When to use this endpoint

Use this unpaginated route for invoice pickers and job-to-invoice linking. ID is always returned.

Authentication and permissions

The request must use a logged-in CRM session or valid signed API credentials and is scoped to that tenant.

Users whose legacy crm_access mask contains bit 64 receive {"error":"no permission to access api"}. No record-owner check is made.

Parameters

ParameterTypeRequiredDescription
fieldsJSON array stringNoOptional fields: num, cdate, customer_id, customer_type, last_edited, and status. Unknown names are ignored.
openMixedNoPresence adds status<2, regardless of value.
status / status_maxInteger-compatibleNoExact or maximum status. Conditions combine if both are supplied.
customer_id / customer_typeIntegersTogetherDirect target. Customer targets also include parent and siblings; asset targets also include owner, owner parent, and children of that parent.
days_from / days_toInteger day offsetsNoBounds relative to today; the upper bound adds one extra day.
last_edited_from / last_edited_toUnix secondsNoInclusive edit checkpoint bounds.
idsJSON arrayNoLimits to integer-coerced IDs. An empty decoded list is rejected.

Example request

$rows = FM_api('Invoices_list', [
	'open' => 1,
	'fields' => json_encode(['num', 'cdate', 'status']),
]);

Example response

[
  {"id": "981", "num": "INV-981", "cdate": "2026-10-02", "status": "1"}
]

Errors and unusual responses

ResponseCondition
{"error":"not logged in"}No authenticated tenant context is available. Invalid signed credentials can be rejected by the dispatcher before the handler runs.
{"error":"no permission to access api"}The legacy access bit is set.
{"error":"invalid parameter: ids"}IDs decodes to an empty array.

Legacy application errors may be returned with HTTP 200. Check the decoded response for error, not only the HTTP status.

Behaviour and edge cases

  • There is no explicit ordering or page limit.
  • All filters combine with AND except target-family expansion inside the customer condition.
  • Fields parsing is activated only when the trimmed JSON string is longer than four characters. Malformed iterable input is legacy unsafe and should not be sent.

See it in Fieldmotion

CRM1

Invoice widgets, Job invoice linking, and the Job invoice page call this route.

CRM2

Invoice table widgets and Job linking use the same endpoint.

Related endpoints