Core concepts

Plans and add-ons

The API and MCP are included in any paid plan; they are not an add-on. Access needs an administrator and the API switched on by Filmo for your environment; some modules need their add-on. Call GET /api/v1/account to see which add-ons the account has today.

The API and the MCP server are included in any paid plan and are not an add-on: the API does not check the plan or any add-on to let a key in. Access needs two things: Filmo has switched the API and MCP on for the environment your account lives in (a switch on Filmo's side, not an account setting), and an administrator creates the key or approves the OAuth connection. The rate limits are the same for every plan. Modules that have an add-on keep it, as the next section says. The help center covers the subscription in Your subscription.

Some modules sit behind an add-on. If the account has not contracted it, or has let it expire, an operation of that module answers 402 addon_required and requiredAddon names the add-on. It is a 402 and not a 403 because it is about the add-on, not about permissions. The answer is per resource: the same key can call other resources of the account without any add-on.

Add-onOpens
crmOpportunities and pipelines
incidenceIncidents and repair tickets
purchasesPurchase orders, supplier invoices and subrent updates
custom-fieldsCustom field definitions
AI creditPOST /api/v1/ai/ask. Without quota it answers 402

That table names the main add-ons. The ids come from a closed catalog: addons lists the ones the account has, and each operation that can answer 402 names its add-on in the x-required-addon extension of the specification. Some operations outside these modules can also respond 402.

The list is generated from the 402 responses the spec declares. Each operation on it names its add-on.

OperationScope
GET /api/v1/repair-ticketsrepair-tickets:read
POST /api/v1/repair-ticketsrepair-tickets:write
GET /api/v1/repair-tickets/{ticketId}repair-tickets:read
PATCH /api/v1/repair-tickets/{ticketId}repair-tickets:write
PATCH /api/v1/subrents/{subrentId}subrents:write
GET /api/v1/purchase-orderspurchase-orders:read
GET /api/v1/purchase-orders/{purchaseOrderId}purchase-orders:read
PATCH /api/v1/purchase-orders/{purchaseOrderId}purchase-orders:write
GET /api/v1/custom-fieldscustom-fields:read
GET /api/v1/incidentsincidents:read
POST /api/v1/incidentsincidents:write
GET /api/v1/incidents/{incidentId}incidents:read
PATCH /api/v1/incidents/{incidentId}incidents:write
GET /api/v1/incidents/status-countsincidents:read
POST /api/v1/incidents/{incidentId}/commentsincidents:write
GET /api/v1/crm/opportunitiescrm:read
POST /api/v1/crm/opportunitiescrm:write
GET /api/v1/crm/opportunities/{opportunityId}crm:read
PATCH /api/v1/crm/opportunities/{opportunityId}crm:write
PATCH /api/v1/crm/opportunities/{opportunityId}/stagecrm:write
POST /api/v1/crm/opportunities/{opportunityId}/closecrm:write
POST /api/v1/crm/opportunities/{opportunityId}/linkscrm:write
GET /api/v1/crm/pipelinescrm:read
GET /api/v1/crm/pipelines/{pipelineId}crm:read
POST /api/v1/purchase-orders/{purchaseOrderId}/approvepurchase-orders:write
POST /api/v1/purchase-orders/{purchaseOrderId}/receivepurchase-orders:write
GET /api/v1/supplier-invoicessupplier-invoices:read
GET /api/v1/supplier-invoices/{supplierInvoiceId}supplier-invoices:read
POST /api/v1/ai/askai:ask
POST /api/v1/invoices/{invoiceId}/validateinvoices:write
PUT /api/v1/invoices/external/{originSystem}/{originExternalId}invoices:write
PATCH /api/v1/proformas/{proformaId}/statusinvoices:write
PATCH /api/v1/quotes/{quoteId}/statusquotes:write
POST /api/v1/contracts/{contractId}/validatecontracts:write
POST /api/v1/contracts/{contractId}/signcontracts:write
POST /api/v1/supplier-invoices/{supplierInvoiceId}/validatesupplier-invoices:write
POST /api/v1/supplier-invoices/{supplierInvoiceId}/voidsupplier-invoices:write

GET /api/v1/account returns addons, the add-ons the account has access to today. Read it at start-up and before you call a resource behind an add-on. The MCP server lists only the tools the key can call.

A free trial lasts 14 days and needs no card. During it an administrator can create keys and connect OAuth and MCP, like in any account, so it serves to try the API. trial has active, true while the trial lasts, and endsAt. While a trial is active every add-on is unlocked, so what you build during it can start answering 402 afterwards.

  • When the trial ends, keys and OAuth connections are not revoked, and authentication does not look at the trial. Endpoints behind an add-on answer 402 addon_required; endpoints that need no add-on keep working.
  • Validating an invoice or a credit note in a trial account uses up numbers of its numbering. Validate only what a test needs.
  • Filmo purges the data of an account whose trial ended and that has not been converted to a paid subscription about 30 days after the end.
  • Read addons on the account you will use in production, not only on the trial, and handle addon_required explicitly.

Testing guidance is in Testing, and the help center covers billing in Your subscription.

  • Core concepts

    Permissions

    A refusal has three different causes: the key lacks a scope, the key's owner lacks a permission, or the account lacks an add-on. Each has a different status or code and a different fix.

  • Get started

    Quickstart

    Create an API key in the API and MCP section of the Filmo settings, then call GET /api/v1/account. The response tells you the timezone, currency, add-ons and scopes to build with.

  • Guides

    Testing your integration

    Start with a read-only key, check the account's automations before the first write, and keep irreversible operations out of any account that holds real data.