Digits

Exchange an authorization code for a refresh token, or a refresh token for a new access token.

Create or reactivate multiple client employees' access across multiple client organizations in a single request. Users and client organizations must already exist. This operation is synchronous. An entry for an already-active employee binding succeeds without changing access when the request matches existing access; otherwise, that entry fails with AlreadyExists. Use Update Client Employee to fully replace access for active employee bindings. When reactivating an employee, supplied roles are applied and access omitted from the entry is not removed. Requires scope: `organization:sync`.

Remove employee access across multiple client organizations by Digits-assigned user ID or caller-assigned user ID. Maximum 100 per request. Removes matching client employee bindings and entity-role bindings for those clients' entities. Underlying users and affiliation/client roles are not deleted. Requires scope: `organization:sync`.

Create or reactivate a client employee's access to a client organization. Both the user and client organization must already exist. This operation is synchronous. If the client employee binding already exists and is active, the request fails with AlreadyExists; use Update Client Employee to fully replace access for an active employee binding. When reactivating a client employee, supplied roles are applied and access omitted from the request is not removed. Requires scope: `organization:sync`.

Remove a client employee's access to a client organization. Removes the client employee binding in the client organization and entity-role bindings for that client's entities. The underlying user and affiliation/client roles are not deleted. Requires scope: `organization:sync`.

Get a single client employee within a client organization by their Digits-assigned user ID.

List all client employees with access to a client organization.

Replace a client employee's access within a client organization. The client employee binding must already exist and be active. If it does not exist or is not active, the request fails with NotFound; use Create Client Employee to create or reactivate access. This operation is synchronous and declarative: the client employee's organization role and entity-role bindings within this client organization are replaced by the request body. Requires scope: `organization:sync`.

Delete multiple client entities by Digits-assigned ID or caller-assigned ID. Maximum 100 per request. Removes all employee entity-role bindings for the specified entities. Requires scope: `organization:sync`.

Create a new entity within a client organization. The entity object is created synchronously, but data provisioning completes asynchronously. Requires scope: `organization:sync`.

Delete an entity within a client organization. Removes all employee entity-role bindings for this entity. Requires scope: `organization:sync`.

Get a single entity within a client organization by its Digits-assigned ID.

List all entities within a client organization.

Create or update a payment instrument owned by a client entity.

Delete client payment instruments by Digits-assigned or caller-assigned IDs. Unknown IDs are skipped. A deleted payment instrument becomes unavailable for any future payments; any in-flight payments continue to use it.

Find client payment instruments by Digits-assigned or caller-assigned IDs.

Read endpoint to get company information, including fiscal year start month and earliest transaction date.

List all connection sources.

Sync endpoint to create, update, and delete connection sources. Connection sources organize transactions (for example, by bank account; or to separate bills and invoices) Labels allow seamless reference to the chart of accounts within the Ledger.

Create or update a payment instrument owned by an organization entity. The entity's first instrument becomes its default funding instrument; an existing default is never overwritten.

Delete entity payment instruments by Digits-assigned or caller-assigned IDs. Unknown IDs are skipped. A deleted payment instrument becomes unavailable for any future payments; any in-flight payments continue to use it.

Find entity payment instruments by Digits-assigned or caller-assigned IDs.

Get a single category by its ID.

Fetch the full Chart of Accounts from the Ledger.

Get a single ledger department by its ID.

List ledger departments.

Get a single ledger location by its ID.

List ledger locations.

Get a single ledger party by its ID.

List ledger parties.

Get a single ledger project by its ID.

List ledger projects.

Generate an accounts payable aging report.

Generate an accounts receivable aging report.

Generate a balance sheet statement.

Generate a cash flow statement.

Generate a profit and loss statement.

Generate a trial balance statement.

Get a summary of ledger transactions.

List ledger entries.

Get a ledger transaction by its ID.

Query ledger entries.

Provision multiple client organizations in a single request. Maximum 100 entities total across all clients per request. Each client is created synchronously, but entity data provisioning completes asynchronously. Requires scope: `organization:sync`.

Delete multiple client organizations by Digits-assigned ID or caller-assigned ID. Maximum 100 per request. Client organizations and their entities are removed. Employee bindings in each client organization and entity-role bindings on each client's entities are removed. Users are not deleted. Requires scope: `organization:sync`.

Provision a new client organization with one or more entities. The client and entity objects are created synchronously, but data provisioning for each entity completes asynchronously. Requires scope: `organization:sync`.

