Balance sheet totals per month-end
const url = 'https://api.flychain.us/external/v1/provider/9c1e7a42-0b3d-4e58-9f21-6a8b5c4d3e2f/business_entity/3f5d8b16-7c94-42a1-b0e6-58d9c2a71b43/financial_reports/balance_sheet/monthly/summary?as_of_date=2026-08-31&months=12';const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url 'https://api.flychain.us/external/v1/provider/9c1e7a42-0b3d-4e58-9f21-6a8b5c4d3e2f/business_entity/3f5d8b16-7c94-42a1-b0e6-58d9c2a71b43/financial_reports/balance_sheet/monthly/summary?as_of_date=2026-08-31&months=12' \ --header 'Authorization: Bearer <token>'Provider keys only. A partner key is refused with 403 ENDPOINT_NOT_AVAILABLE.
The category totals per prior month-end, plus the as-of snapshot — one request covers a trailing-twelve-month position series for an entity. This is the endpoint a recurring job should use.
Each period carries its own is_closed and is_complete flags, so a job can
narrow its work to the months that can still move and treat closed months as
settled.
periods holds month-ends only. The as-of snapshot is returned separately,
under as_of, because it is the one column that may be mid-month: a position on
the 3rd of the month is not a month-end figure, and appending it to periods
would let it be read — or averaged — as one. When your as_of_date is a month
end, as_of is simply that month’s column.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”The provider, from GET /providers or the provider_id on a business-entity
record. With a partner key it must be a provider in your partner relationship;
with a provider key it is always your own provider_id, which GET /providers
returns.
Example
9c1e7a42-0b3d-4e58-9f21-6a8b5c4d3e2fThe business entity, from GET /business_entities. Must belong to the
provider_id in the same path.
Example
3f5d8b16-7c94-42a1-b0e6-58d9c2a71b43Query Parameters
Section titled “Query Parameters”The date to report the position as of, inclusive.
Same format rules as start_date — a real calendar date, zero-padded, in
YYYY-MM-DD form; 2026-7-1 and 2026-02-31 are both 400 INVALID_REQUEST.
Clamped from both ends, and the response echoes the date it actually used.
Capped at today when it falls in the future, which is the ordinary case for a job
asking for the current month-end every day. Raised to the entity’s
books_start_date when it falls earlier — you get the earliest position we
hold rather than a zero, and as_of_date in the response tells you which date
that is. This differs from the income statement, where a range entirely before
the books is a 400: a snapshot at the books floor is a real opening position,
whereas a range with no books behind it is not a period at all.
Example
2026-08-31How many monthly columns to return, counting the as_of snapshot. months=12
returns eleven prior month-ends plus the as-of.
Clamped to the entity’s books: an entity with four months of books returns four columns however many you ask for. Costs the same on our side at any value — the whole series comes from one call — so the only reason to lower it is payload size.
Example
12Responses
Section titled “Responses”Category totals per month-end, plus the as-of snapshot.
Category totals per month-end, plus the as-of column.
object
The basis an entity’s financials are prepared on.
A property of the entity, not a request parameter. A report is produced on the
basis the underlying books are kept on; there is no per-request switch. It is
returned on every entity record and every report so a figure is never ambiguous,
and it will not change without notice. See guides/data-semantics.
null only where the entity has no books yet — every entity with
reporting_available: true carries a basis.
When this payload was produced, ISO 8601 UTC.
Chronological, one entry per complete month before the as-of date’s
month, up to months - 1 of them. Empty when the as-of date falls in the
entity’s first month of books.
A month-end column carrying the category totals.
object
Month and year of this column, e.g. July 2026.
The date this position is as of — the last day of the month.
Whether a Flychain bookkeeper has finalized the books through end_date.
This is the flag that says a figure is final.
Whether this column’s end_date is in the past. Always true here, because a
month-end column is never the month in progress — the one column that can be
mid-month is as_of, which carries is_closed alone, as whole_period does
on a monthly income statement.
Published as a constant rather than omitted so that a period reads the same on
this report as on the income statement, where the same two flags appear and
is_complete genuinely varies. See guides/data-semantics.
