DEVELOPER API
Everything in Cove, one clean REST API
A Hono-powered REST API at /api/v1, documented with OpenAPI 3.1. Issue invoices, record expenses and revenue, and manage clients and products — from your own code.
Interactive Scalar docs at app.joincove.io/api/v1/docs — every endpoint, callable straight from the browser.
REST /api/v1
Production-grade from the first request
The API is built on Hono with Zod schemas and published as an OpenAPI 3.1 spec at /api/v1/openapi.json. What the dashboard can do, your code can do.
Per-key rate limits
Configure limits per key. Every response returns quota headers, and overruns get a clean 429 instead of silent failures.
Idempotency keys
Retry a POST safely. Send an idempotency key and a network hiccup never creates a duplicate invoice.
Interactive Scalar docs
Call every endpoint straight from the browser at app.joincove.io/api/v1/docs — or generate a typed client from /api/v1/openapi.json.
Outbox-backed webhooks
Subscribe to workspace events and Cove delivers them to your HTTPS endpoint from a durable outbox, drained every one to two minutes — with every attempt visible in the delivery history.
One API across the whole workspace
Endpoints cover clients, invoices, receipts, expenses, revenue, products, documents, HR, calendar, and taxes.
Invoicing
Issue, update, and manage invoices and receipts programmatically.
Payroll and HR
Generate payroll runs and HR documents via dedicated endpoints.
Records and catalog
Clients, products, expenses, revenue, documents, and calendar events — full CRUD.
SECURITY
Every key scoped, every call logged
Keys are created, rotated, and revoked in the Developers section of your workspace. What each one can reach is explicit — and everything it does is on the record.
Scoped API keys
Each key carries explicit permission scopes, so an integration can only touch what you granted.
Your organization only
A key only ever sees your own organization's data, and the roughly 141 MCP tools are filtered by the same scopes.
Full request logging
Every call is logged, so you can trace exactly what an integration did and when.