ERPNext

BUSINESS · TASKS

Customers, items, orders, and invoices on the ERPNext site they connect.

Connecting ERPNext in practice

Every ERPNext is somebody else’s self-hosted Frappe site, so the base URL, the version and the permission model differ per tenant, and the api_key:api_secret pair is bound to one user whose roles are checked on every request. A list call returns 20 records and only the `name` field unless you ask for more, so the obvious "get all customers" call comes back as a page of ids.

Scopes that draw scrutiny

Authorization: token api_key:api_secret Frappe’s token auth. There are no scope tokens: the key inherits every role of the user it was generated for, and each request is logged against that user.
Whitelisted remote methods (Frappe’s own term) Anything outside the REST resource endpoints is reachable only if a developer marked the method whitelisted, so the callable surface of a site depends on its installed apps rather than on the published API.

Worth knowing

A POST to a remote method calls frappe.db.commit() automatically, so a half-finished multi-step write is already durable when the next call fails.
Pagination is `limit_start` and `limit_page_length`, aliased to `limit` in v13, and the default page is 20 records with only the `name` field — `fields` has to be passed to get anything else.
Three auth mechanisms coexist (token pair, OAuth bearer, and a cookie session from /api/method/login), and a tenant may have disabled the one your integration assumes.
The REST API guide publishes no rate limit, so throughput is a property of the tenant’s own hosting rather than of the platform.

Checked against Frappe REST API (2026-09-29), Frappe REST API (markdown source) (2026-09-29)

Acts as the person, not as itself

Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.

Credentials never touch the agent

Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.

Every call on the record

Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.

What an agent can do

Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.

erpnext_delete_api_resource_by_doctype_by_documentnameWRITE

Delete one document permanently. Frappe refuses the delete when another document links to it. via DELETE /api/resource/{DocType}/{DocumentName}

api

erpnext_delete_api_v2_document_by_doctype_by_nameWRITE

Delete one document permanently through Frappe's v2 route family. via DELETE /api/v2/document/{doctype}/{name}

api

erpnext_get_api_method_by_dotted_path_to_methodWRITE

Call any whitelisted server method by its dotted Python path, e.g. frappe.client.get_list. The method must be whitelisted in the site and the connected user must be allowed to call it. via GET /api/method/{method_path}

api

erpnext_get_api_method_frappe_auth_get_logged_userREAD

Return the id of the user this connection acts as. The cheapest way to confirm a credential works and to see whose permissions the connection carries. via GET /api/method/frappe.auth.get_logged_user

api

erpnext_get_api_method_frappe_integrations_oauth2_authorizeWRITE

The site's own OAuth 2 authorization endpoint. Answers a redirect to the sign-in and consent screens. Agentic Fabriq's own connection already runs this flow; the tool exists because the endpoint is part of the documented surface. via GET /api/method/frappe.integrations.oauth2.authorize

api

erpnext_get_api_method_frappe_integrations_oauth2_openid_profileREAD

The OpenID Connect userinfo endpoint: the signed-in user's profile claims for a token carrying the openid scope. via GET /api/method/frappe.integrations.oauth2.openid_profile

api

erpnext_get_api_method_logoutWRITE

End the current site session. This connection authenticates with a token or an API key rather than a cookie session, so there is normally nothing to end. via GET /api/method/logout

api

erpnext_get_api_resource_by_doctypeREAD

List documents of one DocType, with optional field selection, filters and offset paging. `fields` and `filters` are JSON documents sent as a single query-string value, e.g. fields=["name","customer"] and filters=[["status","=","Open"]]. via GET /api/resource/{DocType}

api

erpnext_get_api_resource_by_doctype_by_documentnameREAD

Read one document by its DocType and its name (Frappe's primary key). via GET /api/resource/{DocType}/{DocumentName}

api

erpnext_get_api_v2_doctype_by_doctype_countREAD

Count the documents of one DocType, optionally filtered. via GET /api/v2/doctype/{doctype}/count

api

erpnext_get_api_v2_doctype_by_doctype_metaREAD

Read a DocType's metadata: its fields, their types and its permissions. The call to make first when a caller does not know a DocType's shape. via GET /api/v2/doctype/{doctype}/meta

api

erpnext_get_api_v2_document_by_doctypeREAD

List documents of one DocType through Frappe's v2 route family. The same capability as the v1 list, on the newer path. via GET /api/v2/document/{doctype}

api

erpnext_get_api_v2_document_by_doctype_by_nameREAD

Read one document through Frappe's v2 route family. via GET /api/v2/document/{doctype}/{name}

api

erpnext_get_api_v2_document_by_doctype_by_name_copyREAD

Return a copy of one document as an unsaved draft, for a caller that wants to create a near-duplicate. via GET /api/v2/document/{doctype}/{name}/copy

api

erpnext_get_api_v2_document_by_doctype_by_name_method_by_methodWRITE

Call a whitelisted method that belongs to one document, without changing it. via GET /api/v2/document/{doctype}/{name}/method/{method}

api

erpnext_patch_api_v2_document_by_doctype_by_nameWRITE

Update the named fields of one document through Frappe's v2 route family. via PATCH /api/v2/document/{doctype}/{name}

api

erpnext_post_api_method_frappe_integrations_oauth2_get_tokenWRITE

The site's own OAuth 2 token endpoint, for the authorization_code and refresh_token grants. Note that the path is slash-INTOLERANT: a trailing slash answers 301 and the body is dropped. via POST /api/method/frappe.integrations.oauth2.get_token

api

erpnext_post_api_method_frappe_integrations_oauth2_introspect_tokenREAD

RFC 7662 token introspection: whether a token is active, and what it carries. via POST /api/method/frappe.integrations.oauth2.introspect_token

api

erpnext_post_api_method_frappe_integrations_oauth2_revoke_tokenWRITE

Revoke an OAuth token at the site. Destructive: a token revoked here stops working immediately, including this connection's own if its value is passed. via POST /api/method/frappe.integrations.oauth2.revoke_token

api

erpnext_post_api_method_loginWRITE

Start a password session on the site and receive an `sid` cookie. This integration does NOT use it: a cookie session is not a credential this connection stores or sends, so the call exists because ERPNext documents it, not because it connects anything. Note that it takes the user's password as a parameter. via POST /api/method/login

api

erpnext_post_api_resource_by_doctypeWRITE

Create one document of the named DocType. The request body is the document's own fields, {"fieldname": value}. via POST /api/resource/{DocType}

api

erpnext_post_api_v2_document_by_doctypeWRITE

Create one document through Frappe's v2 route family. via POST /api/v2/document/{doctype}

api

erpnext_post_api_v2_document_by_doctype_by_name_method_by_methodWRITE

Call a whitelisted method that belongs to one document, with a request body. This is how document actions such as submit and cancel are performed, so it can change the document. via POST /api/v2/document/{doctype}/{name}/method/{method}

api

erpnext_put_api_resource_by_doctype_by_documentnameWRITE

Update one document in place. The body carries only the fields to change. via PUT /api/resource/{DocType}/{DocumentName}

api

erpnext_put_api_v2_document_by_doctype_by_nameWRITE

Replace one document through Frappe's v2 route family. via PUT /api/v2/document/{doctype}/{name}

api