Payments

Payments applied to an invoice.

The object#

Field	Type	Description
idread-only	integer	NolaPro id.
invoiceid	integer	Invoiceid. Id only.
invoice	string(30)	The `invoicenumber` of the referenced invoices, instead of the id. Send this or `invoiceid`, not both unless they agree.
amountmoney	string(4dp)	Stored as `decimal(19,4)`.
voucherid	integer	Voucherid. Id only.
voucher	string(50)	The `voucher` of the referenced gltransactions, instead of the id. Send this or `voucherid`, not both unless they agree.
datereceived	string	Date the payment was received - the accounting date it posts under.
paymeth	integer	Payment method code: 1 = cash, 2 = check (the POS writes 2 for credit card), 3 = credit card, 4 = ACH/EFT, 5 = POS card terminal, 99 = write-off; 0 = on account or unset.
interest	integer	1 when the payment pays finance-charge interest rather than invoice principal.
cancel	boolean	Cancelled. Always a boolean on the wire, whatever integer width the column uses (D23).
cancel_useridread-only	integer	User who voided the payment.
cancel_user	string(50)	The `name` of the referenced genusers, instead of the id. Send this or `cancel_userid`, not both unless they agree.
checkid	string(100)	Check number or payment reference the customer paid with.
bankdepositid	integer	Bankdepositid. Id only.
bankstatement_enddateread-only	string	End date of the bank statement the payment was reconciled under. Maintained by bank reconciliation, so it cannot be written through the API.
old_idread-only	string(255)	Payment id in the system this record was imported from.
refund_paymeth	integer	Payment method used for the refund, when the payment is a refund.
cctransactionid	integer	Cctransactionid. Id only.
currency	string(10)	Currency the payment was received in.
returned	integer	1 when the payment was returned by the bank (NSF/bounced).
feeinvoiceid	integer	Feeinvoiceid. Id only.
feeinvoice	string(30)	The `invoicenumber` of the referenced invoices, instead of the id. Send this or `feeinvoiceid`, not both unless they agree.
feeapbillid	integer	Feeapbillid. Id only.
bankfee_amountmoney	string(4dp)	Stored as `decimal(19,4)`.
bankfee_glid	integer	GL account a bank fee taken out of the payment posts to.
bankfee_gl	string(20)	The `name` of the referenced glaccounts, instead of the id. Send this or `bankfee_glid`, not both unless they agree.
rnum	string(30)	Reference number recorded with the payment (remittance or voucher reference).
tenderedmoney	string(4dp)	Stored as `decimal(19,4)`.
transid	string(32)	Gateway transaction id, for card and online payments.
orderdepositid	integer	Orderdepositid. Id only.
ccterminalid	integer	Ccterminalid. Id only.
costcodeid	integer	Cost code.
costcode	string(20)	Code for the referenced costcode, instead of the id.
inventorylocationid	integer	Inventorylocationid. Id only.
inventorylocation	string(20)	The `locationcode` of the referenced inventorylocations, instead of the id. Send this or `inventorylocationid`, not both unless they agree.
isb2bpayment	boolean	True when the customer paid through the B2B portal.
isb2bpaymentfee	boolean	True when the record is the convenience fee charged on a B2B portal payment.
jointcheck	boolean	True when the payment is a joint check (AR joint checks feature).
bankstatement_cleardateread-only	string	Date the payment cleared the bank. Maintained by bank reconciliation, so it cannot be written through the API.
extuserid	integer	Extuserid. Id only.
ispaymentonaccount	boolean	True when the payment is on account rather than applied to a specific invoice.
writeoffreasonid	integer	Write-off reason (`writeoffreason` id) when the payment is a write-off (`paymeth` 99).
creditfromarinvoicepaymentdetailid	integer	Creditfromarinvoicepaymentdetailid. Id only.
credittoarinvoicepaymentdetailid	integer	Credittoarinvoicepaymentdetailid. Id only.
entrydate	string	When the record was created.
customerid	integer	Reference to `customers`, by id. Write either this or `customer`.
customer	string(30)	Code for the referenced customer, instead of the id.
datereceivedandvoucheridread-only	integer	STORED GENERATED in the database. Read-only - MySQL computes it, and a value sent here is silently discarded.
pendingarachbankrecdatereceivedread-only	string	STORED GENERATED in the database. Read-only - MySQL computes it, and a value sent here is silently discarded.
creditorderdepositid	integer	Creditorderdepositid. Id only.
checkaccountid	integer	Checking account the payment was deposited to.
checkaccount	string(30)	The `name` of the referenced checkaccounts, instead of the id. Send this or `checkaccountid`, not both unless they agree.
externalid	string(100)	Your own key. Scoped to your company.

