"Zenn" matching MCP tools:

• request_api_keyA

  ZenoC

  Ask the user to hand this session a Zeno API key. **Use this first** — every current Zeno user already has an account. `email` is the address on their Zeno account. **Ask them for it**; you cannot guess it, and the request is aimed by it — Zeno will only show it to somebody signed in as the owner of that address. Pass `client_name` too: it is the only thing identifying you on the approval page, and without it the person is asked to trust "an unnamed client". Returns a plain `verification_uri`. Tell the user to open it, sign in, and approve the request waiting there; we also email them a notice. **There is no code**, in either direction: nothing to read out, nothing to type, and nothing for you to put in a link. Then call `collect_api_key` with the `claim_token` returned here, waiting `poll_interval_seconds` between calls, until its `status` stops being `pending`. The user chooses on the page what the key may reach — usually a single company — so expect the key to be scoped, and read a 403 elsewhere as that scope rather than as a failure. The answer is the same whether or not that address has a Zeno account. If nothing ever arrives, the likeliest cause is a mistyped address — ask, do not assume.

  ConnectorNo auth

• epss_timeseriesA

  ZEN SecDBA

  Get the historical EPSS time series for a specific CVE. ## What this tool does Returns the historical EPSS score, percentile, and model version available for a CVE across time, ordered by date. Useful for analyzing how exploitability likelihood has evolved over time. ## When to use this tool Use this tool when the user asks about: - EPSS trend over time - how exploitability probability changed - whether EPSS spiked or dropped - historical comparison of risk If the user only wants the current EPSS score, use `vulnerability_score` instead. ## Inputs - **cve_id**: valid CVE identifier (`CVE-YYYY-NNNNN`). ## Outputs - **series**: array of objects, each containing: - `date`: measurement date in ISO format - `score`: EPSS score - `percentile`: EPSS percentile - `model`: EPSS model version ## LLM usage guidelines - Never guess EPSS values-use this tool for all EPSS time-series questions. - If `cve_id` is malformed or incomplete, ask the user to correct it before calling. - If the user mentions multiple CVEs, call the tool once per CVE as needed. - If no historical data is available, return an empty series and state that no EPSS history was found.

  ConnectorNo auth

• start_signupA

  ZenoC

  Create a Zeno account for somebody who does not have one yet. Use `request_api_key` first if they might already have an account — this tool cannot tell you, and deliberately never will. We email `email` a verification link. The user opens it, sees that you asked (by the name in `client_name`, shown as an unverified claim), chooses their own password, and decides separately whether to connect you. **You never see the link**, and you must not ask for it: it is what proves they own the mailbox, and a link you could repeat is a link anyone could. Then poll `collect_api_key` with the `claim_token` returned here. `denied` is terminal and means the person chose to create the account without connecting you, or refused outright — tell them plainly and stop; do not start another.

  ConnectorNo auth

• gl_profit_and_lossA

  ZenoC

  Revenue − expense → net result, for one fiscal year. **Window** — same rules as the trial balance: ``fiscal_year`` defaults to the latest posted year, ``period_id`` narrows to one period of it, unknown values are 404 and a contradictory pair 422. A P&L is a **flow** statement, so no reading makes the sum of every fiscal year a company's result — hence no all-years mode (ZET-155). Opening batches post only to balance-sheet accounts, so they never enter this figure. **The cut** — by the line's stamped ``fiscal_year_id`` FK, not by posting date; the response's ``fiscal_year_cut`` says so (see the trial balance; ``null`` only for a company that has posted nothing, ZET-166). For the full statement — per-account sections, the year's own account names, the problems list and the cash flow — use ``GET /companies/{id}/financial-statements``, which cuts by a posting-date window instead, so the two can disagree for a short/long or shifted fiscal year; this route returns the three totals.

  ConnectorNo auth

• create_ar_invoiceA

  ZenoC

  Create an outgoing (sales) invoice as a **draft** — nothing is booked yet (accountant role). A draft changes no ledger balance, gets no invoice number and appears in no VAT return; it exists so it can be edited. Posting happens later, at ``POST …/ar/invoices/{invoice_id}/issue``. Body: ``issue_date`` (required), ``counterparty_id`` (the customer — required before it can be issued), ``currency``/``language``, ``due_date`` (filled from the customer's payment terms when omitted), ``doc_type`` (``invoice``, the default — a ``credit_note`` draft can never be issued: credit an issued invoice with ``POST …/ar/invoices/{invoice_id}/credit-note`` instead), and ``lines``: each line carries ``quantity``, ``unit_price``, a revenue ``account_code`` and a ``vat_code_id`` (the id from ``GET …/gl/vat-codes``; a line without one declares no VAT). Totals, per-line net/VAT/gross and discounts are computed server-side — do not send them. Returns the created invoice with its lines and computed totals. Check ``GET …/ar/invoices/{invoice_id}/readiness`` for what still blocks issuing.

