---
title: "Requests and responses"
source: https://developers.qashio.com/v2/conventions/
---

# Requests and responses

These apply to every endpoint unless stated otherwise, and are not repeated per endpoint.

## Response envelope

Successful responses are wrapped:

```json
{
  "status_code": 200,
  "success": true,
  "data": { },
  "pagination": { },
  "meta": { "request_id": "req_a1b2c3d4e5f6", "timestamp": "2026-07-17T08:00:00.000Z" }
}
```

- `data` holds the resource (an object) or the collection (an array).
- `pagination` appears on list endpoints only.
- `message` appears on write endpoints only (`POST`, `PUT`).
- `meta.request_id` is also returned as the `x-request-id` response header: quote it in support
  requests.

## Error envelope

Errors omit `success` and carry a structured `errors` array:

```json
{
  "status_code": 404,
  "message": "Resource not found.",
  "errors": [{ "field": null, "code": "NOT_FOUND", "message": "Resource not found." }],
  "meta": { "request_id": "req_a1b2c3d4e5f6", "timestamp": "2026-07-17T08:00:00.000Z" }
}
```

## Pagination

List endpoints accept `page` (1-based) and `page_size`, and return:

```json
"pagination": {
  "page": 1, "page_size": 20, "total_records": 7, "total_pages": 1,
  "has_next": false, "has_previous": false
}
```

Both values must be positive integers. Default page size is **10** for bank accounts, chart of
accounts, suppliers, tax rates and ERP transactions; **20** for cards, pool accounts, statements and
core cards; **12** for statements by account.

## Date inputs

`*_from` / `*_to` parameters take `YYYY-MM-DD` and are inclusive. On the ERP master
data and ERP transaction endpoints, both ends of a range **must be sent together**: sending only
one returns `400`. On cards and pool accounts either end may be sent alone.

## Month inputs

`month`, `from_month` and `to_month` take `YYYY-MM`.

## Text filters

On ERP master data and ERP transactions, text filters such as `remote_name` are
case-insensitive *partial* matches. Identifier filters (`qashio_id`, `parent_qashio_id`,
`account_id`, `user_id`) are exact.

## Common errors


| Status | Meaning |
| --- | --- |
| `400` | Invalid parameter: malformed id, unknown enum value, incomplete date range |
| `401` | Missing, expired or invalid access token |
| `403` | Token is valid but the user is not permitted to perform this action |
| `404` | Resource does not exist, or does not belong to your company |
| `429` | Rate limit exceeded: back off and retry |

## Scoping

All data is scoped to the company bound to your access token. A resource belonging to
another company returns `404`, never another company's data.