Endpoints#

POST/payments/batch 207400422

Create many.

Requires scope payments:write.

Parameters

Name	In	Type	Notes
Idempotency-Key	header	string	Makes the write safely retryable. Any unique string per logical operation; a UUID is fine. The failure this prevents is specific: the request succeeds, the response is lost to a timeout, you retry, and the customer is billed twice. With a key, the retry returns the original response - same status, same body, same id - and creates nothing. The body is part of the key's identity. Reusing a key with a different body is a bug on your side, not a retry, and answers `409 idempotency_replay` rather than silently handing back the old response. Keys are remembered for 24 hours.

Body array

Field	Type	Description
invoiceidrequired	integer	The POSTED invoice being paid.
amountrequiredmoney	string	How much was received. Decimal STRING, not a JSON number.
date	string	Date received. Defaults to today.
method	integer	Payment method id.
reference	string(100)	Cheque number or transaction reference.
externalid	string(100)	Your own identifier for this record. Stored verbatim and returned on reads; `GET /<resource>?externalid=...` finds it again.

When it fails

Status	Code	Meaning
400	invalid_request	The request was malformed.
422	period_closed	The GL period containing the date is closed.
422	rule_violation	NolaPro refused the document. `message` carries its reason.
422	unknown_value	A reference did not resolve in this company.

curl -X POST \
  'https://acme.nolapro.com/!/api/v2/payments/batch' \
  -H 'Authorization: Bearer $NP_TOKEN' \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: your-unique-key' \
  -d '[
    {
        "invoiceid": 104,
        "amount": "125.0000",
        "date": "2026-08-02",
        "externalid": "crm-8842"
    }
]'

$ch = curl_init('https://acme.nolapro.com/!/api/v2/payments/batch');
curl_setopt_array($ch, [
  CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . getenv('NP_TOKEN')],
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_CUSTOMREQUEST  => 'POST',
  CURLOPT_POSTFIELDS     => json_encode([
    [
      'invoiceid' => 104,
      'amount' => '125.0000',
      'date' => '2026-08-02',
      'externalid' => 'crm-8842',
    ],
  ]),
]);
$res = json_decode(curl_exec($ch), true);

import os, requests

r = requests.post(
    "https://acme.nolapro.com/!/api/v2/payments/batch",
    headers={"Authorization": f"Bearer {os.environ['NP_TOKEN']}"},
    json=[
        {
            "invoiceid": 104,
            "amount": "125.0000",
            "date": "2026-08-02",
            "externalid": "crm-8842",
        },
    ],
)
r.raise_for_status()

const res = await fetch(
  'https://acme.nolapro.com/!/api/v2/payments/batch',
  {
    method: 'POST',
    headers: { Authorization: `Bearer ${process.env.NP_TOKEN}` },
    body: JSON.stringify([
      {
        invoiceid: 104,
        amount: "125.0000",
        date: "2026-08-02",
        externalid: "crm-8842",
      },
    ]),
  }
);
const data = await res.json();

using System.Net.Http.Json;

var token = Environment.GetEnvironmentVariable("NP_TOKEN");

using var http = new HttpClient();
http.DefaultRequestHeaders.Add("Authorization", "Bearer " + token);

var body = new[] {
    new {
        invoiceid = 104,
        amount = "125.0000",
        date = "2026-08-02",
        externalid = "crm-8842",
    },
};

var req = new HttpRequestMessage(HttpMethod.Post,
    "https://acme.nolapro.com/!/api/v2/payments/batch") {
    Content = JsonContent.Create(body),
};
req.Headers.Add("Idempotency-Key", "your-unique-key");

var res = await http.SendAsync(req);
res.EnsureSuccessStatusCode();

Response 207

{
    "results": [
        {
            "index": 1,
            "status": 1
        }
    ]
}

GET/payments 200403

List payments.

Requires scope payments:read.

