API: Changes and deprecations

Sist oppdatert: 23.10.2026

The Luca API has a single GraphQL schema with no version numbers. The v1 in /api/v1/graphql belongs to the endpoint, not to the schema, so there is no older version to stay on. When we change the schema, we change it for everyone. This page explains how we do that, so you know what to expect, and lists every change we have made.

How we change the API

Changes we make at any time

We add to the schema all the time: new types, new fields, new optional arguments and input fields, and new enum values. None of these affect a query that already works, so we make them without notice.

Your integration should be written to cope with them:

Ignore fields in a response you did not ask for or do not know.
Handle an enum value you do not recognise, for example by treating it as “other” instead of failing.

Changes we announce first

Everything else breaks somebody: removing or renaming a field, argument, input field or enum value, making an argument required, or changing a field’s type. We never make such a change in a single step.

We add the replacement first.
We mark the old field as deprecated. It gets GraphQL’s @deprecated directive, with a reason naming what to use instead, and is listed below under Deprecated fields together with the date.
The deprecated field keeps working, unchanged, for at least six months from that date.
After six months we may remove it at any time. When we do, the list below shows the date we removed it, and the changelog says so too.

We may remove a deprecated field sooner than six months if we can see that no integration is using it.

Security fixes

If a field or argument has to change to fix a security problem, we change it straight away, without a deprecation period, and document the change here afterwards.

How to keep up

Check this page. Most GraphQL clients, such as Insomnia, Altair and GraphiQL, also strike through deprecated fields when you write a query, and an introspection query returns them with isDeprecated: true and the deprecationReason.
Move off a deprecated field when you next work on your integration, not when it disappears.
Contact support@lucalabs.com if a deprecation leaves you without something you need. We would rather hear about it before the field is gone.

Deprecated fields

Everything we have deprecated, newest first. A field without a date under “Removed on” still works. A removed field stays in this table for three months after we removed it, and in the changelog for good.

Deprecated	Use instead	Deprecated on	Removed on
`tag`, `tags`, `tagCreate`, `tagUpdate`, `tagDestroy`	Nothing, tags are no longer supported	23.10.2026	–
`BookkeepingPostingLine.tags`, `SaleProduct.tags`, `SaleProductInput.tagIds`, `bookkeepingGeneralLedger(tagIds:)`	Nothing, tags are no longer supported	23.10.2026	–
`EntryCreateInput.salaryEmployeeId`, `EntryUpdateInput.salaryEmployeeId`	`workedById` (already ignored)	22.10.2026	–
`timesheetEntries(salaryEmployee:)`	`workedBy`	22.10.2026	–
`TimesheetEntry.finalized`, `EntryCreateInput.finalized`, `EntryUpdateInput.finalized`	`submitted`	21.10.2026	–
`PaymentInput.payments`	`paymentOn`, `amountCents`, `bankAccountId` and `sign` on `PaymentInput` itself (already rejected with an error)	13.04.2026	–
`SaleCustomer.addressCity`, `SaleCustomerInput.addressCity`	`addressPlace`	13.11.2025	23.10.2026
`PurchaseSupplier.addressCity`, `PurchaseSupplierInput.addressCity`	`addressPlace`	13.11.2025	23.10.2026
`SaleCustomer.addressStreetOne`, `SaleCustomer.addressStreetTwo`	`addressStreet`	20.11.2024	23.10.2026
`PurchaseSupplier.addressStreetOne`, `PurchaseSupplier.addressStreetTwo`	`addressStreet`	20.11.2024	23.10.2026
`SaleCustomerInput.addressStreetOne`, `SaleCustomerInput.addressStreetTwo`	`addressStreet`	20.11.2024	23.10.2026
`PurchaseSupplierInput.addressStreetOne`, `PurchaseSupplierInput.addressStreetTwo`	`addressStreet`	20.11.2024	23.10.2026
`PurchaseReviewStatusTypes.NOT_REVIEWED`	`NOT_CONSIDERED`	16.06.2023	23.10.2026
`BankAccount.openDate`	`openedOn`	31.08.2021	23.10.2026

Changelog

Every change to the API an integration could notice, newest first. Changes marked Breaking stop an existing query from working.

