Getting started

Three steps to your first successful call: activate the module, create an API user, run a request.

1. Activate the module

In your BOCP admin panel, go to Integrări → BOCP REST API and enable the module. This module is required for any request to succeed.

2. Create an API user

Still under Integrări → BOCP REST API, create a new user. BOCP will auto-generate a username and a strong password. You'll only see the password once — store it in your secret manager immediately.

Each API user has three access controls, layered together:

Control	Purpose
IP whitelist	Only the listed IPs may call the API with these credentials. Use `` only for tests — never in production*.
Route restriction	Optionally limit the user to specific modules (`sales`, `invoices`, ...).
Method restriction	Optionally limit the user to certain HTTP methods (e.g. `GET`-only for a reporting integration).

Brute-force protection. Repeated failed authentications lock the caller's IP for a short period. Do not retry with the same wrong credentials.

3. Base URL

Your base URL is:

https://secure.bocp.eu/app/rest/v1/2

Every endpoint path is appended to this prefix.

4. Your first request

List the most recent sales in your account:

curl -u YOUR_USER:YOUR_PASS \
  'https://secure.bocp.eu/app/rest/v1/2/sales/list/'

Response envelope (abbreviated):

{
  "is_error": false,
  "http_code": 200,
  "data": [
    { "bocp_id": 1234, "doc_nr": 42, "doc_date": "2026-07-10", ... }
  ],
  "page": 1,
  "has_more_pages": true,
  "your_ip": "1.2.3.4",
  "your_user": "api_user_xyz",
  "your_method": "GET"
}

5. Add filters

Filters are passed as URL path segments, not query strings. Everything is optional and combinable:

curl -u USER:PASS \
  'https://secure.bocp.eu/app/rest/v1/2/sales/list/year:2026/modifiedafter:2026-06-01%2000:00:00/page:2/'

See Conventions for the full list of standard filters and how include/exclude work.

6. Content types

Method	Content-Type
`GET`, `DELETE`	None — all data goes in the URL
`POST`	`multipart/form-data` for file uploads; `application/json` otherwise
`PATCH`, `PUT`	`application/json`

7. Logs

Every request is logged. Review your call history in Sistem → Activity log → API log.

Testing tip. GET requests are safe to run against a live account — they never modify data. POST, PATCH and DELETE apply changes immediately. For write-side work, ask support for a separate test account.

» Continue to Conventions.