The documents API is a read-only HTTP interface. It returns the documents Easy Invoices issued for a shop as a list of changes, and each document’s PDF.
Three document kinds: invoices, credit notes and cancellation invoices, each with its own list.
Read-only: nothing can be created, changed or deleted through the API.
Pull, not push: your system polls, we never call your servers.
Only issued documents with a finished PDF are listed — retroactively for all past ones too.
Authentication
Every request needs one of the shop’s API tokens in the Authorization header. The shop owner creates it in the app: Settings → Advanced → Manage API access.
A token starts with ei_live_ and is shown exactly once. We do not store it in plain text.
Valid for 30, 90, 180 or 365 days; after that, create a new token. For an integration that runs unattended for good there is also a token that never expires: it stays valid until it is revoked.
At most three active tokens per shop. A token can be revoked in the app at any time and stops working immediately.
The token belongs in the header only — never in the URL, source code or an email.
Header
Authorization: Bearer ei_live_…
Quickstart
A sync takes four steps. The first run returns everything, every run after that only what is new or has changed.
1
First run
Call the list with type=INVOICE and a start date in updatedSince. Without updatedSince you receive all documents from the beginning.
2
Page through
As long as hasMore is true, call again right away and pass nextCursor as cursor.
3
Fetch the PDF
Every document carries pdfUrl. Call it with the same token.
4
Repeat regularly
Store the last nextCursor and pass it on the next run, e.g. every 15 minutes.
The API is also available in machine-readable form: as an OpenAPI specification and as a ready-made Postman collection. Both are generated from the API’s code, so they always match this page.
GET /public/documents/{id}/pdf?type=… returns the PDF of a listed document as a download. Simply use the pdfUrl from the list.
The ETag header is a SHA-256 of the file. It stays the same while the PDF is unchanged.
Documents of another shop, or ones not finished yet, return 404.
Document fields
Every element of data has these fields.
Field
Type
Meaning
id
string
Stable id. Together with type, your key against duplicates.
type
string
INVOICE, CREDIT_NOTE or CANCELLATION.
number
string
Document number as printed on the PDF.
orderAttributes
list
Additional details of the Shopify order (name, value) as they stood when the invoice was issued. Marketplace connectors store their own order number here. Values containing an email address are left out.
orderTags
list
Tags of the Shopify order when the invoice was issued.
orderId
string
Numeric Shopify order id.
orderNumber
string
Shopify order number without prefix (e.g. 2909). Not the number on the marketplace.
isActive
boolean
For invoices, false once replaced by a corrected one. Then check whether you need to withdraw a document you already passed on.
relatedInvoiceId
string | null
For credit notes and cancellation invoices, the id of the related invoice.
issueDate
ISO 8601
Issue date.
status
string
Processing status, e.g. EMAIL_SENT.
currency
ISO 4217
Currency, e.g. EUR.
totalGross
string
Gross amount with a dot as decimal separator, e.g. 41.80.
updatedAt
ISO 8601
Last change. The list is ordered by it.
pdfUrl
URL
Full address of the PDF, fetched with the same token.
Credit notes and cancellation invoices carry the order details of the invoice they refer to.
Syncing reliably
The list is a change log: nothing is skipped, but a document may appear more than once.
A document appears again when it changes, e.g. when its email was delivered or an invoice was replaced. Recognise duplicates by type and id.
nextCursor comes with every response, including empty ones. Always store the latest.
Changes from the last 30 seconds are held back, so a change still being written is never skipped.
Keep track of which documents your target system already received rather than relying on the cursor alone.
Matching documents to marketplace orders
Marketplace connectors store their own order number in the additional details of the Shopify order. You find them in orderAttributes — no Shopify access needed.
Connector
Attribute
Example value
Order_id
Mirakl Connect (e.g. Shop Apotheke)
COM-277476493-2-A
eBay Order Id
eBay
01-15351-70916
Mirakl Connect: uploading an invoice (POST /v2/orders/{order_id}/documents) expects the Connect order id, not the marketplace number. List Connect orders with v2-listOrders and updated_from, find the order whose channel_order_id matches Order_id, and upload the PDF as CUSTOMER_INVOICE. v2-listOrderDocuments shows whether an invoice is already there.
Which attributes a connector writes is up to the connector. Check a real order before relying on them.
Errors and limits
Errors come as an HTTP status with a JSON body. Error responses never contain document data.
Per token: 60 list calls and 120 PDF downloads per minute, 25,000 calls per day.
Per IP address: 120 requests per minute and route.
Status
Meaning
What to do
400
Bad request
E.g. cursor and updatedSince together, or a cursor of another document kind. Fix the request.
401
Unauthorized
The token is missing, invalid, expired or revoked. Retrying does not help — create a new token.
404
Not found
The document does not exist or does not belong to the token’s shop.
429
Too many requests
Wait as many seconds as Retry-After says.
503
Temporarily unavailable
Try again after Retry-After.
Still have questions?
Our support team helps you right in the app or by email.
Strictly necessary cookies are always set. The three optional purposes below are set only with your consent — you can choose each one separately and change your decision at any time via “Cookie settings” in the footer. Details in our Privacy Policy
.
The optional purposes are: Statistics (Google Analytics 4, Google Ireland Limited), Marketing (Meta Pixel and Conversions API, Meta Platforms Ireland Limited) and Company identification (Pipedrive Web Visitors / Leadfeeder Oy, Finland — uses your IP address to determine which company is visiting us, and files it as a sales contact). “Adjust settings” lists exactly which data each one transmits.
For statistics and marketing, data may be transferred to the USA and combined there with data from other sources. Google and Meta are certified under the EU-US Data Privacy Framework; a level of protection equivalent to the EU still cannot be guaranteed. By making your selection you expressly consent to this transfer (Art. 49 (1) (a) GDPR). A withdrawal takes effect immediately, for the future.