Overview

The Büro API is available over gRPC and HTTP/JSON. Use the left nav to pick an interface.

The first-party Büro API includes a catalog family at /v1/contacts and /v1/articles, invoices at /v1/invoices (including POST /v1/invoices/{id}/schluss to draft a Schlussrechnung from an Abschlag), recurring templates at POST /v1/recurring-templates and POST /v1/recurring-templates/{id}/run, quotations at /v1/quotations (including pursue), and storno at /v1/invoices/{id}/storno. POST /v1/invoices accepts language (de | en) and taxRegime (standard | intraCommunity | export | reverseCharge13b). Seller VAT lives on Organization.vatId. Organization Beleglayout fields are street, postalCode, city, taxNumber, accentColor, and hasLogo. PUT, GET, and DELETE /v1/organizations/current/logo upload, download, or remove the logo. Layout writes (those PATCH fields and logo PUT/DELETE) require Edition XL. GET /v1/invoices/{id}/xrechnung returns application/xml (XRechnung 3.0 UBL) for an eligible finalized invoice. That path is first-party REST and may not appear as a generated gRPC RPC. Büro does not send the XRechnung over Peppol. POST /v1/delivery-notes/sammel-invoice creates a draft Sammelrechnung from two or more finalized Lieferscheine (Edition XL). DELETE /v1/invoices/{id} discards a draft collective invoice only. Those paths are first-party REST and may not appear as generated gRPC RPCs.

Kundencenter is first-party REST: POST /v1/contacts/{id}/portal-link creates a link, POST /v1/portal/{token}/unlock unlocks with the contact postal code, GET /v1/portal/{token}/items lists finalized quotations and invoices, and GET /v1/portal/{token}/file/{kind}/{id} downloads a PDF. Unlock sets the HttpOnly cookie buero_portal. Those paths may not appear as generated gRPC RPCs.

Kundenakte is first-party REST (Edition XL): GET/POST /v1/contacts/{id}/notes lists and adds notes, GET/POST /v1/contacts/{id}/files lists and attaches folder files (after POST /v1/files). Those paths may not appear as generated gRPC RPCs. Büro does not invent contacts from OCR.

Incoming Belege are first-party REST (not gRPC): POST /v1/files multipart (file, optional type=voucher) returns 201 {id,...} and 502 when S3 env is unset (Objektpeicher ist nicht konfiguriert); GET /v1/files/{id} returns the file bytes; GET/POST /v1/vouchers and GET/PUT /v1/vouchers/{id} manage the bookkeeping voucher (purchaseinvoice). Those paths may not appear as generated gRPC RPCs. Büro does not offer an inbound invoice mailbox.

DATEV Belege online is hand-written HTTP on the app host (cookie companion_session), documented under REST → DATEV. It is not a DATEV-Datei export and not part of the generated OpenAPI file.

Local books are first-party REST (not gRPC): GET /v1/postings, GET /v1/posting-categories, and GET /v1/archive/files require Edition L+ (FeatReports). PATCH Organization festgeschriebenThrough sets the inclusive lock date (cannot clear or move backward). Mutating a locked Beleg returns 409 FESTGESCHRIEBEN. Those paths may not appear as generated gRPC RPCs.

Kasse and Anlagen are first-party REST (not gRPC): /v1/cashbook, /v1/cashbook/entries, /v1/assets, /v1/assets/{id}/depreciate, /v1/vouchers/{id}/asset require L+ (FeatCashbook / FeatAssets). Those paths may not appear as generated gRPC RPCs.

Mitarbeiter Stammdaten are first-party REST (not gRPC): GET/POST /v1/employees and GET/PATCH /v1/employees/{id} require organization.lohnEnabled. There is no Abrechnung. Those paths may not appear as generated gRPC RPCs.

Reports are first-party REST: GET /v1/reports/euer, GET /v1/reports/guv, GET /v1/reports/bwa, GET /v1/reports/ustva, GET /v1/reports/zm, GET /v1/reports/liquidity, GET /v1/reports/year-end, GET /v1/reports/export, and GET /v1/reports/{kind}/file require L+ (FeatReports). EÜR requires booksBasis EUER. Büro does not submit reports to ELSTER. Those paths may not appear as generated gRPC RPCs.

The first product sample is contacts (GET /v1/contacts / CatalogService), not Hello. Authenticate REST with an XL Inhaber API key: POST /v1/api-keys returns token once; send Authorization: Bearer <token>. Keys are hashed at rest. Event subscriptions POST JSON to callbackUrl with X-Buero-Signature: sha256=<hex> (HMAC-SHA256 of the raw body). Do not call api.lexware.io or expect X-Lxo-Signature.

Interface	What you can do
gRPC	Call services over gRPC. See every RPC in the reference.
REST	Call the same API over HTTP/JSON. Open the API reference for paths and examples.
CLI	Run platform from a terminal. Install or download a binary.
SDK	Use Go, TypeScript, or Python from your own code.
MCP	Connect an editor or agent. Install or download platform-mcp.