The three category totals, in cents. Each is the rolled-up figure for that category — every account beneath it included.
asset_cents equals liability_cents + equity_cents. The identity is not
published as a fourth field: you can check it yourself, and a figure we derived
for you is one more thing that could disagree with the statement it came from.
object
Total assets, in cents.
Total liabilities, in cents.
Total equity, in cents.
The as-of column carrying the category totals.
object
The effective date, after clamping.
Whether the books are finalized through as_of_date.
The three category totals, in cents. Each is the rolled-up figure for that category — every account beneath it included.
asset_cents equals liability_cents + equity_cents. The identity is not
published as a fourth field: you can check it yourself, and a figure we derived
for you is one more thing that could disagree with the statement it came from.
object
Total assets, in cents.
Total liabilities, in cents.
Total equity, in cents.
Examples
Two month-end positions, plus the as-of snapshot
GET .../financial_reports/balance_sheet/monthly/summary?as_of_date=2026-08-31&months=3
months counts the as-of column, so three months means two prior month-ends plus
the as-of. June is closed and settled; July is complete as a calendar month but
its books are not yet closed, so its figures can still move. The as-of column is
31 August here because that is the date asked for — had it been mid-month, it
would be a month-to-date position and still returned under as_of rather than
appended to periods.
{ "provider_id": "9c1e7a42-0b3d-4e58-9f21-6a8b5c4d3e2f", "business_entity_id": "3f5d8b16-7c94-42a1-b0e6-58d9c2a71b43", "accounting_basis": "CASH", "currency": "USD", "generated_at": "2026-09-02T09:14:33Z", "periods": [ { "label": "June 2026", "end_date": "2026-06-30", "is_closed": true, "is_complete": true, "totals": { "asset_cents": 37600000, "liability_cents": 11800000, "equity_cents": 25800000 } }, { "label": "July 2026", "end_date": "2026-07-31", "is_closed": false, "is_complete": true, "totals": { "asset_cents": 39800000, "liability_cents": 12100000, "equity_cents": 27700000 } } ], "as_of": { "as_of_date": "2026-08-31", "is_closed": false, "totals": { "asset_cents": 41250000, "liability_cents": 12430000, "equity_cents": 28820000 } }}Malformed request — a missing or unparseable date, a path id that is not a UUID,
start_date after end_date, or a range that does not overlap the period this
entity has books for. Also returned when the request reached us over plaintext
HTTP; see INSECURE_TRANSPORT below and guides/authentication.
The failure shape for every error — validation, authorization, ours — so a client needs a single error path.
Match on code, not on message: the code set below is the contract and is
stable, while wording may be clarified. New codes may be added within v1 (see
guides/versioning), so treat an unrecognised code as “the HTTP status is
authoritative”.
This includes a request that never reaches a documented operation at all — an
unrouted path or a method we do not serve on that path, which is the failure you
are most likely to meet while integrating. Those are answered before any operation
runs, so no operation below lists them, but they arrive in this same shape, as
ENDPOINT_NOT_FOUND (404) and METHOD_NOT_ALLOWED (405). Either one means
check the URL rather than your credentials: the operations below are the whole
surface.
object
object
Machine-readable cause.