Parameters

Name	In	Type	Notes
customerid	query	string	Restrict to one customerid.
inventorylocationid	query	string	Restrict to one inventorylocationid.
invoiceid	query	string	Restrict to one invoiceid.
cancel	query	string	Defaults to `false`. Pass `true` or `any`.
externalid	query	string	Exact match on your own key.
include	query	string	Comma-separated extras to embed. Only `custom_fields` is available: the extra fields this install has defined on the record. Off by default, and an unrecognised value is refused rather than ignored. See Conventions.
bankdepositid	query	integer	Restrict to payments on one bank deposit. Pass 0 for the ones not yet banked.

When it fails

Status	Code	Meaning
403	insufficient_scope	Token lacks read scope.

curl \
  'https://acme.nolapro.com/!/api/v2/payments' \
  -H 'Authorization: Bearer $NP_TOKEN'

$ch = curl_init('https://acme.nolapro.com/!/api/v2/payments');
curl_setopt_array($ch, [
  CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . getenv('NP_TOKEN')],
  CURLOPT_RETURNTRANSFER => true,
]);
$res = json_decode(curl_exec($ch), true);

import os, requests

r = requests.get(
    "https://acme.nolapro.com/!/api/v2/payments",
    headers={"Authorization": f"Bearer {os.environ['NP_TOKEN']}"},
)
r.raise_for_status()

const res = await fetch(
  'https://acme.nolapro.com/!/api/v2/payments',
  {
    method: 'GET',
    headers: { Authorization: `Bearer ${process.env.NP_TOKEN}` },
  }
);
const data = await res.json();

using System.Net.Http.Json;

var token = Environment.GetEnvironmentVariable("NP_TOKEN");

using var http = new HttpClient();
http.DefaultRequestHeaders.Add("Authorization", "Bearer " + token);

var res = await http.GetAsync(
    "https://acme.nolapro.com/!/api/v2/payments");
res.EnsureSuccessStatusCode();

POST/payments 201400422

Create.

Requires scope payments:write.

Parameters

Name	In	Type	Notes
Idempotency-Key	header	string	Makes the write safely retryable. Any unique string per logical operation; a UUID is fine. The failure this prevents is specific: the request succeeds, the response is lost to a timeout, you retry, and the customer is billed twice. With a key, the retry returns the original response - same status, same body, same id - and creates nothing. The body is part of the key's identity. Reusing a key with a different body is a bug on your side, not a retry, and answers `409 idempotency_replay` rather than silently handing back the old response. Keys are remembered for 24 hours.

Body

Field	Type	Description
invoiceidrequired	integer	The POSTED invoice being paid.
amountrequiredmoney	string	How much was received. Decimal STRING, not a JSON number.
date	string	Date received. Defaults to today.
method	integer	Payment method id.
reference	string(100)	Cheque number or transaction reference.
externalid	string(100)	Your own identifier for this record. Stored verbatim and returned on reads; `GET /<resource>?externalid=...` finds it again.

When it fails

Status	Code	Meaning
400	invalid_request	A required field was missing.
422	period_closed	The GL period containing the date is closed.
422	rule_violation	NolaPro refused the document. `message` carries its reason.
422	unknown_value	A reference did not resolve in this company.

curl -X POST \
  'https://acme.nolapro.com/!/api/v2/payments' \
  -H 'Authorization: Bearer $NP_TOKEN' \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: your-unique-key' \
  -d '{
    "invoiceid": 104,
    "amount": "125.0000",
    "date": "2026-08-02",
    "externalid": "crm-8842"
}'

$ch = curl_init('https://acme.nolapro.com/!/api/v2/payments');
curl_setopt_array($ch, [
  CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . getenv('NP_TOKEN')],
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_CUSTOMREQUEST  => 'POST',
  CURLOPT_POSTFIELDS     => json_encode([
    'invoiceid' => 104,
    'amount' => '125.0000',
    'date' => '2026-08-02',
    'externalid' => 'crm-8842',
  ]),
]);
$res = json_decode(curl_exec($ch), true);

import os, requests

r = requests.post(
    "https://acme.nolapro.com/!/api/v2/payments",
    headers={"Authorization": f"Bearer {os.environ['NP_TOKEN']}"},
    json={
        "invoiceid": 104,
        "amount": "125.0000",
        "date": "2026-08-02",
        "externalid": "crm-8842",
    },
)
r.raise_for_status()

const res = await fetch(
  'https://acme.nolapro.com/!/api/v2/payments',
  {
    method: 'POST',
    headers: { Authorization: `Bearer ${process.env.NP_TOKEN}` },
    body: JSON.stringify({
      invoiceid: 104,
      amount: "125.0000",
      date: "2026-08-02",
      externalid: "crm-8842",
    }),
  }
);
const data = await res.json();