Delete a client organization managed by the caller's organization. The client organization and its entities are removed. Employee bindings in the client organization and entity-role bindings on the client's entities are removed. Users are not deleted. Requires scope: `organization:sync`.

Get a single client organization by its Digits-assigned ID.

List all client organizations affiliated with the organization.

Delete multiple employee bindings by Digits-assigned user ID or caller-assigned user ID. Maximum 100 per request. Deletes matching employee bindings and removes their entity-role and client-role bindings. Underlying users are not deleted. Requires scope: `organization:sync`.

Create or reactivate an employee binding. The user must already exist (either provisioned via SSO or as an existing Digits user). This operation is synchronous. If the employee binding already exists and is active, the request fails with AlreadyExists; use Update Employee to fully replace access for an active employee binding. When reactivating an employee, supplied roles are applied and access omitted from the request is not removed. Requires scope: `organization:sync`.

Delete an employee binding in the caller's organization. Removes all of the employee's entity-role and client-role bindings. The underlying user is not deleted. Requires scope: `organization:sync`.

Get a single employee by their Digits-assigned ID.

List all employees in the organization.

Fully replace an employee binding. The user must already exist and have an active employee binding. The request must identify the employee by Digits-assigned ID or caller-assigned user ID, include the employee's organization role, and may include entity access (`entities` and/or `entityRole`), client access (`clients` and/or `clientRole`), or both. `entityRole` and `clientRole` are stored as employee-level defaults for future entities or client entities and are applied to current access unless explicit `entities` or `clients` entries override them. Access omitted from the request is removed. Requires scope: `organization:sync`.

Create a new entity within the organization. The entity object is created synchronously, but data provisioning (chart of accounts, etc.) completes asynchronously. Requires scope: `organization:sync`.

Delete an entity. Deleting an entity also removes all employee access bindings for that entity. Requires scope: `organization:sync`.

Get a single entity by its Digits-assigned ID.

List all entities in the organization.

Returns the caller's organization, including its Digits-assigned ID and, when set, its caller-assigned ID.

List the departments provided by this source.

Batch sync endpoint to create, update, and delete departments. Idempotence and deduplication is handled via the external_id field on each department.

List the locations provided by this source.

Batch sync endpoint to create, update, and delete locations. Idempotence and deduplication is handled via the external_id field on each location.

Batch endpoint to store time series metric samples.

List the parties provided by this source.

Batch sync endpoint to create, update, and delete parties. Idempotence and deduplication is handled via the external_id field on each party.

List the products provided by this source.

Batch sync endpoint to create, update, and delete products. Idempotence and deduplication is handled via the external_id field on each product.

List the projects provided by this source.

Batch sync endpoint to create, update, and delete projects. Idempotence and deduplication is handled via the external_id field on each project.

Delete transactions by external ID.

Batch sync endpoint to create or update transactions. Idempotence and deduplication is handled via the external_id field on each transaction.

Audit all SSO users in the organization with their current client organization access.

Returns the SSO configuration for the organization. The organization must have SSO previously configured.

Delete multiple SSO users by Digits-assigned ID or caller-assigned ID. The organization must have SSO configured. Removes each user and their employee and entity access from the organization and its client organizations. This operation is synchronous. Requires scope: `user:sync`.

Create a new SSO user. The organization must have SSO configured. A deleted user is reactivated when recreated by the same identity provider, whether under the previous subject identifier or a new one. Recreation from a different identity provider is rejected. Returns the Digits-assigned ID and caller-assigned ID mapping. This operation is synchronous. Requires scope: `user:sync`.

Delete an SSO user. The organization must have SSO configured. Removes the user and their employee and entity access from the organization and its client organizations. This operation is synchronous. Requires scope: `user:sync`.

Get a single SSO user by their Digits-assigned ID. The organization must have SSO configured.

List all SSO users in the organization. The organization must have SSO configured.

Approve one or more bills awaiting approval. Requires scope: `bills:manage`.

Delete one or more pre-approval bills. Requires scope: `bills:manage`.

Get a workflow bill by its Digits-assigned ID. Requires scope: `bills:manage`.

Pay one or more approved bills, either through Digits-managed payment rails or by recording an external/manual payment. Requires scope: `bills:manage`.

Query workflow bills visible to the caller. Requires scope: `bills:manage`.

Reject one or more bills awaiting approval. Requires scope: `bills:manage`.

Submit one or more draft bills for approval. Requires scope: `bills:manage`.

Report externally managed payment lifecycle updates for one or more bills. Requires scope: `bills:manage`.

Void one or more eligible bills. Requires scope: `bills:manage`.