API changelog

August 2026

Sandbox reset and fiscal seeding

Test-mode improvements. All changes are additive: existing integrations need no changes.

• New endpoint POST /api/v1/sandbox/reset wipes the sandbox back to a freshly-provisioned state. API keys and webhook subscriptions survive, and request audit records are retained; all bookkeeping and master data, including stored idempotency keys, is deleted and re-seeded. Only tlr_test_ keys may call it; live keys and OAuth tokens receive 403. No Idempotency-Key header is needed — see Resetting the sandbox.
• Sandboxes are now provisioned ready for use: an open fiscal year and VAT periods matching the live company's reporting frequency are seeded alongside the chart of accounts, and the sandbox mirrors the live company's settings (currency, VAT registration, fiscal year bounds). Sandboxes created before this change are upgraded automatically the next time a test key is created or the sandbox is reset.
• Company owners can inspect sandbox data and reset the sandbox from Indstillinger → API-nøgler in the Talero app.

August 2026

Vouchers and test mode

Two additions to the v1 surface. Both are additive: existing integrations need no changes.

Vouchers (bilag)

• Five new endpoints under /api/v1/vouchers cover upload, list, metadata, download and delete, gated by the new vouchers:read and vouchers:write scopes — see Vouchers.
• Documents are uploaded as standard base64 in the JSON body, at most 10 MB decoded. An Idempotency-Key header is required, as on the other create endpoints.
• GET /api/v1/vouchers/{id}/content returns the stored bytes with the document's own Content-Type and a Content-Disposition attachment header, not the JSON envelope.
• Attach a document to an expense by sending its id as voucher_id when creating the expense.
• Deleting a voucher that documents an expense or a ledger transaction, or that carries a retention_until date, is rejected with 400 invalid_request under the bogføringsloven retention obligation.
• The voucher list supports the standard status, since, until and search filters, and sorts on upload_date, original_filename or file_size.

Test mode

• API keys now come in two flavours: tlr_live_ for the company's real books and tlr_test_ for an automatically provisioned sandbox company seeded with a standard Danish chart of accounts. Create a test key under Indstillinger → API-nøgler with live mode turned off — see Test mode.
• Test and live keys are otherwise identical: same endpoints, same scopes, same rate limits. Nothing done with a test key can reach the real books.

Webhooks

• Delivery envelopes now carry a boolean livemode field, so one receiver can serve both sandbox and production events. Existing receivers that ignore unknown fields are unaffected.
• voucher.created and voucher.deleted are now subscribable, bringing the catalog to 23 events.

August 2026

API hardening

A hardening pass across the v1 surface ahead of general availability.

Correctness

• Invoices approved via the API (including auto_approve) now post to the general ledger and draw their numbers from the company's unified document number sequence.
• auto_approve now requires customer_id; requests without it fail with 400 invalid_request.
• Cross-company references (for example a customer_id belonging to another company) are rejected.
• Malformed query parameters, UUIDs and dates now return 400 problem+json responses instead of 500.

Contract

• DELETE responses now return the standard envelope: {"data": {"id": "...", "deleted": true}}.
• The transitional duplicate error field was removed from error responses. Use code and detail — see Errors.
• Rate-limit headers (X-RateLimit-*) are now present on all authenticated responses, including errors and the 429 itself.
• CORS is enabled for browser-based integrations. Credentials must still be kept server-side.

Webhooks

• invoice.overdue is now a subscribable event, bringing the catalog to 21 events.
• Webhook subscriptions are capped at 25 active subscriptions per company.

Security

• API keys were re-issued as part of a credential-storage upgrade. Existing keys have been revoked — key holders must generate a new key under Indstillinger → API-nøgler (Settings → API keys).

Pre-GA · current release

v1.0.0 — integration launch

Public contract

Published the OpenAPI 3.1 contract and English API reference. API keys and approved OAuth 2.0 confidential clients are documented as alternative authentication methods.

Reliability and security

Added distributed rate-limit semantics, OAuth PKCE and client-secret requirements, least-privilege API keys, signed webhook delivery, retries, delivery history, replay, and secret rotation.

Compatibility

Additive changes may be released in v1. Non-security breaking changes will move to a new major API path and receive at least six months' notice after general availability.