using System.Net.Http.Json;

var token = Environment.GetEnvironmentVariable("NP_TOKEN");

using var http = new HttpClient();
http.DefaultRequestHeaders.Add("Authorization", "Bearer " + token);

var body = new {
    invoiceid = 104,
    amount = "125.0000",
    date = "2026-08-02",
    externalid = "crm-8842",
};

var req = new HttpRequestMessage(HttpMethod.Post,
    "https://acme.nolapro.com/!/api/v2/payments") {
    Content = JsonContent.Create(body),
};
req.Headers.Add("Idempotency-Key", "your-unique-key");

var res = await http.SendAsync(req);
res.EnsureSuccessStatusCode();

Response 201

{
    "invoiceid": 104,
    "amount": "125.0000",
    "voucherid": 104,
    "invoicepaid": "Example invoicepaid"
}

GET/payments/{id} 200404

Retrieve one record.

Requires scope payments:read.

Parameters

Name	In	Type	Notes
idrequired	path	integer	The record id.
include	query	string	Comma-separated extras to embed. Only `custom_fields` is available: the extra fields this install has defined on the record. Off by default, and an unrecognised value is refused rather than ignored. See Conventions.

When it fails

Status	Code	Meaning
404	not_found	No record with that id.

curl \
  'https://acme.nolapro.com/!/api/v2/payments/104' \
  -H 'Authorization: Bearer $NP_TOKEN'

$ch = curl_init('https://acme.nolapro.com/!/api/v2/payments/104');
curl_setopt_array($ch, [
  CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . getenv('NP_TOKEN')],
  CURLOPT_RETURNTRANSFER => true,
]);
$res = json_decode(curl_exec($ch), true);

import os, requests

r = requests.get(
    "https://acme.nolapro.com/!/api/v2/payments/104",
    headers={"Authorization": f"Bearer {os.environ['NP_TOKEN']}"},
)
r.raise_for_status()

const res = await fetch(
  'https://acme.nolapro.com/!/api/v2/payments/104',
  {
    method: 'GET',
    headers: { Authorization: `Bearer ${process.env.NP_TOKEN}` },
  }
);
const data = await res.json();

using System.Net.Http.Json;

var token = Environment.GetEnvironmentVariable("NP_TOKEN");

using var http = new HttpClient();
http.DefaultRequestHeaders.Add("Authorization", "Bearer " + token);

var res = await http.GetAsync(
    "https://acme.nolapro.com/!/api/v2/payments/104");
res.EnsureSuccessStatusCode();

Response 200

{
    "invoiceid": 104,
    "invoice": "Example invoice",
    "amount": "125.0000",
    "voucherid": 104,
    "voucher": "Example voucher",
    "datereceived": "2026-08-01"
}

PATCH/payments/{id} 200400404409422

Update.

Requires scope payments:write.

Parameters

Name	In	Type	Notes
idrequired	path	integer	The record id.
Idempotency-Key	header	string	Makes the write safely retryable. Any unique string per logical operation; a UUID is fine. The failure this prevents is specific: the request succeeds, the response is lost to a timeout, you retry, and the customer is billed twice. With a key, the retry returns the original response - same status, same body, same id - and creates nothing. The body is part of the key's identity. Reusing a key with a different body is a bug on your side, not a retry, and answers `409 idempotency_replay` rather than silently handing back the old response. Keys are remembered for 24 hours.

Body

Field	Type	Description
reference	string(100)	Cheque number or transaction reference.
method	integer	Payment method id.
externalid	string(100)	Your own identifier for this record.

When it fails

Status	Code	Meaning
400	invalid_request	The request was malformed.
404	not_found	No such record, or it belongs to another company.
409	stale_record	`If-Match` did not match; someone else changed it first.
422	rule_violation	NolaPro refused the change. `message` carries its reason.

curl -X PATCH \
  'https://acme.nolapro.com/!/api/v2/payments/104' \
  -H 'Authorization: Bearer $NP_TOKEN' \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: your-unique-key' \
  -d '{
    "reference": "Example reference",
    "method": 1
}'