  ConnectorNo auth

• get_bank_statusA

  ZenoC

  Composed bank snapshot — "is my banking up to date?" (CompanyMember). "Reconciled" means entries matched, NOT ledger = statement balance (the close check ``BANK_BALANCE_DOES_NOT_TIE_OUT`` compares that). One call for what otherwise takes ``GET …/bank-accounts`` + one ``GET /bank-accounts/{id}/coverage`` per account + ``GET …/reconciliation/summary`` — and which those three still do not answer: per-account entry-status counts, the ``in_suspense`` counts, each account's latest closing balance, and the **company-level cumulative GL Suspense balance** (elsewhere reachable only through a VAT period's close-checks). Non-zero suspense blocks a clean VAT close. Read-only. Gaps come from the account's **full** history: coverage windows are merged and every internal hole reported (ZCT-509), so a run of missing statements is ONE gap. Not period-scoped; use ``…/reconciliation/completeness`` per month. ``period_gaps`` caps at 10/account, ``period_gap_count`` stays exact — HOLES, not missing months. Explicit non-member ``company_id`` → 403.

  ConnectorNo auth

• linux_auditA

  ZEN SecDBA

  Perform a Linux package vulnerability audit using SecDB. ## What this tool does Analyzes the installed packages of a Linux system-identified by OS and OS version-and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided by the user. ## When to use this tool Use this tool when the user wants to determine: - whether installed packages contain known vulnerabilities - whether a host, VM, container, or base image is affected by security advisories - which packages require patching or upgrading If the user does not know the valid values for `os` or `version`, first call the `linux_os` tool to retrieve the exact supported combinations. ## Inputs - **os**: Linux distribution identifier supported by SecDB (use `linux_os` to obtain allowed values). - **version**: OS version or codename corresponding to the selected distribution. - **packages**: list of installed packages, **one per line**, generated using the appropriate system command: ### For RPM-based distributions (RHEL, CentOS, Rocky, Alma, SUSE) rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' ### For DEB-based distributions (Ubuntu, Debian) dpkg-query -W -f='${Package} ${Version} ${Architecture}\n' ### For Alpine Linux apk list -I The raw output of these commands can be passed directly as the `packages` input (one package per line). ... python3 3.12.3-0ubuntu2.1 amd64 systemd 255.4-1ubuntu8.10 amd64 tmux 3.4-1ubuntu0.1 amd64 ... ## Outputs - **report**: structured objects describing the advisories affecting the audited packages. - **summary**: Markdown summary including total vulnerabilities, severity breakdown, and key findings. ## LLM usage guidelines - Never guess whether a package is vulnerable-always call this tool for Linux audits. - If `os` or `version` is unclear or missing, call `linux_os` and ask the user to choose a valid combination. - Normalize the package list to “one entry per line” if the user provides unstructured output. - The `summary` is already Markdown and can be shown directly. - Use `report` when deeper technical analysis is required.

