Further reading

Capabilities and limits of v1

The API covers most day-to-day work on orders, contacts, items, invoices and the schedule, and leaves a short list of things to the app. Check it here before you design an integration around a feature.

Filmo is rental software, and the API exposes the same records the team sees in the app, with a few deliberate omissions. This page has four parts: what each resource supports, what is not available, the limits a request must respect, and the gaps that are known today.

The endpoint reference lists every operation of a resource: whether you can list, read, create, update and delete it, and which actions it has (reserve, cancel, validate, void…). Every operation is also an MCP tool with the same scope and the same limits; see the MCP overview. The matrix below summarises them for every resource: the operations for list, read, create, update and delete, the number of other actions, and the number of MCP tools. It is generated from the OpenAPI document, so it is always the current contract.

ResourceListReadCreateUpdateDeleteActionsMCP tools
Account—————11
AI—————11
AvailabilityYes—YesYesYes15
CollectionsYes—YesYes—03
ContactsYesYesYesYesYes914
ContractsYesYes———46
Credit notesYesYes———24
CRMYesYesYesYes—39
Custom fieldsYes————01
IncidentsYesYesYesYes—26
Internal servicesYesYesYesYes—04
InvoicesYesYes———57
ItemsYesYesYesYesYes513
KitsYesYesYesYes—04
NotesYes—Yes——02
OrdersYesYesYesYes—610
PlannerYes————24
ProformasYesYes———13
ProjectsYesYesYesYes—38
Purchase ordersYesYes—Yes—25
QuotesYesYes———24
Repair ticketsYesYesYesYes—04
Schedule—————11
ServicesYesYesYesYes—04
SpacesYesYes—YesYes26
StaffYesYesYesYesYes16
SubrentsYesYes—Yes—03
Supplier invoicesYesYes———24
TagsYes—Yes—Yes25
Task typesYes————01
TasksYesYesYesYesYes05
TreasuryYesYesYesYes—18
UsersYes————01
VehiclesYesYesYesYesYes16
WorkflowsYes————12

These are things you might expect from the API that it does not do. Each row names where the spec says so and what to do instead.

Not availableWhere the spec says soWhat to do instead
Prices, discounts, insurance, deposits, status, serialized units and notes when creating an order. The order is created at zero.POST /api/v1/orders: "the order is born at zero and the team prices it from the application"Complete the order in the app.
Adding, removing or editing the lines of an existing order.PATCH /api/v1/orders/{orderId}: "It does NOT add, remove or edit lines"Use the order editor in the app.
Setting your own reference on an order. OrderDto has an external reference field; the create and update bodies do not.OrderCreateBody and OrderUpdateBody compared with OrderDtoKeep your own table of your id against the Filmo id, or put the reference in the app.
Uploading files, for example to an incident.POST /api/v1/incidents/{incidentId}/comments: "v1 has no file upload"Attach files in the app.
PDFs of invoices and other documents.No operation in the spec returns a PDF.Download the document from the app.
Composing an invoice, or editing a quote. Invoices can be validated or voided; quotes and proformas only change status.Tags Invoices, Quotes and Proformas; POST /api/v1/invoices/{invoiceId}/validate, PATCH /api/v1/quotes/{quoteId}/status, PATCH /api/v1/proformas/{proformaId}/statusCompose in the app. To mirror an invoice issued in another system, use PUT /api/v1/invoices/external/{originSystem}/{originExternalId}.
Webhooks. Filmo does not send webhooks: the API sends no events.The spec declares no event subscriptions.Poll incrementally; see the syncing guide.
Reading the status of a workflow run. You can start a run and get its identifier; there is no operation to read it afterwards.POST /api/v1/workflows/{workflowId}/runs; the only other workflow operation is GET /api/v1/workflowsCheck the result in the app.
A record of deletions. Deletes are final and leave no trace, and there is no filter for deleted records.The descriptions of the delete operations, such as DELETE /api/v1/contacts/{contactId}: "It is NOT reversible"Reconcile with windowed sweeps and confirm with a GET before you delete on your side.
The tax breakdown, lines and correction reason of a credit note.GET /api/v1/credit-notes/{creditNoteId}: "the tax breakdown, the lines and the reason for the correction are not published"Register the credit note by its totals and complete the breakdown in the app.
The tax id of the customer as it was when the invoice was issued. InvoiceDto.contact carries only id and name; the current tax id lives on the contact.InvoiceDto and ContactDtoStore the tax id on your side when you receive the invoice.
Tax rate per invoice line, and the invoice series.DocumentLineDto and InvoiceDto have no such fields.Use taxBreakdown of the invoice detail for totals per tax; read the series in the app.
Reading an archived order. It answers 404 and is left out of lists.PUT /api/v1/orders/{orderId}/archive: "an archived order is no longer visible to the API (its GET responds 404)"Restore it with PUT /api/v1/orders/{orderId}/archive and archived: false, using the id you kept. In a sync, treat a 404 as "archived or deleted".
Storing your own id on a contact. Contacts have no dedicated external reference field; contactNumber is the account's internal reference.ContactCreateBody, ContactUpdateBody and ContactDtoYou can use contactNumber (up to 50 characters, not unique) with POST /api/v1/contacts/lookup, and also keep your own table of your id against the Filmo contact id.
Knowing who or what changed a record. No object has an updatedBy field, and everything a key writes is attributed to the administrator who owns it.The Errors section of the API description ("About the person behind the key")Keep a hash of the last state you wrote, so you can ignore your own changes when you sync.

