Use the restricted, audited HTTP API from trusted systems.

Enable

1. Open System Settings → API Console and add exact source IPs to the allowlist.
2. Add known hostile addresses to the optional blocklist.
3. Create credentials for an active administrator.
4. Select only needed action scopes and ensure the role has matching permissions.

curl -X POST https://billing.example.com/api/YOUR_PRIVATE_ENDPOINT_KEY \
 -H 'Authorization: Basic BASE64_IDENTIFIER_COLON_SECRET' \
 -H 'Content-Type: application/json' \
 -d '{"action":"GetClients","limitnum":25}'

Explicit actions cover clients, products, invoices/payments, orders, module lifecycle, tickets and statistics. Requests are POST-only, limited to 1 MB, input-complexity bounded, IP/scoped/role restricted, rate-limited and audited.

For every state-changing action, send a unique X-Idempotency-Key header containing 16–128 letters, numbers, dots, colons, underscores or hyphens. Retrying the same request with the same key returns the stored result; reusing a key for a different payload is rejected.

The API Console shows supported features, readiness checks, 24-hour health totals and searchable request history. History contains metadata only; request bodies and credentials are never stored.