Nova API overview

What the Nova API covers, the three ways software connects, how records are addressed, and where to start as an integration or an AI agent.

Software can do anything in Nova that the organization lets it: customers and contacts, quotes, invoices, payments, work orders, the Schedule, tasks, projects, bookings, tickets, notes, files, agreements, bookkeeping and more. About 80 common operations are documented in full in the API reference; every other operation (roughly 3,200 in all) is listed in the operation index with the permission it needs: Find the operation to call. Both are generated from the running code for every release, so they never drift from what the app does.

Three ways in, one API

• API key — your own software in your own organization. See Make your first API request.
• Connected app — OAuth 2.1; acts as the person who connected it. This is how ChatGPT, Claude and other assistants act for a person. See Authenticate with OAuth 2.1 or an API key and Connect an AI agent through MCP.
• AI teammate — an AI with its own name and roles in one organization. See Run software as an AI teammate.

Choose between an API key, a connected app and an AI teammate helps you pick. All three call the same routes the Nova app uses, so every permission check, validation rule and audit event applies exactly as it does in the app.

Records and identity

• Every record you can address has an opaque uid such as acct_a1b2c3d4e5f6a1b2. Integer ids never appear on the wire. Use the uid in paths and bodies. See How records are identified.
• People read record numbers such as ACC-000001; search by them, but link by uid.
• Every token is bound to one organization. Send X-Organization-ID only when you hold a browser session token; machine credentials already carry it.

What a credential may do

Whatever the organization grants it, and never more than the person who set it up can do themselves. Nothing an organization can do is held back from its own software. An organization can also ask for a person to approve particular actions each time, and the few actions Nova guards with an identity check (payout accounts, role changes, bulk exports) always wait for a person when software tries them (Handle an action that waits for a person's approval). Limits sit beside the grant: rate, a daily cap, addresses, branches, expiry (Rate limits, daily caps and other limits on a credential).

Signing in, the OAuth endpoints, platform administration and the routes that manage credentials are never open to software.

Where to go next

1. Authenticate with OAuth 2.1 or an API key to get a token.
2. Paging, filtering, errors and rate limits and Errors and how to recover for paging, errors and retries.
3. API reference for the documented operations, Find the operation to call for everything else.
4. Receive webhooks when records change to be told when something changes instead of polling.