23 October 2026

Deprecated tags, which are no longer supported: the tag and tags queries, the tagCreate, tagUpdate and tagDestroy mutations, BookkeepingPostingLine.tags, SaleProduct.tags, SaleProductInput.tagIds and bookkeepingGeneralLedger(tagIds:).
timesheetEntryUpdate keeps the billableDuration you send, where it used to reset it to duration, and leaves it unchanged when you leave it out.
Breaking: Removed members that had been deprecated for more than six months: BankAccount.openDate (use openedOn), the NOT_REVIEWED value of PurchaseReviewStatusTypes (use NOT_CONSIDERED), and on SaleCustomer, PurchaseSupplier, SaleCustomerInput and PurchaseSupplierInput, addressStreetOne and addressStreetTwo (use addressStreet) and addressCity (use addressPlace). Updating a customer or supplier without addressStreet now leaves the street address as it was.
Breaking: SubscriptionAddon.EXPENSE_REPORTS is renamed TRAVEL_AND_EXPENSES, so Company.subscription.addons returns the new name.

22 October 2026

Timesheet entries record who did the work and whether the hours are paid out: TimesheetEntry.workedBy and TimesheetEntry.payable, the inputs workedById and payable on EntryCreateInput and EntryUpdateInput, and the filter timesheetEntries(workedBy:). salaryEmployeeId on both inputs and timesheetEntries(salaryEmployee:) are deprecated. salaryEmployeeId is already ignored, because the employee now follows from workedById.
Added the permission levels READ_OWN and FULL_OWN to CompanyPermissionLevel, and SALARY_READ_OWN and TIMESHEET_FULL_OWN to CompanyPermission. A user with one of them sees only their own payslips or timesheet entries.

21 October 2026

Added submitted to TimesheetEntry, EntryCreateInput and EntryUpdateInput, and deprecated finalized on all three. The steps now have to come in order: an entry has to be submitted before it can be approved, an approved entry cannot be unsubmitted, and only an approved entry can be invoiced.

9 October 2026

Added status: ActiveStatus to saleCustomers, purchaseSuppliers and saleProducts. List queries no longer apply the web app's default filters, so saleCustomers without status returns inactive customers too.
Added the permissions query, which lists what the current user may do in the company as CompanyPermissionGrant values (a CompanyPermissionCategory and a CompanyPermissionLevel).
Security fix: paymentCreate refuses a payment source that belongs to another company, and only a user allowed to edit the supplier or customer can overwrite its bank account number.

7 October 2026

Added Company.subscription, which returns the company's plan, add-ons, modules and subscription status.
Added filters to timesheetEntries: registeredBy, project, activityType, salaryEmployee, approved, billable, invoiced and paidOut. Added TimesheetEntry.editable and TimesheetEntry.destroyable.
Added projects(active:), timesheetActivityTypes(project:) and TimesheetActivityType.saleProduct.

6 October 2026

Added PurchaseInvoice.fileName, fileUrl and contentType, for the document behind a booked purchase.

2 October 2026

Breaking: PurchaseInvoiceLineItem.debitAccount can now be null, on a draft line that has no account yet. Added amountCents, currency and kid to PurchaseInvoice, kid to PurchaseInvoiceInput, description to PurchaseInvoiceLineItem and its input, bankAccountNumber to PurchaseSupplierInput, message to Payment and PaymentInput, PaymentInput.bankTransactionId, and bankTransactions(matched:).

30 September 2026

purchaseInvoiceCreate can book a document from the inbox with inboxItemId. Added BookkeepingAccount.vatCodes and defaultVatCode, the VatCode type, and PurchaseSupplier.defaultAccount and defaultVatCode.

29 September 2026

Added prediction to PurchaseInvoice and InboxItem: what we read from the document, each value with a confidence, and a status while the reading is still running.

26 September 2026

Added the me and inboxItem queries, InboxItem.fileUrl and contentType, and the mutations inboxItemCreate (upload a document as base64) and inboxItemDestroy.