INVALID_REQUEST(400) — malformed dates, a non-UUID path id, an inverted range, or a range with no reportable books behind it.INSECURE_TRANSPORT(400) — the request was sent over plaintexthttp, so the key crossed the network in the clear. Rotate the key, then fix the URL; we refuse rather than redirect so this cannot pass unnoticed.INVALID_API_KEY(401) — missing, invalid, expired or revoked key.PARTNER_API_NOT_ENABLED(403) — your key is valid, but your organization is not enrolled in the API programme. Contact us; do not rotate the key.PROVIDER_NOT_ACTIVE(403) — a provider key whose Flychain account is not active. Contact us; do not rotate the key.PROVIDER_API_NOT_ENABLED(403) — a provider key on an account that is not enrolled in the API programme. Contact us; do not rotate the key.ENDPOINT_NOT_AVAILABLE(403) — the path exists and your key is valid, but that operation is not served for your kind of key. The balance sheet and cash flow families are provider-only. Your URL is not wrong; do not rotate the key.PROVIDER_NOT_IN_PARTNER_SCOPE(403) — the provider exists but is not in your relationship, including one that has left it.BUSINESS_ENTITY_NOT_IN_PARTNER_SCOPE(403) — the entity exists but does not belong to theprovider_idin the path.PROVIDER_NOT_FOUND(404) — no provider with that id.BUSINESS_ENTITY_NOT_FOUND(404) — no business entity with that id.ENDPOINT_NOT_FOUND(404) — the URL itself is not one we serve, as opposed to a record we do not have. Check the path against the operations below.METHOD_NOT_ALLOWED(405) — the path exists but not with that method; theAllowresponse header lists the ones it takes. Every operation here is aGET.BOOKS_NOT_AVAILABLE(409) — the entity has no reportable books.INTERNAL_ERROR(500) — ours; retry with backoff.AUTH_SERVICE_UNAVAILABLE(503) — we could not verify your key; retry with backoff, and do not treat it as an authentication failure.
Human-readable detail. Do not match on it.
Examples
Unparseable date
{ "error": { "code": "INVALID_REQUEST", "message": "start_date must be a valid date in YYYY-MM-DD format." }}Path id is not a UUID
{ "error": { "code": "INVALID_REQUEST", "message": "business_entity_id is not a valid UUID." }}Range sits entirely outside the reportable period
{ "error": { "code": "INVALID_REQUEST", "message": "The requested range does not overlap the period this entity has reportable books for. It must fall on or after books_start_date (see GET /business_entities) and must not be entirely in the future." }}Request sent over plaintext HTTP
{ "error": { "code": "INSECURE_TRANSPORT", "message": "This request was sent over plaintext HTTP, so any API key it carried was transmitted in the clear. Reissue it over HTTPS, and treat the key as compromised: rotate it." }}Missing, invalid, expired or revoked API key. One message covers every case on purpose — a caller cannot tell a revoked key from an unknown one.
The failure shape for every error — validation, authorization, ours — so a client needs a single error path.
Match on code, not on message: the code set below is the contract and is
stable, while wording may be clarified. New codes may be added within v1 (see
guides/versioning), so treat an unrecognised code as “the HTTP status is
authoritative”.
This includes a request that never reaches a documented operation at all — an
unrouted path or a method we do not serve on that path, which is the failure you
are most likely to meet while integrating. Those are answered before any operation
runs, so no operation below lists them, but they arrive in this same shape, as
ENDPOINT_NOT_FOUND (404) and METHOD_NOT_ALLOWED (405). Either one means
check the URL rather than your credentials: the operations below are the whole
surface.
object
object
Machine-readable cause.
INVALID_REQUEST(400) — malformed dates, a non-UUID path id, an inverted range, or a range with no reportable books behind it.INSECURE_TRANSPORT(400) — the request was sent over plaintexthttp, so the key crossed the network in the clear. Rotate the key, then fix the URL; we refuse rather than redirect so this cannot pass unnoticed.INVALID_API_KEY(401) — missing, invalid, expired or revoked key.PARTNER_API_NOT_ENABLED(403) — your key is valid, but your organization is not enrolled in the API programme. Contact us; do not rotate the key.PROVIDER_NOT_ACTIVE(403) — a provider key whose Flychain account is not active. Contact us; do not rotate the key.PROVIDER_API_NOT_ENABLED(403) — a provider key on an account that is not enrolled in the API programme. Contact us; do not rotate the key.ENDPOINT_NOT_AVAILABLE(403) — the path exists and your key is valid, but that operation is not served for your kind of key. The balance sheet and cash flow families are provider-only. Your URL is not wrong; do not rotate the key.PROVIDER_NOT_IN_PARTNER_SCOPE(403) — the provider exists but is not in your relationship, including one that has left it.BUSINESS_ENTITY_NOT_IN_PARTNER_SCOPE(403) — the entity exists but does not belong to theprovider_idin the path.PROVIDER_NOT_FOUND(404) — no provider with that id.BUSINESS_ENTITY_NOT_FOUND(404) — no business entity with that id.ENDPOINT_NOT_FOUND(404) — the URL itself is not one we serve, as opposed to a record we do not have. Check the path against the operations below.METHOD_NOT_ALLOWED(405) — the path exists but not with that method; theAllowresponse header lists the ones it takes. Every operation here is aGET.BOOKS_NOT_AVAILABLE(409) — the entity has no reportable books.INTERNAL_ERROR(500) — ours; retry with backoff.AUTH_SERVICE_UNAVAILABLE(503) — we could not verify your key; retry with backoff, and do not treat it as an authentication failure.
