July 22, 2026

Jump to

Return Invoice Magic Links

GET /v3/Invoices/{InvoiceKey} now returns InvoiceMagicLink, a link firms can send to clients to pay the invoice through Karbon Payments.

GET /v3/Invoices/{InvoiceKey}

{
  // ...existing invoice fields
  "InvoiceKey": "M2dVbCt4RHk",
  "InvoiceNumber": "KIN-1001",
  "InvoiceStatus": "AwaitingPayment",
  "InvoiceMagicLink": "https://clientportal.karbonhq.com/invoice-link?token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9..."
}

InvoiceMagicLink is only returned once the invoice has been posted; otherwise it’s null. This field is not returned on the /v3/Invoices list endpoint.

Set RestrictionLevel on Contacts and Organizations

RestrictionLevel can now be set on POST, PUT, and PATCH requests to /v3/Contacts and /v3/Organizations.

POST /v3/Contacts
Content-Type: application/json

{
  "FirstName": "Priya",
  "LastName": "Sharma",
  "RestrictionLevel": "Private"
}

Valid values:

Value	Meaning
`Public`	Managed by anyone in the firm. Always settable.
`Private`	Managed only by the Client Team. Requires your API application to have the `IncludePrivate` permission.
`Hidden`	Visible to and managed only by the Client Team. Requires your API application to have the `IncludeHidden` permission.

Public can always be set. Setting Private or Hidden without the matching permission returns 403 Forbidden:

{
  "error": {
    "code": "4021",
    "message": "This API application does not have permission to set RestrictionLevel to Hidden."
  }
}

An unrecognized RestrictionLevel value returns 400 Bad Request.

On PUT, omitting RestrictionLevel leaves the existing value unchanged rather than resetting it to Public. ClientGroup is not affected by this change — its RestrictionLevel remains read-only.