REST API

The Efimis REST API provides authenticated read and write access to supported Efimis resources.

Base URLs

Use the base URL for the region that hosts your Efimis tenant:

Region	Base URL
UK	https://api.uk.efimis.com/{tenant}/api/v1
AU	https://api.au.efimis.com/{tenant}/api/v1

Replace {tenant} with your tenant alias. All endpoints in the REST API reference are relative to one of these base URLs.

Authentication

Include an OAuth 2.0 access token in the Authorization header of every request. Follow the authentication guide to obtain and reuse an access token.

Make a request

The following example retrieves the first 20 matters from a UK tenant. For an Australian tenant, change api.uk.efimis.com to api.au.efimis.com.

export EFIMIS_TENANT="your-tenant"
export EFIMIS_API_BASE="https://api.uk.efimis.com/$EFIMIS_TENANT/api/v1"

curl --fail-with-body -sS \
  "$EFIMIS_API_BASE/matters?pageIndex=0&pageSize=20" \
  -H "Authorization: Bearer $EFIMIS_TOKEN" \
  -H "Accept: application/json"

EFIMIS_TOKEN must contain an access token obtained using the authentication flow.

Request conventions

• The API version forms part of the URL. This documentation covers /api/v1.
• Requests and responses use JSON. Send Content-Type: application/json when the request has a JSON body and Accept: application/json when requesting JSON.
• Collection endpoints that support pagination expose pageIndex and pageSize. Refer to the endpoint definition for its defaults and constraints.
• Cache and reuse access tokens until shortly before they expire. Do not request a new token for every API call.
• Reuse HTTP connections in long-running applications. See Setting up HttpClient for a .NET example.

Throttling and retries

Requests are rate-limited separately for each integration and tenant. The platform default is currently 100 requests per 60 seconds, although your integration may have a custom limit and replenishment period.

When a limit is exceeded, the API returns 429 Too Many Requests. If the response includes a Retry-After header, wait for the specified number of seconds before retrying. Otherwise, use exponential backoff with jitter.

Read requests can generally be retried after transient failures. Do not automatically retry write requests unless you know that repeating the operation cannot create duplicate data or other unintended changes.

Error handling

Successful responses use a 2xx status code. For unsuccessful responses, inspect both the HTTP status and response body.

Status	Meaning
401 Unauthorized	The access token is missing, expired, invalid or not accepted for the requested tenant.
429 Too Many Requests	The integration has exceeded its rate limit. Follow Retry-After when present.

Requests can also return endpoint-specific validation and authorization errors. The interactive reference documents the responses declared for each endpoint. Using curl --fail-with-body keeps the response body visible when a request fails.

API areas

The REST API currently includes the following resource areas. Availability depends on the permissions and configuration of your integration and tenant.

Area	Resources
People and organisations	/entities, /clients, /employees, /roles, /suppliers
Matters and configuration	/matters, /mattertypes, /tasktypes, /divisions
Billing and finance	/workitems, /invoices, /costrecoveries, /applicablerates, /ratesets, /disbursementcodes, /taxcodes
Documents	/documents, /documentcollections
Integrations	/webhooks

Full API reference

Use the interactive REST API reference for endpoint paths, parameters, request and response schemas, and the responses currently declared for each operation.

For an end-to-end introduction, continue to the quickstart.