$ch = curl_init('https://acme.nolapro.com/!/api/v2/payments/104');
curl_setopt_array($ch, [
  CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . getenv('NP_TOKEN')],
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_CUSTOMREQUEST  => 'PATCH',
  CURLOPT_POSTFIELDS     => json_encode([
    'reference' => 'Example reference',
    'method' => 1,
  ]),
]);
$res = json_decode(curl_exec($ch), true);

import os, requests

r = requests.patch(
    "https://acme.nolapro.com/!/api/v2/payments/104",
    headers={"Authorization": f"Bearer {os.environ['NP_TOKEN']}"},
    json={
        "reference": "Example reference",
        "method": 1,
    },
)
r.raise_for_status()

const res = await fetch(
  'https://acme.nolapro.com/!/api/v2/payments/104',
  {
    method: 'PATCH',
    headers: { Authorization: `Bearer ${process.env.NP_TOKEN}` },
    body: JSON.stringify({
      reference: "Example reference",
      method: 1,
    }),
  }
);
const data = await res.json();

using System.Net.Http.Json;

var token = Environment.GetEnvironmentVariable("NP_TOKEN");

using var http = new HttpClient();
http.DefaultRequestHeaders.Add("Authorization", "Bearer " + token);

var body = new {
    reference = "Example reference",
    method = 1,
};

var req = new HttpRequestMessage(HttpMethod.Patch,
    "https://acme.nolapro.com/!/api/v2/payments/104") {
    Content = JsonContent.Create(body),
};
req.Headers.Add("Idempotency-Key", "your-unique-key");

var res = await http.SendAsync(req);
res.EnsureSuccessStatusCode();

DELETE/payments/{id} 200400409422

Cancel.

Requires scope payments:cancel.

Parameters

Name	In	Type	Notes
idrequired	path	integer	The record id.
Idempotency-Key	header	string	Makes the write safely retryable. Any unique string per logical operation; a UUID is fine. The failure this prevents is specific: the request succeeds, the response is lost to a timeout, you retry, and the customer is billed twice. With a key, the retry returns the original response - same status, same body, same id - and creates nothing. The body is part of the key's identity. Reusing a key with a different body is a bug on your side, not a retry, and answers `409 idempotency_replay` rather than silently handing back the old response. Keys are remembered for 24 hours.

When it fails

Status	Code	Meaning
400	invalid_request	The request was malformed.
409	cannot_cancel	Something already depends on this document - a payment, a shipment, an invoice.
422	period_closed	The current GL period is closed, so a reversal has nowhere to post.
422	unknown_value	No such record in this company.

curl -X DELETE \
  'https://acme.nolapro.com/!/api/v2/payments/104' \
  -H 'Authorization: Bearer $NP_TOKEN'

$ch = curl_init('https://acme.nolapro.com/!/api/v2/payments/104');
curl_setopt_array($ch, [
  CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . getenv('NP_TOKEN')],
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_CUSTOMREQUEST  => 'DELETE',
]);
$res = json_decode(curl_exec($ch), true);

import os, requests

r = requests.delete(
    "https://acme.nolapro.com/!/api/v2/payments/104",
    headers={"Authorization": f"Bearer {os.environ['NP_TOKEN']}"},
)
r.raise_for_status()

const res = await fetch(
  'https://acme.nolapro.com/!/api/v2/payments/104',
  {
    method: 'DELETE',
    headers: { Authorization: `Bearer ${process.env.NP_TOKEN}` },
  }
);
const data = await res.json();

using System.Net.Http.Json;

var token = Environment.GetEnvironmentVariable("NP_TOKEN");

using var http = new HttpClient();
http.DefaultRequestHeaders.Add("Authorization", "Bearer " + token);

var req = new HttpRequestMessage(HttpMethod.Delete,
    "https://acme.nolapro.com/!/api/v2/payments/104");

var res = await http.SendAsync(req);
res.EnsureSuccessStatusCode();

GET/payments/{id}/receipt 200409

Payment receipt as a PDF

The receipt for a payment, covering every invoice its voucher settled. Answers application/pdf, not JSON. Because the body is binary it cannot be carried inside a /batch results array; asking for it there returns 415 not_batchable. A payment with no voucher is refused with 409 not_posted.

Requires scope payments:read.

Parameters

Name	In	Type	Notes
idrequired	path	integer	The invoice id.