  ConnectorNo auth

• vulnerability_searchA

  ZEN SecDBA

  Perform a full-text vulnerability search in SecDB. ## What this tool does Searches across: - CVE entries - Security advisories - Exploit references - Product and vendor vulnerability data Results are formatted in Markdown and include a search summary. ## Searchable fields (Lucene syntax supported): - type: result type - cve, cwe, advisory, nasl, exploitdb, nuclei - id: exact identifier (e.g. id:CVE-2026-12345, id:RHSA-2026:1234) - title: resource title or name - summary: short summary - description: full description text - alias: known vulnerability names (e.g. alias:log4shell) - severity: critical, high, medium, low - kev: true/false — CISA KEV catalog membership - status: NVD status (CVE only) e.g. analyzed, modified - published: publication date (e.g. published:[2026-01-01 TO 2026-12-31]) - modified: last modification date - source: CNA or advisory source (e.g. source:"Red Hat", source:fortinet) - cve: related CVE ID (e.g. cve:CVE-2026-44827) - cwe: related CWE ID (e.g. cwe:CWE-79) - tag: advisory tag (e.g. tag:scada, tag:ics) - attack_vector: network, adjacent, local, physical - cvss_score: CVSS base score (e.g. cvss_score:[7.0 TO 10.0]) Default operator is AND. Use OR for alternatives, quotes for exact phrases, * for wildcards. ## Examples: - "apache struts rce" → RCE vulnerabilities in Apache Struts - "id:CVE-2026-44827" → exact CVE lookup - "source:fortinet AND severity:critical" → critical Fortinet advisories - "alias:log4shell" → Log4Shell by alias - "cve:CVE-2026-44827 AND type:exploitdb" → ExploitDB entries for a CVE - "cvss_score:[9.0 TO 10.0] AND kev:true" → critical KEV CVEs - "tag:scada AND severity:high" → high severity ICS/SCADA advisories ## When to use this tool Use this tool when the user asks: - to look up a CVE, advisory, exploit, or product - "show vulnerabilities for X" - "search for advisories about Y" - exploratory or broad vulnerability discovery ## Inputs - **query**: free-text search term (CVE ID, advisory ID, product name, exploit name, vendor, keyword, etc.) ## Outputs - **results**: array of Markdown-formatted search hits - **summary**: Markdown summary with counts and a link to continue searching on SecDB ## LLM usage guidelines - Use this tool instead of assuming whether a CVE/advisory/exploit exists. - Present `results` and `summary` directly to the user-they are already Markdown. - Combine with `vulnerability_score`, `epss_timeseries`, or `sightings_search` for deeper analysis.

  ConnectorNo auth

• find_operationsA

  ZenoC

  Search EVERY operation this server offers, including the ones not in your tool list. The tool list you can see holds only the common operations. Several hundred more — payroll, VAT returns, year-end close, fixed assets, expenses, cash book, settings, integrations, onboarding — are available but unlisted, and this is how you find them. **Search here before concluding that Zeno cannot do something.** Call with no arguments to browse the catalogue of areas (tags) with their operation counts; with ``tag`` to list one area; with ``query`` to search by keyword. **Every word contributes and matching all of them doubles the score**, so extra words widen the search rather than narrowing it — the AND-then-fall-back- to-OR behaviour this said before was removed in `ef47aa9ab`. A word matching an operation's *name* counts for far more than one found in its description, so prefer the noun you are looking for over a sentence. ``limit`` is capped at 100 per call; when more matched, ``next_offset`` gives the ``offset`` that returns the following page, so an area of any size can be read in full. Paging is stable — the ranking is deterministic and the registry is fixed at startup, so no operation is dropped or repeated between pages. Pass a promising ``name`` to ``describe_operations`` for its arguments, then run it with ``call_operation``.

  ConnectorNo auth

• list_gl_periodsA

  ZenoC

  The company's **accounting periods** — the months a journal entry may post into (CompanyMember read). A period belongs to one fiscal year and carries ``period_no`` (1..12 within the year), ``date_from``/``date_to`` and a ``status``: ``open`` accepts postings, ``soft_closed`` still accepts them, and ``closed``/``year_closed`` refuse them — a posting date inside a closed period fails until an accountant explicitly reopens the period (``POST …/gl/periods/{period_id}/reopen``, reason required, recorded in the close-run ledger — ZET-161). ``fiscal_year_id`` narrows to one year; omitted, every year's periods come back. This is **not** the VAT filing calendar — those are the ``gl_vat_period`` rows of ``GET …/gl/vat/periods``, which have their own quarterly/monthly cadence and their own ``filed``/``paid`` sealing. Use this list to find the ``period_id`` a manual journal entry needs, and to check *why* a posting date was refused.

