Reading data

All read endpoints are GET, return JSON, and share one list format, one pagination scheme and one set of rules for filters and sorts. They return only the safe fields listed below: internal identifiers, cost prices, balances, tax numbers, internal notes and personal data beyond what is listed are never exposed.

Endpoint summary

Lists, details and pagination

List endpoints return:

{
  "data": [ { "id": "ld_0123456789abcdef01234567", "...": "..." } ],
  "pagination": { "limit": 25, "has_more": true, "next_cursor": "opaque-cursor-string" }
}

Detail endpoints return { "data": { ... } }.

Filters are exact matches on the values listed for each endpoint. There is no free-text search, wildcard or arbitrary query language in version 1. Any unknown query parameter, filter or sort name is rejected with 422 validation_failed naming the offender.

To page through everything, keep requesting with the returned next_cursor until has_more is false. The paging is stable while records are being added.

Realistic pagination example

# page 1
curl "https://api.nextorex.com/api/public/v1/crm/leads?limit=2&filter[priority]=high&sort=-created_at" \
  -H "Authorization: Bearer nx_live_xxxxxxxxxxxx_YOUR_SECRET_HERE"

{
  "data": [
    {
      "id": "ld_0123456789abcdef01234567",
      "first_name": "Ayesha",
      "last_name": "Khan",
      "email": "[email protected]",
      "phone": "+923001234567",
      "company_name": "Example Traders",
      "designation": "Owner",
      "city": "Lahore",
      "country": "Pakistan",
      "source": "Website",
      "status": "New",
      "lifecycle": "active",
      "priority": "high",
      "score": 40,
      "is_hot": false,
      "node": "nd_0123456789abcdef01234567",
      "last_activity_at": "2026-10-18T09:30:00+00:00",
      "created_at": "2026-10-18T09:30:00+00:00",
      "updated_at": "2026-10-18T09:30:00+00:00"
    }
  ],
  "pagination": { "limit": 2, "has_more": true, "next_cursor": "opaque-cursor-string" }
}

# page 2: send the cursor back with the same filter and sort
curl "https://api.nextorex.com/api/public/v1/crm/leads?limit=2&filter[priority]=high&sort=-created_at&cursor=opaque-cursor-string" \
  -H "Authorization: Bearer nx_live_xxxxxxxxxxxx_YOUR_SECRET_HERE"

(The first example response is shortened to one record.)

Common filters

Several endpoints share these date filters, which take an ISO 8601 date-time: filter[created_from], filter[created_to], filter[updated_from]. Every list also accepts filter[node] with a node reference (nd_…) to narrow results to one descendant node; an unknown or unreachable node returns 404.

CRM leads

GET /crm/leads, GET /crm/leads/{id}. Scope crm:read, permission Lead.view, CRM application.

Fields: id, first_name, last_name, email, phone, company_name, designation, city, country, source, status, lifecycle, priority, score, is_hot, node, last_activity_at, created_at, updated_at.

Sorts: created_at, updated_at (default -created_at).

ERP customers

GET /erp/customers, GET /erp/customers/{id}. Scope erp:read, permission Customer.view, ERP / POS application. System-managed customer records are not listed.

Fields: id, name, email, phone, address, is_active, node, created_at, updated_at.

Filters: is_active, email, phone, plus the common date filters and node. Sorts: name (default), created_at, updated_at.

{
  "data": {
    "id": "cus_0123456789abcdef01234567",
    "name": "Example Traders",
    "email": "[email protected]",
    "phone": "+923001234567",
    "address": "12 Main Boulevard, Lahore",
    "is_active": true,
    "node": "nd_0123456789abcdef01234567",
    "created_at": "2026-10-01T08:00:00+00:00",
    "updated_at": "2026-10-10T11:15:00+00:00"
  }
}

ERP products

GET /erp/products, GET /erp/products/{id}. Scope erp:read, permission Product.view, ERP / POS application. These are your products.

Fields: id, sku, barcode, name, description, type, category, sale_price, is_active, can_sell, track_inventory, node, created_at, updated_at. Cost prices and stock levels are not exposed.

Filters: is_active, can_sell, type (standard or bundle), sku, barcode, plus the common date filters and node. Sorts: name (default), created_at, updated_at.

Education students

GET /education/students, GET /education/students/{id}. Scope education:read, permission Student.view, Education application.

Fields: id, code, name, status, is_active, class, section, email, phone, node, created_at, updated_at. Guardian details, addresses, fees and linked accounts are not exposed.

Filters: status, is_active, code, email, plus the common date filters and node. Sorts: name (default), created_at, updated_at.

Hierarchy nodes

GET /hierarchy/nodes, GET /hierarchy/nodes/{id}. Any valid key. Fields: id, name, level, parent_id, is_self. Your own node reports parent_id: null. Filter: level (company, bg, le, ou, su). Sort: created_at. See Authorization.

Billing subscription

GET /billing/subscription. Scope billing:read, permission BillingSubscription.view. This is your NEXTOREx subscription (what you pay NEXTOREx), a single object with no id.

{
  "data": {
    "status": "active",
    "billing_cycle": "monthly",
    "currency": "PKR",
    "price_amount": 9980,
    "current_period_start": "2026-10-01T00:00:00+00:00",
    "current_period_end": "2026-11-01T00:00:00+00:00",
    "trial_ends_at": null,
    "cancel_at_period_end": false,
    "cancelled_at": null,
    "apps": [
      {
        "app": "erp",
        "tier": "business",
        "plan_slug": "business",
        "plan_name": "Business",
        "billing_cycle": "monthly",
        "currency": "PKR",
        "unit_price": 6990
      },
      {
        "app": "crm",
        "tier": "basic",
        "plan_slug": "crm_basic",
        "plan_name": "CRM Basic",
        "billing_cycle": "monthly",
        "currency": "PKR",
        "unit_price": 2990
      }
    ]
  }
}

No payment method, card, gateway or internal identifier is ever included.

Billing invoices

GET /billing/invoices, GET /billing/invoices/{id}. Scope billing:read, permission BillingInvoice.view. These are the customer invoices of your business. Invoices that belong to a CRM lead, deal or appointment flow are not visible to keys.

Fields: id, number, status, payment_status, currency, issue_date, due_date, subtotal, tax_amount, discount_amount, total, amount_paid, amount_due, amount_credited, amount_written_off, customer_id, customer_name, paid_at, sent_at, node, created_at, updated_at. Amounts are numbers in the invoice currency.

payment_status is paid, partially_paid, unpaid or not_payable (for example a draft or void invoice).

Sorts: created_at (default -created_at), updated_at, issue_date, due_date. Line items, payment links, customer contact details and notes are not exposed.

Common errors on reads

401 bad key, 403 scope, permission, plan or Developer API access missing, 404 unknown or out-of-reach record or node, 422 invalid query parameter, 429 rate limited. See Errors.