List all wflow organizations the authenticated principal can access. Returns name, baseURL and slug (subdomain). The slug is what every other tool uses as organization. This is the entry point for any cross-organization task.

Return the authenticated account/identity for an organization (GET /account). Useful to confirm auth is working and see the acting user.

Return the catalog of wflow public API operations (method, path, summary, tag). Use this to discover endpoints that no typed tool covers, then call them with wflow_request. Optionally filter by a keyword or tag (e.g. 'payment', 'approval', 'storage', 'partner').

Low-level escape hatch to call ANY wflow public API endpoint. Use this when no typed tool fits (browse the surface with wflow_api_catalog first). • path may be a bare resource ('documents', 'registers/costcenters'), an org-templated path ('/api/{organization}/roles') or the org is injected automatically for relative paths. • {organization} in the path (or a relative path) is filled from the organization argument or WFLOW_ORG. • query is an object of query-string parameters (wflow filter syntax for query, e.g. totalAmount > 1000). • body is sent as JSON for PUT/POST/PATCH. Writes (non-GET) are blocked when WFLOW_READONLY is set.

Search / list documents across one or many organizations with the wflow filter syntax and auto-pagination. • query uses wflow filtering, e.g. orderNo = "Z01", totalAmount > 1000 and totalAmount < 5000, created > "2026-01-01", number = null. Quote the field name-free value as shown. • sort is a comma list, e.g. created desc,totalAmount. • Set allOrganizations or organizations for cross-org queries (e.g. 'find documents for these transactions across all organizations'). Returns slim rows by default; set slim=false for full document objects.

Fetch the full document object (all fields, VAT subtotals, lines, accounting) by its id.

Return the chronological event/audit trail for a document (created, updated, approved, changed accounting, exported, …). Useful for controlling and spotting inconsistencies.

Create (omit id) or update (include id) a document. Only the fields you send are changed — unspecified fields are left untouched. Registers (costCenter, contract, activity, accountingRule, project, …) are set under accounting and may be referenced by {code}, {externalId} or {id} — wflow resolves them on write. Example accounting: {accounting:{costCenter:{code:"202"}, contract:{code:"12345"}}}. Line items go in lines (array of {description, quantity, unitPrice, totalAmount, vatRate, costCenter, …}).

Find every document matching a wflow query (optionally across organizations) and apply the SAME partial patch to each. This powers requests like 'set all documents with order Z01 to cost centre Centrála'. SAFETY: runs as a DRY RUN by default (apply=false) — it returns the matched documents and the patch that would be applied, but changes nothing. Re-run with apply=true to execute. patch is a partial DocumentUpdate merged with each document's id, e.g. {accounting:{costCenter:{code:"CENTRALA"}}}.

Export a set of documents in a given format (byznyssolitea, datev, excel, generic, isdoc, kros, moneyerp, moneys3, mrp, premier, xml). Optionally narrow the set with a StructuredFilter filter (search/sort/filters). The exported file is written to disk and its path returned (useful for 'compare against the accounting ledger export').

Attach a local file to an existing document. Set main=true to mark it as the main document file. Use this together with wflow_update_document to create a document and attach its scan/PDF.

Create a new document and attach one or more local files in a single call (SK QR receipts and ISDOC files are auto-extracted). Optionally pin a document typeId and invoiceType.

Read entries from any wflow register/reference table. type is one of: accountingrules, activities, businesscases, businessitems, businessitemcategories, carddocumenttypes, cashdocumenttypes, cashregisters, chartofaccounts, contracts, costcenters, employees, locations, measureunits, organizationpersons, partnerpersons, partners, paymentmethods, projects, series, vatcontrolstatementlines, vatreturnlines, vatreversechargecodes, vehicles. Each entry typically has {id, externalId, code, description, isValid}. Supports the wflow query/sort syntax and auto-pagination — e.g. resolve a cost centre named 'Centrála' with type='costcenters' and query=description = "Centrála".

Write entries to a register. Two modes: • method='PUT' replaces the WHOLE set — entries missing from your list are marked invalid (this is how ERP reference-table imports work). Match is by externalId, or code if externalId is empty. • method='PATCH' updates only the entries you send, leaving the rest untouched. Each entry: {externalId?, code, description?, isValid?}.

List users in one or many organizations. Each user has {id, identity:{login, fullName}, hasFullAccess}. Use allOrganizations to sweep every org (e.g. to find where a user exists).

Fetch a user by id including role & team membership, document-type permissions and effective rights (UserFull).

Add (by login) or update a user's access. Body fields: {login, hasFullAccess?, roles?:[{id}], teams?:[{id}], documentTypes?:[{id,permission}]}. permission ∈ All | OnlyAssigned | FullAccess. Unspecified fields are left unchanged.

Delete (revoke) a user from an organization by id. Irreversible — confirm intent before calling.

Sweep organizations and return every user who holds a given right, or full-access users (who implicitly have all rights). Defaults to payment rights (CanMarkForPayment, CanManagePayments), directly answering 'which users can pay across organizations?'. Pass rights to check other rights (e.g. CanExport, CanApprove, CanManageSettings).

List roles in an organization (id, name, description). Get one role's rights & members via wflow_request GET roles/{id}.

Create a role (POST, omit id) or update it (PUT, pass roleId). Body: {name, description?, users?:[userId...], rights?:[Right...]}. Rights are enum names like CanApprove, CanMarkForPayment, CanExport, CanManageSettings.

Delete a role by id. Irreversible.

List teams in one or many organizations (id, name, description, system flag).

Fetch a team by id including its member users.

Create a team (POST, omit id) or update it (PUT, pass teamId). Body: {name, description?, users?:[userId...]}. This is how you 'create a new team X and add these users to it'.

Delete a team by id. Irreversible.