  ConnectorNo auth

• ssvc_calculatorA

  ZEN SecDBA

  Compute CISA SSVC (Stakeholder-Specific Vulnerability Categorization) for a CVE. ## What this tool does Calculates the SSVC decision (Track, Track*, Attend, Act) using: - exploitation status - technical impact - automatable exploitation - mission prevalence (user-provided) - public well-being impact (user-provided) This reflects CISA's official SSVC prioritization model. ## When to use this tool Use this tool when the user asks about: - how urgently a CVE should be remediated - CISA SSVC priority or risk category - a structured decision model for remediation ## Inputs - **cve_id**: the vulnerability to evaluate (`CVE-YYYY-NNNNN`) - **mission_prevalence**: `M`, `S`, or `E` (must be provided by the user) - **public_well_being_impact**: `M`, `A`, or `I` (must be provided by the user) ## Outputs - `decision`: one of **Track**, **Track\***, **Attend**, **Act** - `exploitation` - `technical_impact` - `automatable` - `mission_prevalence` - `public_well_being_impact` - `mission_and_well_being_impact_value` - `vector_string` - `summary`: Markdown explanation of the outcome ## LLM usage guidelines - Always ask the user for **mission_prevalence** (M/S/E) and **public_well_being_impact** (M/A/I) before calling. - Never guess these values—SSVC depends on user context. - Use the `summary` to explain clearly why the decision was returned. - Combine with `vulnerability_score` or `sightings_search` if the user needs additional context.

  ConnectorNo auth

• feed_report_catalogA

  ZEN SecDBA

  List available public ZEN SecDB feed reports. ## What this tool does Returns the catalog of available ZEN SecDB public feed reports, including their identifiers, descriptions, and supported input parameters. This tool helps discover which reports can be executed through `feed_report`. ## When to use this tool Use this tool when: - the user asks what public reports are available - you need to discover the correct report ID before running a report - you need to inspect supported filters or input parameters - you are unsure which report best matches the user request ## Inputs This tool does not require any input. ## Outputs - **reports**: array of report definitions, each containing: - `report_id`: report identifier - `title`: human-readable report title - `description`: short explanation of what the report returns - `input_schema`: optional JSON schema describing supported input parameters ## LLM usage guidelines - Use this tool before `feed_report` whenever the correct report ID or supported parameters are not already known. - Do not invent report IDs or parameters not present in the catalog. - Prefer the most specific matching report for the user request. - When useful, briefly summarize the most relevant available reports before calling `feed_report`.

  ConnectorNo auth

• upload_intakeA

  ZenoC

  Upload ANY file and let the system decide what it is (the unified intake queue — the same door as "Documents → Upload" in the web app). ``file_base64`` is the file's raw bytes, base64-encoded. Prefer this whenever the file is not plainly an invoice, and always for: bank statements (CAMT.053 XML, CSV, PDF or Excel exports) — these become BankStatement + BankEntry rows, matched to the registered bank account by IBAN; journal/accounting exports; and balance sheets, P&L statements and VAT filings. Mixed .zip archives are expanded and routed per file. Returns 202 with the queue row: routing happens asynchronously, so poll ``get_intake`` for the outcome and its targets. An unroutable file becomes a failed queue row carrying the reason — it is never silently dropped.

  ConnectorNo auth

• reverse_gl_journal_entryA

  ZenoC

  **Storno** a posted journal entry: post its mirror image (accountant role). Nothing is deleted; the original stays, linked, and the **reversal** entry is returned. The only VAT-correct storno door — VAT postings, open items and what the document spawned are all unwound. ``body.posting_date`` dates the reversal and decides its period; omitted, it reuses the original's. A closed-period entry needs one in an open period and a person: the reversal is booked there; the entry stays unchanged. **409** when: the entry is a reversal or already corrected; the date falls in a filed VAT period; an open item still carries a live settlement; the target period is closed or sealed; or a closed-period entry cannot be corrected (the reason is named).

  ConnectorNo auth

• whoamiA

  ZenoC

  Which user this request acts as, and which company's books it is bound to (jwt or API key). Zeno serves every tenant from one host, and an API key is opaque — nothing else tells a connected agent whose books it is about to write. Call this FIRST when working over MCP: ``company_scoped: true`` means this connection's data access is confined to ``company_id`` — ``company_name`` names it (null here means the bound company no longer exists), no other tenant is reachable, and the admin endpoints are refused however privileged the owner is. ``is_admin`` is that owner's bit: worth nothing outside this company, still full authority inside it, so a scoped key with ``is_admin: true`` may write these books even when ``company_role`` is null. ``company_scoped: false`` means the credentials carry the owner's full principal and ``memberships`` lists the companies it can act in. Read-only and cheap — at most one lookup. ZET-171, ZET-176. ``credential_purpose`` says which kind of credential this is, and is what the withholding rule keys on (SP-08): anything that is neither ``full`` nor ``session`` is confined, and gets ``memberships`` **withheld — null, not empty**. Working over MCP, what you book or accept is recorded as MCP — not as this user acting in person — and the app displays it that way. ``capabilities`` says what this caller may do, each verdict computed from the predicate the gate itself evaluates (SP-12) — so an agent learns what it cannot do before it collides rather than after. A credential confined **to a company** gets the entries whose verdict is a fact about the *credential*; the one that would read the owner's estate (``create_company``) is omitted, because its verdict would disclose a sibling tenant. A credential confined to **no** company — an onboarding key — has no sibling to disclose and does get it, which is the one operation such a key exists to call. ``pending_admin_actions`` is present and empty until PRE-03/PRE-04 fill it.

