Runs the full issuance pipeline: validation → gapless numbering → Tax Authority clearance → PDF render and digital signature. Returns 201, or 202 when the Authority holds the invoice. Send "draft": true to stop after validation and leave an unnumbered draft.

{
  "doc_type": 400,
  "issue_date": "2026-08-07",
  "customer_id": "019fda...",
  "payments": [
    { "method": "bank_transfer", "amount": 1121.00, "paid_date": "2026-08-07" },
    { "method": "withholding",   "amount": 59.00 }
  ],
  "linked_invoices": [
    { "invoice_id": "019fdac1-...", "amount": 1180.00 }
  ]
}

Issues an existing draft — same pipeline and same 201/202 semantics as an ordinary create. Issuing anything that is not a draft returns 409 MAKOR-DOC-060, which is also what a duplicate request looks like.

Valid only while the document is pending with allocation status rejected or objection; otherwise 409 MAKOR-ALLOC-001. If a reverse-charge resubmission is itself refused you get 409 MAKOR-ALLOC-002.

Asks for an allocation number for a document that is already issued — the other side of the gate. The gate asks while issuing; this asks afterwards, up to a year from the invoice date. It covers the three ways an invoice exists without a number: failed_retro_pending (the Authority was unreachable), rejected_continue (issued without one after a refusal) and not_required (under the threshold — the Authority allocates for these too). A document that already has a number is refused with 409 MAKOR-ALLOC-004: one invoice, one allocation. can_request_allocation on the document says in advance whether the call will be accepted.

curl -X POST 'https://makor.izid.io/api/v1/documents/{document_id}/allocation-request' \
  -H 'Authorization: Bearer mk_live_...'

HTTP/1.1 200 OK

{
  "outcome": "approved",
  "rejection_code": null,
  "rejection_message": null,
  "document": {
    "id": "019fdad4-...",
    "status": "issued",
    "doc_number": 42,
    "allocation_status": "approved",
    "allocation_number": "20260807123456782000000042",
    "allocation_number_short": "000000042",
    "can_request_allocation": false
  }
}

Returns { items, next_cursor }, newest first. List items omit lines, payments and open_balance — fetch a single document for those.

The full document, including lines[], payments[] and — for issued invoices and proformas — open_balance.

Deletes a draft. Anything already numbered returns 409 MAKOR-DOC-065 — issued documents are immutable and are cancelled or credited, never deleted.

Returns application/pdf. New originals are signed and stored at finalization; every later call returns those exact bytes, preserving the original file unchanged. Add ?copy=true for a copy (העתק) rendering. Drafts have no PDF (409 MAKOR-PDF-001).

Creates — or returns the existing — public link for the customer: { token, url }. The page lives at /d/{token}, needs no authentication, is served noindex, and offers the PDF at /d/{token}/pdf. Only issued or cancelled documents can be shared (409 MAKOR-SHARE-001).

Partial update. Editing a customer never changes documents already issued to them — those carry a frozen snapshot.

Soft-deletes (deactivates). History is preserved for the statutory retention period.

Lists live sequences (sandbox sequences are private): doc_type, doc_type_name_he, series, next_number, configured_start, locked.

The Bank of Israel rate for one currency on one date, normalised to a single unit (the Bank publishes some currencies per 100). 404 means the Bank did not publish that date — a weekend or a holiday — and 503 means the feed is unreachable. Both are answers rather than failures: send the rate you have.

The codes that may be used, each with its decimal places and display symbol.

Multipart with a single file field. Optional: direction (expense/income), year, month, external_ref. JPG, PNG or PDF up to 50MB; a multi-page PDF becomes one scan per page. Answers 202 with scan_ids, or 200 with {"scan_ids": [], "status": "duplicate"} when the same bytes were already filed — so retrying an upload is always safe.

Extraction runs in the background. Poll until status leaves processing, or subscribe to scan.ready. extraction.uncertain_fields is the model flagging its own reading; extraction.warnings is the server’s arithmetic disagreeing. Both mark what to check; neither blocks filing.

Nothing counts towards a report until it is approved. Send only what changed. Approval enforces what review only warned about: subtotal plus VAT must equal the total (MAKOR-SCAN-005), a total is required (-009), and a foreign-currency scan needs fx_rate (-010).

When extraction is unavailable — the switch is off, or no model is configured — the upload still succeeds and the scan lands in ready with empty fields and an extraction.skipped_reason. Treat that as a normal case, not an error.

Both fields are optional. Omitting to uses the address on the customer record; an explicit one wins. With neither you get MAKOR-MAIL-002 rather than a silent success. The From is מקור’s — that is what lets the message pass DKIM without every business publishing DNS records — with the business name in the subject and body. Reply-To is the business’s own address, so a reply reaches them.

status is sent, failed (with an error saying why — safe to retry) or captured — מצב ניסוי, where the message is built and logged but never posted. Every send fires a document.emailed webhook.

Everything this business sent lately, newest first. limit up to 100.

Returns monthly[] (month, total, vat), by_type[] and total.

Output VAT per month: periods[] with taxable and output_vat, plus total_output_vat.

Tax withheld at source per customer — the figures behind your annual טופס 806 reconciliation: customers[] and total_withheld.

Builds INI.TXT and BKMVDATA.TXT (fixed-width, ISO-8859-8, CRLF) inside the mandated OPENFRMT/{vat}.{yy}/{MMDDhhmm} folder structure and returns export_id, folder_name, record_counts and the closing_report — per document type, the count and total your accountant reconciles against.

Returns the ZIP archive. Accountant-role members can export even though they cannot issue anything — that is the whole point of the role.

Owner-only. The response contains the signing secret — shown once.

The last 50 attempts with event_type, status, response_status and attempt — the first place to look when an integration goes quiet.

Returns key (the full secret, once), key_id, the granted scopes and sandbox.

Metadata only — key_id, name, scopes, sandbox, last_used_at, revoked. Secrets are never retrievable.

Revokes immediately. Owner or employee role required.

Everything above assumes the business already has a Makor account and granted you access. When you are bringing a customer of your own, this call registers them and grants you access in the same operation. Authenticated with your operator key alone. Registering the A tax ID is registered once: if it is already yours you get409 MAKOR-REG-001 naming the business, and if it belongs to someone else,409 MAKOR-REG-004 — the business has to connect you from its own account. There is no scopes field: the grant opens fully, and the owner narrows or revokes it once they claim the business.

Returns data[] of business_id, legal_name, tax_id, scopes (the effective permission) and granted_at, plus has_more and next_offset. Parameters: limit (default 100, max 500) and offset. This is the only call where an operator key is valid without a business in the path.

Owner-only — an operator can never add itself. Granting twice returns 409 MAKOR-OP-001; re-granting after a revoke reuses the same record, so the history of who was connected stays in one place.

Disconnects the operator from this business only. It takes effect on the next request and touches neither the operator’s key nor any of its other businesses.