Some of these have a longer treatment elsewhere: syncing data for deletes and archived records, and data left out by design for costs, margins and personal data.

The same list is also generated from the spec, so a gap that a new release closes disappears from it:

IdWorkaround
Amounts, status, serialized units and notes when creating an orderPOST /api/v1/orders creates a draft at zero from the customer, the dates and the requested items. Prices, discounts, insurance, deposits, status, specific serialized units, accessories and notes are completed by the team in the Filmo app. Reserving the order with POST /api/v1/orders/{orderId}/reserve is possible once it exists.
Adding, removing or editing the lines of an orderPATCH /api/v1/orders/{orderId} changes the customer, the project and the dates only. Edit the lines in the order editor of the Filmo app. GET /api/v1/orders/{orderId}/lines reads them.
Setting an external reference when creating an orderexternalReference is returned on reads, but the body of POST /api/v1/orders does not accept it, and neither does the body of PATCH /api/v1/orders/{orderId}. Store your reference where the API can write it: a note on the order with POST /api/v1/notes, or a tag assigned with POST /api/v1/tags/{tagId}/assignments. Or set it in the Filmo app. Projects are different: externalReference is writable.
Uploading filesPOST /api/v1/incidents/{incidentId}/comments takes text only because v1 has no file upload. Attach files in the Filmo app.
PDF of invoices and other documentsNo operation returns a PDF or any other file: every response is application/json. Read the data of the document with GET /api/v1/invoices/{invoiceId} or GET /api/v1/quotes/{quoteId} and render it yourself, or download the PDF from the Filmo app.
Composing draft invoices and editing quotesInvoices can be validated (POST /api/v1/invoices/{invoiceId}/validate), voided (POST /api/v1/invoices/{invoiceId}/void) or mirrored from an ERP (PUT /api/v1/invoices/external/{originSystem}/{originExternalId}); quotes and proformas change status only (PATCH /api/v1/quotes/{quoteId}/status, PATCH /api/v1/proformas/{proformaId}/status). Compose and edit drafts in the Filmo app.
Events pushed to your server (Filmo does not send webhooks)
Reading the status of a workflow runPOST /api/v1/workflows/{workflowId}/runs returns the identifier of the run and the status it is born with (queued) and does not wait for it to finish. The API has no operation that reads a run afterwards. Check the result in the Filmo app, or from the data the workflow changes.
A log of deleted records
Tax breakdown, lines and reason of a credit noteGET /api/v1/credit-notes/{creditNoteId} says that the signed tax document, the tax breakdown, the lines and the reason for the correction are not published; netPrice and the other totals are. Record the credit note by its totals, and complete the breakdown from the Filmo app.
The customer's tax ID at the time an invoice was issuedcontact holds only the id and the name of the customer. The tax ID exists only as the current nif, which can change after the invoice. Store the tax ID on your side when you first receive the invoice.
Tax type per line and the series of an invoiceThe lines of GET /api/v1/invoices/{invoiceId}/lines and GET /api/v1/quotes/{quoteId}/lines carry no tax type, and no invoice schema has a series field. The taxes of an invoice are in taxBreakdown, per tax type for the whole document. Read the series from the Filmo app.
Reading archived ordersAn archived order is not visible to the API: its GET answers 404, like a deleted one, no list includes it and PATCH /api/v1/orders/{orderId} rejects it. To bring an order back, call PUT /api/v1/orders/{orderId}/archive with archived: false (it answers 204, and the order is readable again with its GET), or restore it in the Filmo app. In a sync, treat a 404 on an order you hold as archived or deleted, and do not delete on your side without confirming.
A dedicated external identifier on a contactContacts have no dedicated external-id field. contactNumber is writable on POST /api/v1/contacts and PATCH /api/v1/contacts/{contactId}, but it is not unique and Filmo does not generate it. If you use it as your key, agree a prefix, check for duplicates before writing and treat more than one match in POST /api/v1/contacts/lookup as a conflict to resolve. Or keep a table on your side that maps your identifier to the Filmo contact id.
Knowing who or what made a change