  ConnectorNo auth

• accept_autopost_decisionA

  ZenoC

  One-click accept of a **held** decision (accountant) — posts the AI's proposal. A person's accept overrides the soft guardrails. An agent's is refused (403) unless the row is ``agent_acceptable`` or an expense receipt. Closed period, sealed year, unknown account: 409/422. The row flips ``held → posted`` (again: 409); ``accepted_by_kind`` records the channel (``mcp`` over MCP). Optional ``body``: ``expense:receipt:item:`` needs ``employee_id`` + ``category_id``; ``autopost:capitalize:`` needs ``fixed_asset_category_id`` when the hold has none, and ``needs_split_source`` a ``reclassify_from_account_code``.

  ConnectorNo auth

• create_gl_journal_entryA

  ZenoC

  Create a **draft** journal entry by hand — accountant. It carries NO source document unless you name one. Only the pipeline paths stamp ``source_ref_type``/``source_ref_id`` (an ingested document is ``'item'``), so by default a booking made here cannot be traced back to what justified it. ``document_id`` is the retrofit: name an existing ``gl_document`` (create one with ``POST …/gl/documents``) and it is attached as the entry's source document, so the entry is not evidence-less. The same attach is available afterwards at ``POST …/gl/journal-entries/{id}/documents`` — including on a posted entry. Use it for bookings with genuinely no document behind them — reclassifications, provisions, accruals, year-end adjustments. **Do not transcribe a document into it and then attach the file** — that files the evidence beside a booking nobody derived from it. Each of these has a door that keeps the evidence attached: - an invoice, receipt or statement → ingest the file (``POST …/uploads/`` or ``…/intake``), then accept what the coder proposes (``…/autopost-decisions``); - an already-ingested item → ``POST …/gl/items/{item_id}/coding``; - a bank movement with no document → ``POST /bank-entries/{entry_id}/manual-coding``; - opening balances → ``POST …/opening-entries`` and post the proposal. ``auto_reverse_date`` arms the entry as a one-shot accrual (ZCT-527): once posted, the auto-reversal executor reverses it in full on/after that date. It must be after ``posting_date`` (422 otherwise), and it can only be set while the entry is a draft — on the create here or on the ``PUT`` replace. Drafts do not touch the books until ``…/post``. See ``doc/pipeline.md §"Accounting"``.

  ConnectorNo auth

• linux_osA

  ZEN SecDBA

  List supported Linux operating systems and their corresponding versions for use with the `linux_audit` tool. ## What this tool does Returns an array of supported OS/version pairs, each in the form: {"os":"name", "versions":["version or codename"]} This allows the LLM and the user to know exactly which inputs are valid for the `linux_audit` tool. ## When to use this tool Use this tool when: - the user does not know which OS names or versions are supported - the user provides unclear or ambiguous OS information - you need to validate `os`/`version` before performing a Linux audit This tool should typically be called **before `linux_audit`** whenever parameters are uncertain. ## Inputs This tool does not require any input. ## Outputs Returns an array of objects: - **os**: supported Linux distribution identifier - **versions**: corresponding list of supported release or codename Example: [ {"os": "ubuntu", "versions": ["noble","focal"]}, {"os": "debian", "versions": ["bookworm","sid"]}, {"os": "redhat", "version": ["redhat-9.0"]} ] ## LLM usage guidelines - Use this tool to validate or suggest correct OS/version combinations before calling `linux_audit`. - If the user provides invalid or misspelled OS names, retrieve the official list here and ask them to select one. - Do not guess operating system identifiers-always rely on this tool to confirm correctness.

