/v1/invoices surface.
Auth
Invoice endpoints accept secret (sk_…) or restricted (rk_…) keys only. Publishable (pk_…) keys are always rejected because invoices contain customer PII, amounts, and payment proofs — they are never client-safe.
Dashboard sessions continue to work with the existing role-based access (invoices:read, invoices:write, invoices:send).
Required key permissions
A secret key with no explicit permission list is full-access (Stripe “standard secret”). A restricted key must carry an explicit invoice permission.
List invoices
Query params
string
Filter by status:
DRAFT, ISSUED, PAID, VOID, or OVERDUE.string
Search by invoice number, customer email, or customer wallet.
Response
Retrieve an invoice
lineItems, deliveries, creditNotes, and refunds, plus a signed downloadUrl for the PDF and an iso20022DownloadUrl.
Download the invoice PDF
ISO 20022 export
rem.001.001.07 ISO 20022 XML credit-transfer file for the invoice.
Create an invoice
invoice.issued webhook fires. When a customerEmail is provided, the invoice is emailed to the customer.
Update invoice status (mark paid / void / overdue)
Payment, fires the invoice.paid webhook, and sends the customer a receipt.
Credit notes
Refunds
Resend by email
customerEmail.
Errors
API-key calls are scoped to the team and the workspace environment the key was created in. A
sk_test_… key only sees the development invoices; a sk_live_… key only sees production invoices.