Human-readable detail. Do not match on it.
Examples
{ "error": { "code": "INVALID_API_KEY", "message": "Missing, invalid, expired or revoked API key." }}Your key is valid, but this call is not allowed. Either the operation is not served for your kind of key — the balance sheet and cash flow families are provider-only, eight operations in all — or your provider’s Flychain account is not active or not enrolled in the API programme. None of these is a credential problem; rotating the key will not help.
The partner scope refusals do not appear here: a partner key cannot reach these operations at all.
The failure shape for every error — validation, authorization, ours — so a client needs a single error path.
Match on code, not on message: the code set below is the contract and is
stable, while wording may be clarified. New codes may be added within v1 (see
guides/versioning), so treat an unrecognised code as “the HTTP status is
authoritative”.
This includes a request that never reaches a documented operation at all — an
unrouted path or a method we do not serve on that path, which is the failure you
are most likely to meet while integrating. Those are answered before any operation
runs, so no operation below lists them, but they arrive in this same shape, as
ENDPOINT_NOT_FOUND (404) and METHOD_NOT_ALLOWED (405). Either one means
check the URL rather than your credentials: the operations below are the whole
surface.
object
object
Machine-readable cause.
INVALID_REQUEST(400) — malformed dates, a non-UUID path id, an inverted range, or a range with no reportable books behind it.INSECURE_TRANSPORT(400) — the request was sent over plaintexthttp, so the key crossed the network in the clear. Rotate the key, then fix the URL; we refuse rather than redirect so this cannot pass unnoticed.INVALID_API_KEY(401) — missing, invalid, expired or revoked key.PARTNER_API_NOT_ENABLED(403) — your key is valid, but your organization is not enrolled in the API programme. Contact us; do not rotate the key.PROVIDER_NOT_ACTIVE(403) — a provider key whose Flychain account is not active. Contact us; do not rotate the key.PROVIDER_API_NOT_ENABLED(403) — a provider key on an account that is not enrolled in the API programme. Contact us; do not rotate the key.ENDPOINT_NOT_AVAILABLE(403) — the path exists and your key is valid, but that operation is not served for your kind of key. The balance sheet and cash flow families are provider-only. Your URL is not wrong; do not rotate the key.PROVIDER_NOT_IN_PARTNER_SCOPE(403) — the provider exists but is not in your relationship, including one that has left it.BUSINESS_ENTITY_NOT_IN_PARTNER_SCOPE(403) — the entity exists but does not belong to theprovider_idin the path.PROVIDER_NOT_FOUND(404) — no provider with that id.BUSINESS_ENTITY_NOT_FOUND(404) — no business entity with that id.ENDPOINT_NOT_FOUND(404) — the URL itself is not one we serve, as opposed to a record we do not have. Check the path against the operations below.METHOD_NOT_ALLOWED(405) — the path exists but not with that method; theAllowresponse header lists the ones it takes. Every operation here is aGET.BOOKS_NOT_AVAILABLE(409) — the entity has no reportable books.INTERNAL_ERROR(500) — ours; retry with backoff.AUTH_SERVICE_UNAVAILABLE(503) — we could not verify your key; retry with backoff, and do not treat it as an authentication failure.
Human-readable detail. Do not match on it.
Examples
A partner key on a provider-only operation
{ "error": { "code": "ENDPOINT_NOT_AVAILABLE", "message": "This endpoint is available to provider API keys only. See the reference at https://docs.flychain.us for the endpoints a partner key can read." }}Provider key whose Flychain account is not active
{ "error": { "code": "PROVIDER_NOT_ACTIVE", "message": "This provider's Flychain account is not active, so the API is not available to it. Contact Flychain." }}Provider key on an account not enrolled in the API programme
{ "error": { "code": "PROVIDER_API_NOT_ENABLED", "message": "This provider is not enrolled in the Flychain external API programme. Contact Flychain to request access." }}No provider or business entity exists with that id.
