Scalar360 API

A REST API for everything in Scalar360 — 1257 operations across 59 modules, from invoices and customers to stock, accounts, CRM and payroll. Authenticate with OAuth 2.0 and call the API as a Scalar360 user, inside their organisation, role and plan.

AuthenticationRegister a client and get tokens with OAuth 2.0 ScopesGrant only the modules and operations you need Responses & limitsResponse format, errors, pagination and rate limits OpenAPI 3.0Download the machine-readable specification

The basics

Base URL	`https://api.scalar360.com`
Authentication	OAuth 2.0 — `Authorization: Scalar360-oauthtoken <access_token>` (`Bearer` also works)
Format	JSON request and response bodies, UTF-8
Access token lifetime	1 hour; use a refresh token for long-running integrations
Rate limit	100 requests per minute per access token
Versioning	Paths carry the version where applicable, e.g. `/api/v1/invoices`

Quickstart: your first call in 5 minutes

This uses a self client — the fastest way to call the API from your own script or server.

1. Register a self client

In Scalar360, open Super Intelligence → Developer API, choose Add client → Self client, and copy the Client ID and Client Secret. The secret is shown once.

2. Generate a grant code

On the client, choose Generate code, pick the scopes (for example Scalar360.invoices.READ) and a duration of 3–10 minutes.

3. Exchange it for tokens

Request

curl -X POST "https://api.scalar360.com/oauth/v2/token" \
  -d "grant_type=authorization_code" \
  -d "client_id=$CLIENT_ID" \
  -d "client_secret=$CLIENT_SECRET" \
  -d "code=$GRANT_CODE"

Response

{
  "access_token": "s360_api_at_…",
  "refresh_token": "s360_api_rt_…",
  "scope": "Scalar360.invoices.READ",
  "api_domain": "https://api.scalar360.com",
  "token_type": "Bearer",
  "expires_in": 3600
}

4. Call the API

List invoices

curl "https://api.scalar360.com/api/v1/invoices?page=1&pageSize=20" \
  -H "Authorization: Scalar360-oauthtoken $ACCESS_TOKEN"

Response

{
  "success": true,
  "message": "Success",
  "data": {
    "items": [ { "id": "…", "number": "INV-1042", "status": "SENT", … } ],
    "page": 1,
    "pageSize": 20,
    "totalElements": 128,
    "totalPages": 7
  },
  "timestamp": "2026-10-12T09:30:00Z"
}

When the access token expires after an hour, refresh it — no user interaction needed.

See every module in the API reference in the menu.

How access works

You act as a user. Every call runs as the Scalar360 user who authorised it, in their organisation, with their role, module permissions and plan. If they can't do it in the app, the API can't either.
Scopes narrow it further. A token can only reach the modules and operations it was granted.
Some areas are never available through the API: sign-in, billing and payments, AI and developer settings, and the employee self-service portal.
Everything is logged. Users see each call in Developer API → Activity and can revoke an app at any time.