The schema of each request sets maximum sizes. A request over a limit is rejected with validation_error, and errors[] names the offending field. The table below is generated from the spec, so it is always current.

WhereLimitValue
limitmaximum500
cursormaxLength200
sortmaxLength200
ContactUpdateBody.emailsmaxItems20
ContactUpdateBody.phoneNumbersmaxItems20
ContactUpdateBody.websitesmaxItems20
ContactUpdateBody.addressesmaxItems20
stockTypesmaxItems50
collectionIdsmaxItems50
ItemCreateBody.tagsmaxItems50
ItemUpdateBody.tagsmaxItems50
AvailabilityCheckBody.itemsmaxItems100
statusesmaxItems50
contactIdsmaxItems50
projectIdsmaxItems50
OrderCreateBody.linesmaxItems100
paymentStatusesmaxItems50
orderIdsmaxItems50
operativeStatusesmaxItems50
itemIdsmaxItems50
spaceIdsmaxItems50
inventoryTypesmaxItems50
VehicleCreateBody.tagsmaxItems50
staffTypesmaxItems50
StaffMemberCreateBody.tagsmaxItems50
typesmaxItems50
supplierIdsmaxItems50
StaffAvailabilityBody.tagsmaxItems50
StaffAvailabilityBody.staffIdsmaxItems100
VehicleAvailabilityBody.tagsmaxItems50
VehicleAvailabilityBody.vehicleIdsmaxItems100
tagIdsmaxItems50
entityTypesmaxItems50
ServiceCreateBody.tagsmaxItems50
ServiceCreateBody.requirementsmaxItems20
ServiceCreateBody.requirements[].requiredTagsmaxItems20
ServiceUpdateBody.requirements[].requiredTagsmaxItems20
layersmaxItems50
projectStatusmaxItems50
orderStatusmaxItems50
assignedToStaffIdsmaxItems200
scopesmaxItems50
prioritiesmaxItems50
severitiesmaxItems50
assignedStaffIdsmaxItems50
relatedDocumentIdsmaxItems50
TaskCreateBody.assignedStaffIdsmaxItems50
TaskUpdateBody.assignedStaffIdsmaxItems50
invoiceIdsmaxItems50
ContactsLookupBody.referencesmaxItems200
OrderLineItemsReturnBody.itemsmaxItems500
triggerTypesmaxItems50
InvoiceExternalUpsertBody.linesmaxItems500
  • Lists that paginate return at most 500 records per page (limit, default 50). cursor and sort accept at most 200 characters. A few small lists have no pagination and return everything in one response: check the operation for a cursor parameter.
  • A question to POST /api/v1/ai/ask is at most 4000 characters, and the only mode today is a single pass: there is no conversation to continue.
  • A contact update accepts at most 20 addresses, 20 emails, 20 phone numbers and 20 websites.
  • Creating an order accepts at most 100 lines, and an availability check at most 100 items. Checking the availability of staff or vehicles accepts at most 100 identifiers.
  • A contact lookup accepts at most 200 references.
  • A line-item return and an external invoice each accept at most 500 lines.
  • List filters that accept several values, such as statuses, take up to 50 of them; assignedToStaffIds takes up to 200.