The failure shape for every error — validation, authorization, ours — so a client needs a single error path.
Match on code, not on message: the code set below is the contract and is
stable, while wording may be clarified. New codes may be added within v1 (see
guides/versioning), so treat an unrecognised code as “the HTTP status is
authoritative”.
This includes a request that never reaches a documented operation at all — an
unrouted path or a method we do not serve on that path, which is the failure you
are most likely to meet while integrating. Those are answered before any operation
runs, so no operation below lists them, but they arrive in this same shape, as
ENDPOINT_NOT_FOUND (404) and METHOD_NOT_ALLOWED (405). Either one means
check the URL rather than your credentials: the operations below are the whole
surface.
object
object
Machine-readable cause.
INVALID_REQUEST(400) — malformed dates, a non-UUID path id, an inverted range, or a range with no reportable books behind it.INSECURE_TRANSPORT(400) — the request was sent over plaintexthttp, so the key crossed the network in the clear. Rotate the key, then fix the URL; we refuse rather than redirect so this cannot pass unnoticed.INVALID_API_KEY(401) — missing, invalid, expired or revoked key.PARTNER_API_NOT_ENABLED(403) — your key is valid, but your organization is not enrolled in the API programme. Contact us; do not rotate the key.PROVIDER_NOT_ACTIVE(403) — a provider key whose Flychain account is not active. Contact us; do not rotate the key.PROVIDER_API_NOT_ENABLED(403) — a provider key on an account that is not enrolled in the API programme. Contact us; do not rotate the key.ENDPOINT_NOT_AVAILABLE(403) — the path exists and your key is valid, but that operation is not served for your kind of key. The balance sheet and cash flow families are provider-only. Your URL is not wrong; do not rotate the key.PROVIDER_NOT_IN_PARTNER_SCOPE(403) — the provider exists but is not in your relationship, including one that has left it.BUSINESS_ENTITY_NOT_IN_PARTNER_SCOPE(403) — the entity exists but does not belong to theprovider_idin the path.PROVIDER_NOT_FOUND(404) — no provider with that id.BUSINESS_ENTITY_NOT_FOUND(404) — no business entity with that id.ENDPOINT_NOT_FOUND(404) — the URL itself is not one we serve, as opposed to a record we do not have. Check the path against the operations below.METHOD_NOT_ALLOWED(405) — the path exists but not with that method; theAllowresponse header lists the ones it takes. Every operation here is aGET.BOOKS_NOT_AVAILABLE(409) — the entity has no reportable books.INTERNAL_ERROR(500) — ours; retry with backoff.AUTH_SERVICE_UNAVAILABLE(503) — we could not verify your key; retry with backoff, and do not treat it as an authentication failure.
Human-readable detail. Do not match on it.
Examples
{ "error": { "code": "PROVIDER_NOT_FOUND", "message": "No provider exists with that id." }}{ "error": { "code": "BUSINESS_ENTITY_NOT_FOUND", "message": "No business entity exists with that id." }}The entity exists and is in your relationship, but has no books a report can be
produced from — it is still onboarding, or it has been deactivated. It appears in
GET /business_entities with reporting_available: false; skip it rather than
recording a zero.
The failure shape for every error — validation, authorization, ours — so a client needs a single error path.
Match on code, not on message: the code set below is the contract and is
stable, while wording may be clarified. New codes may be added within v1 (see
guides/versioning), so treat an unrecognised code as “the HTTP status is
authoritative”.
This includes a request that never reaches a documented operation at all — an
unrouted path or a method we do not serve on that path, which is the failure you
are most likely to meet while integrating. Those are answered before any operation
runs, so no operation below lists them, but they arrive in this same shape, as
ENDPOINT_NOT_FOUND (404) and METHOD_NOT_ALLOWED (405). Either one means
check the URL rather than your credentials: the operations below are the whole
surface.
object
object
Machine-readable cause.
