get(
    "https://api.vlasterp.com/api/v1/clients",
    headers=headers,
    params={"page": 1, "per_page": 25},
)
data = resp.json()

vlastERP supports two authentication methods:

JWT tokens expire after 1 hour. Use POST /api/v1/auth/refresh with your refresh token to obtain a new pair.

• Authenticated: 600 requests/minute per tenant.
• Unauthenticated: 30 requests/minute per IP.

Every response includes rate-limit headers:

• X-RateLimit-Limit — max requests in the window
• X-RateLimit-Remaining — requests left
• X-RateLimit-Reset — Unix timestamp when the window resets

When the limit is exceeded you will receive a 429 Too Many Requests response.

All list endpoints support cursor-free offset pagination:

Responses include a pagination object:

{
  "data": [...],
  "pagination": {
    "page": 1,
    "per_page": 25,
    "total": 142,
    "total_pages": 6
  }
}

All errors follow a consistent JSON envelope. The code field is a machine-readable constant; message is human-readable.

{
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Field 'email' is required",
    "details": [
      { "field": "email", "message": "must not be empty" }
    ]
  }
}