Rate limits are a separate matter: 120 requests per minute per key, and 30 per minute shared by the three availability queries. See rate limits.

Filmo runs the API on a hosting platform, and the platform bounds how large a request or a response can be and how long one call may last. Filmo does not publish the size limits as part of the contract, and apart from one operation it documents no duration limit either, so do not design around a specific size or duration.

  • Keep requests small. Send large changes as several writes, each with its own Idempotency-Key.
  • Keep pages at a size you have measured. A page of 500 records of a large object is a big response; if you see failures, lower limit.
  • Over REST, POST /api/v1/ai/ask is allowed to run for up to 300 seconds and can take tens of seconds on questions that chain several queries. Allow a long client timeout, above 300 seconds, and do not retry before it expires. Through MCP, do not assume the same allowance. For every other operation there is no documented duration limit: set your own timeouts and handle a 504.
  • The platform itself generates the 413, 502 and 504 responses; they are never application/problem+json and have no code. Branch on the HTTP status, not on the body. A 502 or a 504 on a write does not tell you whether the write happened: retry it with the same Idempotency-Key.

This table lists the documented limitations and the information or functionality needed to resolve each one. Entries are removed as they are resolved.

GapWhat would close itExpected
Field codes of validation errorsThe codes in errors[].code of a validation_error are not a closed list; until the contract closes it, treat a code you do not know as a generic validation failure.—
Synchronisation semanticsWhether a change in lines, payments or status updates the parent's updatedAt, the delay between writing and committing it, the filter precision, what archiving or restoring does to updatedAt, and a tombstone or deletedSince; until then the guides recommend the conservative option.—
The OAuth contractWhether the OAuth contract will gain audience binding (resource), a revocation endpoint (RFC 7009) and confidential clients. Today a token has no audience, there is no revocation endpoint (the administrator revokes the connection in the settings) and every client is public; the OAuth pages describe it as it works.—
Platform limitsThe platform's limits on the size of a request and of a response, and on the duration of a call, which Filmo documents only for askAi; until then the pages say so and advise small requests and pages you have measured.—
External key for contacts and ordersThe field POST /contacts/lookup compares, a writable external reference on contacts and orders, and optionally a change-origin field; until then the guides match on email or contactNumber and keep a correspondence table.—
Events fired by writes through the APIThe exact correspondence between every endpoint and its workflow events, whether a request will ever be able to suppress them, and loop protection for a workflow that calls the API with a key. Known from the code: writes through the REST API and MCP fire the same events as the app, with origin set to API or MCP; a workflow trigger can filter by origin, but a request cannot suppress events; a chain of workflows is cut at ten hops. The pages say what is known and mark the rest as an inference.—
Integrators with many accountsPartner or development accounts, and the process to appear in /integrations; until then the page is reduced.—
Fiscal data for accountingtaxBreakdown, lines and credit-note reasons, a fiscal snapshot of the invoice and the tax type per line; until then they are listed under "Not available in v1".—
MCP client requirements the vendor does not documentThe vendors' own documentation (plans, tool limits, organisation settings); the pages say "not documented by the vendor" where it is not.—
  • Further reading

    Archiving and deleting

    Filmo has several ways to take a record out of use, and they are not interchangeable. Some can be undone and some cannot; check this page before you call a destructive operation.

  • Further reading

    Data the API leaves out

    The public API leaves out business-sensitive data on purpose: costs, margins, access codes, internal tax documents and staff payroll or personal data. Treat a field that is not in the response schema as not available.

  • Guides

    Syncing data

    Filmo v1 does not send webhooks, so you keep another system in step by polling: read what changed in half-open time windows, and run a separate sweep to find what was deleted. Do not follow the pagination cursor to decide what changed or what disappeared.

  • Guides

    Going live checklist

    Go through these eight checks before your integration runs against production data. Each one points to the guide that explains it.