INVALID_REQUEST(400) — malformed dates, a non-UUID path id, an inverted range, or a range with no reportable books behind it.INSECURE_TRANSPORT(400) — the request was sent over plaintexthttp, so the key crossed the network in the clear. Rotate the key, then fix the URL; we refuse rather than redirect so this cannot pass unnoticed.INVALID_API_KEY(401) — missing, invalid, expired or revoked key.PARTNER_API_NOT_ENABLED(403) — your key is valid, but your organization is not enrolled in the API programme. Contact us; do not rotate the key.PROVIDER_NOT_ACTIVE(403) — a provider key whose Flychain account is not active. Contact us; do not rotate the key.PROVIDER_API_NOT_ENABLED(403) — a provider key on an account that is not enrolled in the API programme. Contact us; do not rotate the key.ENDPOINT_NOT_AVAILABLE(403) — the path exists and your key is valid, but that operation is not served for your kind of key. The balance sheet and cash flow families are provider-only. Your URL is not wrong; do not rotate the key.PROVIDER_NOT_IN_PARTNER_SCOPE(403) — the provider exists but is not in your relationship, including one that has left it.BUSINESS_ENTITY_NOT_IN_PARTNER_SCOPE(403) — the entity exists but does not belong to theprovider_idin the path.PROVIDER_NOT_FOUND(404) — no provider with that id.BUSINESS_ENTITY_NOT_FOUND(404) — no business entity with that id.ENDPOINT_NOT_FOUND(404) — the URL itself is not one we serve, as opposed to a record we do not have. Check the path against the operations below.METHOD_NOT_ALLOWED(405) — the path exists but not with that method; theAllowresponse header lists the ones it takes. Every operation here is aGET.BOOKS_NOT_AVAILABLE(409) — the entity has no reportable books.INTERNAL_ERROR(500) — ours; retry with backoff.AUTH_SERVICE_UNAVAILABLE(503) — we could not verify your key; retry with backoff, and do not treat it as an authentication failure.
Human-readable detail. Do not match on it.
Examples
{ "error": { "code": "BOOKS_NOT_AVAILABLE", "message": "This business entity does not currently have reportable books. GET /business_entities lists it with reporting_available: false." }}Our side. Safe to retry with backoff.
The failure shape for every error — validation, authorization, ours — so a client needs a single error path.
Match on code, not on message: the code set below is the contract and is
stable, while wording may be clarified. New codes may be added within v1 (see
guides/versioning), so treat an unrecognised code as “the HTTP status is
authoritative”.
This includes a request that never reaches a documented operation at all — an
unrouted path or a method we do not serve on that path, which is the failure you
are most likely to meet while integrating. Those are answered before any operation
runs, so no operation below lists them, but they arrive in this same shape, as
ENDPOINT_NOT_FOUND (404) and METHOD_NOT_ALLOWED (405). Either one means
check the URL rather than your credentials: the operations below are the whole
surface.
object
object
Machine-readable cause.
INVALID_REQUEST(400) — malformed dates, a non-UUID path id, an inverted range, or a range with no reportable books behind it.INSECURE_TRANSPORT(400) — the request was sent over plaintexthttp, so the key crossed the network in the clear. Rotate the key, then fix the URL; we refuse rather than redirect so this cannot pass unnoticed.INVALID_API_KEY(401) — missing, invalid, expired or revoked key.PARTNER_API_NOT_ENABLED(403) — your key is valid, but your organization is not enrolled in the API programme. Contact us; do not rotate the key.PROVIDER_NOT_ACTIVE(403) — a provider key whose Flychain account is not active. Contact us; do not rotate the key.PROVIDER_API_NOT_ENABLED(403) — a provider key on an account that is not enrolled in the API programme. Contact us; do not rotate the key.ENDPOINT_NOT_AVAILABLE(403) — the path exists and your key is valid, but that operation is not served for your kind of key. The balance sheet and cash flow families are provider-only. Your URL is not wrong; do not rotate the key.PROVIDER_NOT_IN_PARTNER_SCOPE(403) — the provider exists but is not in your relationship, including one that has left it.BUSINESS_ENTITY_NOT_IN_PARTNER_SCOPE(403) — the entity exists but does not belong to theprovider_idin the path.PROVIDER_NOT_FOUND(404) — no provider with that id.BUSINESS_ENTITY_NOT_FOUND(404) — no business entity with that id.ENDPOINT_NOT_FOUND(404) — the URL itself is not one we serve, as opposed to a record we do not have. Check the path against the operations below.METHOD_NOT_ALLOWED(405) — the path exists but not with that method; theAllowresponse header lists the ones it takes. Every operation here is aGET.BOOKS_NOT_AVAILABLE(409) — the entity has no reportable books.INTERNAL_ERROR(500) — ours; retry with backoff.AUTH_SERVICE_UNAVAILABLE(503) — we could not verify your key; retry with backoff, and do not treat it as an authentication failure.