When it fails

Status	Code	Meaning
409		The invoice is still a draft.

curl \
  'https://acme.nolapro.com/!/api/v2/payments/104/receipt' \
  -H 'Authorization: Bearer $NP_TOKEN'

$ch = curl_init('https://acme.nolapro.com/!/api/v2/payments/104/receipt');
curl_setopt_array($ch, [
  CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . getenv('NP_TOKEN')],
  CURLOPT_RETURNTRANSFER => true,
]);
$res = json_decode(curl_exec($ch), true);

import os, requests

r = requests.get(
    "https://acme.nolapro.com/!/api/v2/payments/104/receipt",
    headers={"Authorization": f"Bearer {os.environ['NP_TOKEN']}"},
)
r.raise_for_status()

const res = await fetch(
  'https://acme.nolapro.com/!/api/v2/payments/104/receipt',
  {
    method: 'GET',
    headers: { Authorization: `Bearer ${process.env.NP_TOKEN}` },
  }
);
const data = await res.json();

using System.Net.Http.Json;

var token = Environment.GetEnvironmentVariable("NP_TOKEN");

using var http = new HttpClient();
http.DefaultRequestHeaders.Add("Authorization", "Bearer " + token);

var res = await http.GetAsync(
    "https://acme.nolapro.com/!/api/v2/payments/104/receipt");
res.EnsureSuccessStatusCode();

GET/payments/{id}/attachments 200404

List files attached to a payment.

The attachments on this payment, newest first. Accepted filedefinitionid values: 42 (default 42). Metadata only - each file's bytes are at GET /attachments/{id}/content.

Requires scope payments:read.

Parameters

Name	In	Type	Notes
idrequired	path	integer	The payment id.
filedefinitionid	query	integer	Only files in this list. Accepted `filedefinitionid` values: 42 (default 42).
filecategoryid	query	integer	Only files filed under this category.
filename	query	string	Partial match on the file name, case insensitive.

When it fails

Status	Code	Meaning
404	not_found	No payment with that id in this company.

curl \
  'https://acme.nolapro.com/!/api/v2/payments/104/attachments' \
  -H 'Authorization: Bearer $NP_TOKEN'

$ch = curl_init('https://acme.nolapro.com/!/api/v2/payments/104/attachments');
curl_setopt_array($ch, [
  CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . getenv('NP_TOKEN')],
  CURLOPT_RETURNTRANSFER => true,
]);
$res = json_decode(curl_exec($ch), true);

import os, requests

r = requests.get(
    "https://acme.nolapro.com/!/api/v2/payments/104/attachments",
    headers={"Authorization": f"Bearer {os.environ['NP_TOKEN']}"},
)
r.raise_for_status()

const res = await fetch(
  'https://acme.nolapro.com/!/api/v2/payments/104/attachments',
  {
    method: 'GET',
    headers: { Authorization: `Bearer ${process.env.NP_TOKEN}` },
  }
);
const data = await res.json();

using System.Net.Http.Json;

var token = Environment.GetEnvironmentVariable("NP_TOKEN");

using var http = new HttpClient();
http.DefaultRequestHeaders.Add("Authorization", "Bearer " + token);

var res = await http.GetAsync(
    "https://acme.nolapro.com/!/api/v2/payments/104/attachments");
res.EnsureSuccessStatusCode();

POST/payments/{id}/attachments 201400404409413415422

Attach a file to a payment.

multipart/form-data with one file part; see the AttachmentUpload schema for the other parts. Accepted filedefinitionid values: 42 (default 42). Answers 201 with the attachment's metadata and Location: /attachments/{id}. Check _meta.warnings for datatype_truncated and stored_under_parent_company.

Requires scope payments:write.

Parameters

Name	In	Type	Notes
idrequired	path	integer	The payment id.
Idempotency-Key	header	string	Makes the write safely retryable. Any unique string per logical operation; a UUID is fine. The failure this prevents is specific: the request succeeds, the response is lost to a timeout, you retry, and the customer is billed twice. With a key, the retry returns the original response - same status, same body, same id - and creates nothing. The body is part of the key's identity. Reusing a key with a different body is a bug on your side, not a retry, and answers `409 idempotency_replay` rather than silently handing back the old response. Keys are remembered for 24 hours.

Body multipart/form-data

Field	Type	Description
filerequired	string	The file. Exactly one part named `file`; a second one, or `file[]`, is `400 invalid_request` so an idempotent retry can never half-succeed. Empty is refused. Over the cap (the smaller of `APIV2_MAX_UPLOAD_BYTES`, 64 MB by default, and PHP's `upload_max_filesize` / `post_max_size`) is `413 payload_too_large` naming the limit that applied.
filename	string(255)	Overrides the part's file name.
notes	text	Free text shown beside the file.
filedefinitionid	integer	Only when the parent accepts more than one list. Anything the parent does not accept is `422 unknown_value` naming the accepted ids.
filecategoryid	integer	Category by id.
filecategory	string(255)	Category by name. Sent with `filecategoryid` and disagreeing is `422 conflicting_reference`.

