Overview
With the Finovia API a company, or a business system acting on the company's behalf, submits its customer invoices to Finovia and follows what happens to them.
Status: draft. The contract is written but not built. Fields and responses may change until version 1.0.0 is published. After that, a change that breaks backwards compatibility becomes a new version in the path (/v2), and /v1 remains available until an announced end date.
Two kinds of callers, one API
- A company that is a Finovia client reaches its own invoices.
- A business system (partner) reaches only the clients that have approved it themselves, in Finovia's client portal. The client approves each business system once and can end the connection at any time.
The client is always given in the path: /v1/clients/{clientId}/.... A client the caller cannot reach returns 404, never 403, so that the response does not reveal that the client exists at Finovia. The connection to the client is checked before anything else in the request. 403 only means that the token lacks the scope for the operation. An ended connection applies from the next request: no more invoices, no more events in the feed and no more webhooks for that client.
Language
Error messages (message in FieldError and failure, and title and detail in errors) are written in Swedish or English. Choose with the Accept-Language header: sv or en. Without the header, or with any other language, they are in Swedish. The response states the language in Content-Language.
Build your logic on code, never on the message. Codes are the same in both languages and do not change; messages may be reworded.
Absence
When Finovia does not have a value, it is shown as absence with a reason (state: absent and reason), never as null, zero or an omitted field that could be read as something else.
Receiving is not registering
A submitted invoice is answered with 202 Accepted and a submission with its own id. The invoice is then checked and handed over to invoice processing. Follow the submission with GET .../invoice-submissions/{id}, with webhooks or with the event feed GET /v1/events.
received ─┬→ validated ─┬→ handed_over ─┬→ registered
│ │ └→ registration_failed
│ └→ registration_failed (stopped before hand-over, e.g. no purchase agreement)
└→ rejected (field errors, or the invoice number is already in use)
202 means received. It never means that Finovia has purchased the invoice. Whether the invoice is purchased depends on the client's agreement with Finovia and shows in the invoice's financing_status.
Sent is sent
A registered invoice cannot be changed or deleted. A wrong invoice is corrected with a credit note and a new invoice.
An invoice that was rejected or whose submission ended in registration_failed was never registered. Correct it and submit it again, with the same invoice number and a new Idempotency-Key.
Amounts
Amounts are always strings with a dot as decimal separator, for example "12500.00", never JSON numbers. The currency is always given, as ISO 4217. An invoice without a currency is rejected; it never becomes SEK. An amount has at most as many decimals as its currency (two for SEK and EUR). Every amount on an invoice has the invoice's currency and the basis its field states; otherwise the invoice is rejected.
On a credit note, unit_price, face_amount, tax_reduction and amount_due are negative, and is_credit_note is true.
Finovia does not check the sum of the lines against face_amount before hand-over; VAT and rounding per line are calculated by invoice processing. After registration the registered amount is reconciled with amount_due to the öre. If they differ, Finovia's staff sees it, and the submission ends in registration_failed with the code amount_mismatch.
Unknown is never a status
When Finovia does not know a status, it is shown as absence (state: absent) with a reason. It never means unpaid, approved or anything else. New values may be added to code lists without a new version; a client must tolerate a value it does not recognise.
Sandbox and production
The sandbox accepts invoices freely and never sends anything to a real recipient. Production is closed until Finovia opens it.
Getting started in the sandbox
1. Confirm the sandbox terms below to Finovia. Finovia hands out no credentials before that. 2. Get your credentials from Finovia: the sandbox address, a client id, a secret and the id of a fictitious test client that your key reaches. The secret is shown once; Finovia only keeps its hash. 3. Get a token: POST /v1/oauth/token with grant_type=client_credentials, client_id and client_secret, form-encoded or as HTTP Basic. The token is valid for 15 minutes. 4. Submit an invoice to POST /v1/clients/{clientId}/invoices with an Idempotency-Key, and follow it with GET .../invoice-submissions/{id} or GET /v1/events.
What is different in the sandbox:
- Responses are simulated. Every response carries the header
Finovia-Sandbox: simulated. A valid invoice is registered after a few seconds; nothing reaches invoice processing, and the statuses are those of a new invoice. - Private persons only with Skatteverket's test numbers. A recipient that is a private person must be identified with one of Skatteverket's published test personal identity numbers, with twelve digits (
YYYYMMDDNNNN). Any other personal identity number is rejected with sandbox_requires_test_personnummer, and so is a personal identity number in any other field. - Nothing is kept. Submissions are held in memory and deleted after seven days, or when the sandbox restarts. A PDF is accepted but never stored.
- Limits: at most 10 MB per request and 1,000 submissions per API client.
- Webhooks are not available yet and return 501. Use
GET /v1/events. - This documentation is open at
https://developer.finovia.se/docs, and the contract itself at https://developer.finovia.se/openapi.yaml, without a token. Generate a client from the contract if you like; it is the source. API calls go to https://sandbox.api.finovia.se.
Sandbox terms
These terms apply to everyone who uses the sandbox. They are also part of the partnership agreement with Finovia.
1. Only fictitious data. Never real personal data or real customers' data, and never a copy of production data. This includes names, addresses and free text about private persons. 2. Personal identity numbers only from Skatteverket's list of test numbers, and only as the recipient's number. 3. The sandbox is not production. Nothing is registered, and everything is deleted after seven days. 4. Keep the secret secret. Report a leak to Finovia immediately. Finovia may revoke the key at any time. 5. If real data is sent by mistake, tell Finovia, and Finovia deletes it. 6. No security testing or load testing without Finovia's written consent. 7. Finovia logs your calls: when, which operation, the result and the error code. Never the content. 8. Finovia may suspend your key at any time, and does so on suspicion of a breach of these terms. 9. The sandbox is provided as is. No availability is guaranteed, and it may change or be emptied without notice. 10. Keep it confidential. What you learn from Finovia that is not public, and your key, is not passed on.
Servers
https://sandbox.api.finovia.seSandbox. Documentation and the developer portal are at https://developer.finovia.se.
https://api.finovia.seProduction. Closed for now. The address is preliminary.