  ConnectorNo auth

• feed_reportA

  ZEN SecDBA

  Run a public ZEN SecDB feed report. ## What this tool does Executes a predefined report on ZEN SecDB public feed data and returns structured results for analytics, trends, distributions, and top-N summaries. Supported reports can cover public datasets such as: - CVEs - security advisories - EPSS - weaknesses - CPE vendors and products - exploit references - sightings and IOC-related data Use `feed_report_catalog` to discover the list of available reports and their supported input parameters. ## When to use this tool Use this tool when the user asks about: - distributions, trends, or counts across public vulnerability data - top CVEs, top weaknesses, top vendors, or similar rankings - timeline-based summaries such as yearly or monthly trends - aggregated views over public SecDB feed data Do not use this tool when the user asks for details about a single CVE, advisory, or exploit. Use the dedicated lookup tools instead. ## Inputs - **report_id**: identifier of the report to execute - **filters**: optional object with report-specific filters - **limit**: optional maximum number of results to return, when supported by the selected report ## Outputs - **summary**: Optional Markdown summary of the report results - **report**: structured JSON object containing: - `report_id`: executed report identifier - `filters`: applied filters - `data`: structured report rows or aggregated values ## LLM usage guidelines - Use `feed_report_catalog` when you need to discover which public reports are available or which parameters they support. - Do not guess report IDs-use the catalog when uncertain. - Present `summary` directly to the user-it is already Markdown. - Use `report` for structured follow-up analysis, comparisons, or tool chaining. - If the selected report does not exist, return a clear not-found error instead of guessing an alternative.

  ConnectorNo auth

• purl_auditA

  ZEN SecDBA

  Perform a software package vulnerability audit using SecDB. ## What this tool does Analyzes a list of software packages identified by PURL (Package URL) and returns vulnerability information plus a Markdown summary. The audit results are based exclusively on the package list provided. ## When to use this tool Use this tool when the user wants to determine: - whether application dependencies contain known vulnerabilities - whether a project is affected by security advisories - which packages require patching or upgrading ## Supported ecosystems - **npm** - Node.js packages (e.g. pkg:npm/lodash@4.17.21) - **maven** - Java/JVM packages (e.g. pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1) - **pypi** - Python packages (e.g. pkg:pypi/django@4.2.0) - **gem** - Ruby gems (e.g. pkg:gem/rails@7.0.0) - **cargo** - Rust crates (e.g. pkg:cargo/openssl-src@111.10) - **nuget** - .NET packages (e.g. pkg:nuget/Newtonsoft.Json@13.0.1) - **golang** - Go modules (e.g. pkg:golang/github.com/gin-gonic/gin@1.9.1) - **composer** - PHP packages (e.g. pkg:composer/symfony/symfony@6.4.0) ## Inputs - **purls**: list of Package URLs, one per entry. Generate them from your project manifest files: - Node.js: package.json / package-lock.json - Python: requirements.txt / Pipfile.lock / pyproject.toml - Ruby: Gemfile.lock - Go: go.mod / go.sum - Rust: Cargo.lock - PHP: composer.lock - Java: pom.xml / build.gradle - .NET: *.csproj / packages.lock.json ## Outputs - **report**: structured JSON objects describing the advisories affecting the audited packages. - **summary**: Markdown summary including total vulnerabilities, severity breakdown, and key findings. ## LLM usage guidelines - Never guess whether a package is vulnerable — always call this tool. - Only submit PURLs from the supported ecosystems listed above; others will be ignored. - The `summary` is already Markdown and can be shown directly. - Use `report` when deeper technical analysis is required.

  ConnectorNo auth

• issue_ar_invoiceA

  ZenoC

  Issue a draft — **this is the booking step** (accountant role). In one transaction it assigns the next invoice number, posts the journal entry (debit the AR control account, credit revenue per line, credit output VAT per VAT code), opens the receivable open item the customer's payment will settle, freezes the invoice against further edits (``status`` → ``issued``) and renders the PDF+QR snapshot. The turnover reaches the VAT return from here — a draft never does. Only a **draft** can be issued: re-issuing an issued invoice is a 409. It is also refused when the invoice is not ready (no customer, no lines, a line without a revenue account…) — call ``GET …/ar/invoices/{invoice_id}/readiness`` first, whose ``blocking`` list is exactly what this refuses on — when the ``issue_date`` is not inside an **open** accounting period, or when the fiscal year has no AR control account configured. Returns the issued invoice (now with ``document_no`` and ``commercial_document_id``). A renderer outage does not fail the issue: the booking stands and the snapshot stays pending, re-rendered on demand by ``GET …/ar/invoices/{invoice_id}/pdf``. To undo one, reverse its journal entry; there is no un-issue.

  ConnectorNo auth