When it fails

Status	Code	Meaning
400	unknown_parameter	A form field that is not on the AttachmentUpload schema.
400	invalid_type	`filedefinitionid` or `filecategoryid` that is not an integer.
404	not_found	No payment with that id in this company.
409	upload_limit_reached	This file list allows a fixed number of files on a payment and it is full. Remove one first.
413	payload_too_large	The file is over the cap. The body names the limit that applied.
415	multipart_required	The body was not `multipart/form-data`.
422	unknown_value	`filedefinitionid` is not one this payment accepts, or the category does not exist in this company.

curl -X POST \
  'https://acme.nolapro.com/!/api/v2/payments/104/attachments' \
  -H 'Authorization: Bearer $NP_TOKEN' \
  -H 'Idempotency-Key: your-unique-key' \
  -F 'file=@grant-letter-signed.pdf' \
  -F 'filename=grant-letter-signed.pdf' \
  -F 'notes=Signed copy received 21 Sep' \
  -F 'filedefinitionid=8' \
  -F 'filecategory=Receipts'

$fields = [
    'filename' => 'grant-letter-signed.pdf',
    'notes' => 'Signed copy received 21 Sep',
    'filedefinitionid' => '8',
    'filecategory' => 'Receipts',
  ];
$fields['file'] = new CURLFile('grant-letter-signed.pdf');

$ch = curl_init('https://acme.nolapro.com/!/api/v2/payments/104/attachments');
curl_setopt_array($ch, [
  CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . getenv('NP_TOKEN'), 'Idempotency-Key: your-unique-key'],
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_POST           => true,
  CURLOPT_POSTFIELDS     => $fields,
]);
$res = json_decode(curl_exec($ch), true);

import os, requests

with open("grant-letter-signed.pdf", "rb") as fh:
    r = requests.post(
        "https://acme.nolapro.com/!/api/v2/payments/104/attachments",
        headers={"Authorization": f"Bearer {os.environ['NP_TOKEN']}", "Idempotency-Key": "your-unique-key"},
        files={"file": fh},
        data={
            "filename": "grant-letter-signed.pdf",
            "notes": "Signed copy received 21 Sep",
            "filedefinitionid": "8",
            "filecategory": "Receipts",
        },
    )
r.raise_for_status()

import { openAsBlob } from 'node:fs';

const form = new FormData();
form.append('file', await openAsBlob('grant-letter-signed.pdf'), 'grant-letter-signed.pdf');
form.append('filename', "grant-letter-signed.pdf");
form.append('notes', "Signed copy received 21 Sep");
form.append('filedefinitionid', "8");
form.append('filecategory', "Receipts");

const res = await fetch(
  'https://acme.nolapro.com/!/api/v2/payments/104/attachments',
  {
    method: 'POST',
    headers: { Authorization: `Bearer ${process.env.NP_TOKEN}`, 'Idempotency-Key': 'your-unique-key' },
    body: form,
  }
);
const data = await res.json();

var token = Environment.GetEnvironmentVariable("NP_TOKEN");

using var http = new HttpClient();
http.DefaultRequestHeaders.Add("Authorization", "Bearer " + token);

using var form = new MultipartFormDataContent();
form.Add(new StreamContent(File.OpenRead("grant-letter-signed.pdf")), "file", "grant-letter-signed.pdf");
form.Add(new StringContent("grant-letter-signed.pdf"), "filename");
form.Add(new StringContent("Signed copy received 21 Sep"), "notes");
form.Add(new StringContent("8"), "filedefinitionid");
form.Add(new StringContent("Receipts"), "filecategory");

var req = new HttpRequestMessage(HttpMethod.Post,
    "https://acme.nolapro.com/!/api/v2/payments/104/attachments") { Content = form };
req.Headers.Add("Idempotency-Key", "your-unique-key");

var res = await http.SendAsync(req);
res.EnsureSuccessStatusCode();

Order deposits →

Deposits taken against an order. A deposit alone makes an order invoiceable - arorder2invoice.php admits an order that has a deposit even when nothing has shipped. Card brand and number are never returned.

Daily closes →

End-of-day close records.