# July 22, 2026 

** July 22, 2026 Karbon API release makes RestrictionLevel writable on Contacts and Organizations and returns invoice magic links. **
---

## Return Invoice Magic Links

`GET /v3/Invoices/{InvoiceKey}` now returns `InvoiceMagicLink`, a link firms can send to clients to pay the invoice through Karbon Payments.

```http
GET /v3/Invoices/{InvoiceKey}
```

```json
{
  // ...existing invoice fields
  "InvoiceKey": "M2dVbCt4RHk",
  "InvoiceNumber": "KIN-1001",
  "InvoiceStatus": "AwaitingPayment",
  "InvoiceMagicLink": "https://clientportal.karbonhq.com/invoice-link?token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9..."
}
```

`InvoiceMagicLink` is only returned once the invoice has been posted; otherwise it's `null`. This field is not returned on the `/v3/Invoices` list endpoint.

## Set RestrictionLevel on Contacts and Organizations

`RestrictionLevel` can now be set on `POST`, `PUT`, and `PATCH` requests to `/v3/Contacts` and `/v3/Organizations`.

```http
POST /v3/Contacts
Content-Type: application/json

{
  "FirstName": "Priya",
  "LastName": "Sharma",
  "RestrictionLevel": "Private"
}
```

Valid values:

| Value | Meaning |
|---|---|
| `Public` | Managed by anyone in the firm. Always settable. |
| `Private` | Managed only by the Client Team. Requires your API application to have the `IncludePrivate` permission. |
| `Hidden` | Visible to and managed only by the Client Team. Requires your API application to have the `IncludeHidden` permission. |

`Public` can always be set. Setting `Private` or `Hidden` without the matching permission returns `403 Forbidden`:

```json
{
  "error": {
    "code": "4021",
    "message": "This API application does not have permission to set RestrictionLevel to Hidden."
  }
}
```

An unrecognized `RestrictionLevel` value returns `400 Bad Request`.

On `PUT`, omitting `RestrictionLevel` leaves the existing value unchanged rather than resetting it to `Public`. `ClientGroup` is not affected by this change — its `RestrictionLevel` remains read-only.