API, webhooks, custom roles and audit log
Connect other software with API keys and webhooks, give people custom roles, and see who changed what.
These are part of the Business plan.
API keys
In Settings > API & webhooks, click + New key and copy the key: it is shown once. A key acts as the person who made it, with their role. Send it with each call:
Authorization: Bearer exk_...
The address is https://www.ellibo.com/expense/api.php/v1/...:
| Call | What it does |
|---|---|
GET /v1/expenses | Expenses. Filters: from, to, status (unreported, draft, submitted, approved, rejected, reimbursed), person (email), limit, offset. |
GET /v1/expenses/{id} | One expense with its lines, policy flags and custom fields. |
POST /v1/expenses | Adds an expense: date, amount, category (name or id), merchant, description, tax_rate, ref_no, currency, exchange_rate. An admin's key can add one for someone with person (their email). |
GET /v1/reports | Reports. Filters: status, from, to. /v1/reports/{id} includes its expenses. |
GET /v1/advances | Advances, with what is left. |
GET /v1/categories | The categories. |
Answers are JSON. Errors come as {"error": {"code", "message"}} with the HTTP status. A key can make 5,000 calls a day. Turn off a key to stop it at once.
Webhooks
Click + New webhook, enter the address and tick the events (none ticked means all of them). The signing secret is shown once.
We POST JSON to the address with these headers:
X-Ellibo-EventX-Ellibo-TimestampX-Ellibo-Signature: sha256=...: the HMAC-SHA256 oftimestamp + "." + bodywith the secret. Check it before you trust the call.
A call that fails is tried again after 1, 5, 30, 120 and 720 minutes. Test sends a test call. Recent calls shows what was sent and the answers.
Custom roles
In Settings > Custom roles, make a role and choose what it can do besides adding its own expenses:
- approve the reports and requests sent to them
- see every expense, report and advance
- pay back, advances, cards and payouts
- change Expense settings
Give it to people in Users. Users and the plan always stay with admins. Deleting a role makes its people Submitters.
Audit log
Settings > Audit log lists who changed what, and when:
- settings, policies, approval settings and rules
- users and roles, and bank details
- approvals and undos, reimbursements, payouts and advances
- cards, budgets, custom fields, workflow rules, API keys, webhooks and imports
Filter it by area.