Human-readable detail. Do not match on it.
Examples
{ "error": { "code": "INTERNAL_ERROR", "message": "An unexpected error occurred. Retry with backoff." }}We could not verify your API key right now — our identity provider was
unreachable or rate-limited. This is not an authentication failure: the key
may well be valid. Retry with backoff rather than treating it as a 401.
The failure shape for every error — validation, authorization, ours — so a client needs a single error path.
Match on code, not on message: the code set below is the contract and is
stable, while wording may be clarified. New codes may be added within v1 (see
guides/versioning), so treat an unrecognised code as “the HTTP status is
authoritative”.
This includes a request that never reaches a documented operation at all — an
unrouted path or a method we do not serve on that path, which is the failure you
are most likely to meet while integrating. Those are answered before any operation
runs, so no operation below lists them, but they arrive in this same shape, as
ENDPOINT_NOT_FOUND (404) and METHOD_NOT_ALLOWED (405). Either one means
check the URL rather than your credentials: the operations below are the whole
surface.
object
object
Machine-readable cause.
INVALID_REQUEST(400) — malformed dates, a non-UUID path id, an inverted range, or a range with no reportable books behind it.INSECURE_TRANSPORT(400) — the request was sent over plaintexthttp, so the key crossed the network in the clear. Rotate the key, then fix the URL; we refuse rather than redirect so this cannot pass unnoticed.INVALID_API_KEY(401) — missing, invalid, expired or revoked key.PARTNER_API_NOT_ENABLED(403) — your key is valid, but your organization is not enrolled in the API programme. Contact us; do not rotate the key.PROVIDER_NOT_ACTIVE(403) — a provider key whose Flychain account is not active. Contact us; do not rotate the key.PROVIDER_API_NOT_ENABLED(403) — a provider key on an account that is not enrolled in the API programme. Contact us; do not rotate the key.ENDPOINT_NOT_AVAILABLE(403) — the path exists and your key is valid, but that operation is not served for your kind of key. The balance sheet and cash flow families are provider-only. Your URL is not wrong; do not rotate the key.PROVIDER_NOT_IN_PARTNER_SCOPE(403) — the provider exists but is not in your relationship, including one that has left it.BUSINESS_ENTITY_NOT_IN_PARTNER_SCOPE(403) — the entity exists but does not belong to theprovider_idin the path.PROVIDER_NOT_FOUND(404) — no provider with that id.BUSINESS_ENTITY_NOT_FOUND(404) — no business entity with that id.ENDPOINT_NOT_FOUND(404) — the URL itself is not one we serve, as opposed to a record we do not have. Check the path against the operations below.METHOD_NOT_ALLOWED(405) — the path exists but not with that method; theAllowresponse header lists the ones it takes. Every operation here is aGET.BOOKS_NOT_AVAILABLE(409) — the entity has no reportable books.INTERNAL_ERROR(500) — ours; retry with backoff.AUTH_SERVICE_UNAVAILABLE(503) — we could not verify your key; retry with backoff, and do not treat it as an authentication failure.
Human-readable detail. Do not match on it.
Examples
{ "error": { "code": "AUTH_SERVICE_UNAVAILABLE", "message": "Unable to verify the API key right now. Retry with backoff." }}