22 September 2026

Added SaleInvoice.url and PurchaseInvoice.url, links to the invoice in the web app. purchaseInvoiceCreate accepts the voucher as base64 through fileBase64 and fileName, as an alternative to a multipart upload.

21 September 2026

Added the document inbox: the inboxItems query, the InboxItem type and the inboxItemRegister mutation.

19 September 2026

company(id:) may be called without an id, and returns the current company. Added bankTransactions(beginningOn:, endingOn:), saleInvoices(dueDateBeginningOn:, dueDateEndingOn:, settled:) and SaleInvoice.dueDate.

18 September 2026

Every error carries a machine-readable extensions.code, one of nine. Branch on the code, not on the message. A field the user may not read now answers FORBIDDEN for that field instead of failing the whole request, and error messages are always in English.

17 September 2026

Breaking: New OAuth server: OAuth 2.1 with the authorization code flow and PKCE, described in API: Authenticate with OAuth2. OAuth applications and tokens from the old server stopped working, and a client secret alone is no longer accepted. One consent can cover several companies, so every query and mutation takes an optional companyId, which an OAuth token has to give (or send X-Luca-Company). Mutations need the accounting.write scope. Personal API keys work as before.

13 September 2026

Breaking: Fixed fields that failed whenever they were selected: BookkeepingPostingLine.tags is now a list, [Tag!], and SalaryPayslipLineItem.employee resolves. purchaseSuppliers now returns PurchaseSupplierConnection instead of SaleCustomerConnection. PurchaseInvoice.reviewStatus returns NOT_CONSIDERED where it returned NOT_REVIEWED, and Payment.sourceId is the hashed id the rest of the API uses.

11 September 2026

Breaking: Removed Vipps as a way to send an invoice: the VIPPS value of SaleSendMethod and saleInvoiceSend(phoneNumber:).
The depth limit now applies to every query, and a query that runs too long is stopped and answered with TIMEOUT. Security fix: looking a record up by id refuses one that belongs to a company the caller has no access to.

9 September 2026

Added bookkeepingAccount to BankAccount, SaleCustomer and PurchaseSupplier, the ledger account each one posts to.

3 September 2026

Added bankReconciliationMatchCreate and bankReconciliationMatchDestroy. List queries paginate properly with first and after; before, they stopped at 25 rows and could report hasNextPage wrongly.

2 September 2026

Added bank reconciliation matching: BankReconciliation.matches, postings and transactions, BankTransaction.match, BookkeepingPosting.description, and the ReconciliationMatch and ReconciliationPosting types.

22 June 2026

Breaking: Mutations depend on the company's plan. Sales mutations need the Accounting or Invoicing plan, every other mutation needs Accounting, and a company without it gets an error (PLAN_REQUIRED since 18 September 2026).

13 April 2026

Breaking: paymentCreate takes the payment directly on PaymentInput: paymentOn, amountCents, bankAccountId and sign are required, and the payments list is deprecated and rejected with an error. Added approveLater and recipientBankAccountNumber.

31 March 2026

Added vps to BankAccountTypes, for VPS accounts.

30 March 2026

Breaking: Removed BankAccount.integrationRequested.

26 March 2026

Added the purchaseInvoiceDestroy mutation.

15 December 2025

Breaking: Removed BookkeepingPosting.postingType.
Breaking: productId on ActivityTypeCreateInput and ActivityTypeUpdateInput is renamed saleProductId.

4 December 2025

Added ALTINN_SYSTEM_USER_NONE, ALTINN_SYSTEM_USER_READ and ALTINN_SYSTEM_USER_FULL to CompanyPermission.

13 November 2025

Added addressPlace to SaleCustomer, PurchaseSupplier and their inputs, and deprecated addressCity.

24 October 2025

Breaking: addressCity on SalaryEmployee, EmployeeCreateInput and EmployeeUpdateInput is replaced by addressPlace. Added countryNumber to all three.

7 October 2025

Breaking: The values of BankAccountTypes are now lower case: standard, tax_deduction, international and credit_card.

Integrasjoner