BUSINESS · TASKS
Customers, items, orders, and invoices on the ERPNext site they connect.
Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.
Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.
Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
erpnext_delete_api_resource_by_doctype_by_documentnameWRITEDelete one document permanently. Frappe refuses the delete when another document links to it. via DELETE /api/resource/{DocType}/{DocumentName}
erpnext_delete_api_v2_document_by_doctype_by_nameWRITEDelete one document permanently through Frappe's v2 route family. via DELETE /api/v2/document/{doctype}/{name}
erpnext_get_api_method_by_dotted_path_to_methodWRITECall any whitelisted server method by its dotted Python path, e.g. frappe.client.get_list. The method must be whitelisted in the site and the connected user must be allowed to call it. via GET /api/method/{method_path}
erpnext_get_api_method_frappe_auth_get_logged_userREADReturn the id of the user this connection acts as. The cheapest way to confirm a credential works and to see whose permissions the connection carries. via GET /api/method/frappe.auth.get_logged_user
erpnext_get_api_method_frappe_integrations_oauth2_authorizeWRITEThe site's own OAuth 2 authorization endpoint. Answers a redirect to the sign-in and consent screens. Agentic Fabriq's own connection already runs this flow; the tool exists because the endpoint is part of the documented surface. via GET /api/method/frappe.integrations.oauth2.authorize
erpnext_get_api_method_frappe_integrations_oauth2_openid_profileREADThe OpenID Connect userinfo endpoint: the signed-in user's profile claims for a token carrying the openid scope. via GET /api/method/frappe.integrations.oauth2.openid_profile
erpnext_get_api_method_logoutWRITEEnd the current site session. This connection authenticates with a token or an API key rather than a cookie session, so there is normally nothing to end. via GET /api/method/logout
erpnext_get_api_resource_by_doctypeREADList documents of one DocType, with optional field selection, filters and offset paging. `fields` and `filters` are JSON documents sent as a single query-string value, e.g. fields=["name","customer"] and filters=[["status","=","Open"]]. via GET /api/resource/{DocType}
erpnext_get_api_resource_by_doctype_by_documentnameREADRead one document by its DocType and its name (Frappe's primary key). via GET /api/resource/{DocType}/{DocumentName}
erpnext_get_api_v2_doctype_by_doctype_countREADCount the documents of one DocType, optionally filtered. via GET /api/v2/doctype/{doctype}/count
erpnext_get_api_v2_doctype_by_doctype_metaREADRead a DocType's metadata: its fields, their types and its permissions. The call to make first when a caller does not know a DocType's shape. via GET /api/v2/doctype/{doctype}/meta
erpnext_get_api_v2_document_by_doctypeREADList documents of one DocType through Frappe's v2 route family. The same capability as the v1 list, on the newer path. via GET /api/v2/document/{doctype}
erpnext_get_api_v2_document_by_doctype_by_nameREADRead one document through Frappe's v2 route family. via GET /api/v2/document/{doctype}/{name}
erpnext_get_api_v2_document_by_doctype_by_name_copyREADReturn a copy of one document as an unsaved draft, for a caller that wants to create a near-duplicate. via GET /api/v2/document/{doctype}/{name}/copy
erpnext_get_api_v2_document_by_doctype_by_name_method_by_methodWRITECall a whitelisted method that belongs to one document, without changing it. via GET /api/v2/document/{doctype}/{name}/method/{method}
erpnext_patch_api_v2_document_by_doctype_by_nameWRITEUpdate the named fields of one document through Frappe's v2 route family. via PATCH /api/v2/document/{doctype}/{name}
erpnext_post_api_method_frappe_integrations_oauth2_get_tokenWRITEThe site's own OAuth 2 token endpoint, for the authorization_code and refresh_token grants. Note that the path is slash-INTOLERANT: a trailing slash answers 301 and the body is dropped. via POST /api/method/frappe.integrations.oauth2.get_token
erpnext_post_api_method_frappe_integrations_oauth2_introspect_tokenREADRFC 7662 token introspection: whether a token is active, and what it carries. via POST /api/method/frappe.integrations.oauth2.introspect_token
erpnext_post_api_method_frappe_integrations_oauth2_revoke_tokenWRITERevoke an OAuth token at the site. Destructive: a token revoked here stops working immediately, including this connection's own if its value is passed. via POST /api/method/frappe.integrations.oauth2.revoke_token
erpnext_post_api_method_loginWRITEStart a password session on the site and receive an `sid` cookie. This integration does NOT use it: a cookie session is not a credential this connection stores or sends, so the call exists because ERPNext documents it, not because it connects anything. Note that it takes the user's password as a parameter. via POST /api/method/login
erpnext_post_api_resource_by_doctypeWRITECreate one document of the named DocType. The request body is the document's own fields, {"fieldname": value}. via POST /api/resource/{DocType}
erpnext_post_api_v2_document_by_doctypeWRITECreate one document through Frappe's v2 route family. via POST /api/v2/document/{doctype}
erpnext_post_api_v2_document_by_doctype_by_name_method_by_methodWRITECall a whitelisted method that belongs to one document, with a request body. This is how document actions such as submit and cancel are performed, so it can change the document. via POST /api/v2/document/{doctype}/{name}/method/{method}
erpnext_put_api_resource_by_doctype_by_documentnameWRITEUpdate one document in place. The body carries only the fields to change. via PUT /api/resource/{DocType}/{DocumentName}
erpnext_put_api_v2_document_by_doctype_by_nameWRITEReplace one document through Frappe's v2 route family. via PUT /api/v2/document/{doctype}/{name}
Put ERPNext behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.