# Business Made · Period close Part of AppEngine API Documentation. Full index: https://appengine.appmint.io/documentation.md ## GET /business-made/period-close **List period closes** `operationId: PeriodCloseController_list` Accounting periods and their close status. #### Signature ```http GET /business-made/period-close () -> Period closes ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/period-close/start` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | ### Responses | Status | Meaning | | --- | --- | | `200` | Period closes | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## GET /business-made/period-close/{id} **Get a period close** `operationId: PeriodCloseController_get` Fetches one close with its checklist and progress. #### Signature ```http GET /business-made/period-close/{id} (id: string) -> The period close ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/period-close/{id}/lock` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `id` | path | string | yes | Record id. | ### Responses | Status | Meaning | | --- | --- | | `200` | The period close | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## POST /business-made/period-close/start **Start a period close** `operationId: PeriodCloseController_start` Opens the close process for a period, generating its checklist. Run the close checks first so the checklist starts from a clean position. #### Signature ```http POST /business-made/period-close/start (body) -> The started close ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `GET /business-made/books/reports/close-check` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | ### Request body The period to close. ```json { "periodStart": "2026-09-01", "periodEnd": "2026-09-30" } ``` ### Responses | Status | Meaning | | --- | --- | | `201` | The started close | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## POST /business-made/period-close/{id}/checklist/{itemId} **Complete a checklist item** `operationId: PeriodCloseController_toggle` Marks one close checklist item done. Required items must all be complete before the period can be locked. #### Signature ```http POST /business-made/period-close/{id}/checklist/{itemId} (id: string, itemId: string, body) -> The updated close ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors | Status | Code | Message | When | What to do | | --- | --- | --- | --- | --- | | `404` | — | Close not found | No period close has that id. | List them with `GET /business-made/period-close`. | Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/period-close/{id}/lock` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `id` | path | string | yes | Record id. | | `itemId` | path | string | yes | Checklist item id. | ### Request body Optional completion note. ```json { "note": "Bank reconciled to statement 09/30" } ``` ### Responses | Status | Meaning | | --- | --- | | `201` | The updated close | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `404` | Close not found — No period close has that id. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## POST /business-made/period-close/{id}/lock **Lock a period** `operationId: PeriodCloseController_lock` Closes and locks an accounting period so no further entries can be posted into it. The point the reports for that period stop moving. **Every required checklist item must be complete** — the error reports how many are outstanding and which they are, rather than simply refusing. #### Signature ```http POST /business-made/period-close/{id}/lock (id: string) -> The locked period ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Notes - Reopening a locked period is visible in the audit trail — get the checks right first. #### Errors | Status | Code | Message | When | What to do | | --- | --- | --- | --- | --- | | `404` | — | Close not found | No period close has that id. | List them with `GET /business-made/period-close`. | | `400` | — | required item(s) incomplete | Required checklist items remain outstanding. | The body lists the incomplete items. | Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/period-close/{id}/reopen` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `id` | path | string | yes | Record id. | ### Responses | Status | Meaning | | --- | --- | | `201` | The locked period | | `400` | required item(s) incomplete — Required checklist items remain outstanding. | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `404` | Close not found — No period close has that id. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## POST /business-made/period-close/{id}/reopen **Reopen a period** `operationId: PeriodCloseController_reopen` Unlocks a closed period so entries can be posted into it again. Reopening after reports have been filed or shared means those figures may now change — record why. #### Signature ```http POST /business-made/period-close/{id}/reopen (id: string, body) -> The reopened period ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Notes - Anything already reported from the period may no longer match. #### Errors | Status | Code | Message | When | What to do | | --- | --- | --- | --- | --- | | `404` | — | Close not found | No period close has that id. | List them with `GET /business-made/period-close`. | Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `POST /business-made/period-close/{id}/lock` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `id` | path | string | yes | Record id. | ### Request body Why it was reopened. ```json { "reason": "Late supplier invoice for September" } ``` ### Responses | Status | Meaning | | --- | --- | | `201` | The reopened period | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `404` | Close not found — No period close has that id. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## GET /business-made/budgets **List budgets** `operationId: BudgetController_list` Budgets defined for the org. #### Signature ```http GET /business-made/budgets () -> Budgets ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `GET /business-made/budgets/{id}/variance` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | ### Responses | Status | Meaning | | --- | --- | | `200` | Budgets | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## POST /business-made/budgets **Create a budget** `operationId: BudgetController_create` Creates a budget for a period, by account or department. #### Signature ```http POST /business-made/budgets (body) -> The created budget ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `GET /business-made/budgets/{id}/variance` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | ### Request body The budget to create. ```json { "name": "FY2026 engineering", "periodStart": "2026-01-01", "periodEnd": "2026-12-31", "lines": [ { "accountCode": "6100", "amount": 240000 } ] } ``` ### Responses | Status | Meaning | | --- | --- | | `201` | The created budget | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## GET /business-made/budgets/{id} **Get a budget** `operationId: BudgetController_get` Fetches one budget with its lines. #### Signature ```http GET /business-made/budgets/{id} (id: string) -> The budget ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `GET /business-made/budgets/{id}/variance` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `id` | path | string | yes | Record id. | ### Responses | Status | Meaning | | --- | --- | | `200` | The budget | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## POST /business-made/budgets/update **Update a budget** `operationId: BudgetController_update` Updates a budget. Revising it mid-period changes the variance figures retrospectively — keep a record of the original if the comparison matters. #### Signature ```http POST /business-made/budgets/update (body) -> The updated budget ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `GET /business-made/budgets/{id}/variance` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | ### Request body The budget to update. ```json { "id": "BUD-4821", "lines": [ { "accountCode": "6100", "amount": 260000 } ] } ``` ### Responses | Status | Meaning | | --- | --- | | `201` | The updated budget | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. | ## GET /business-made/budgets/{id}/variance **Get budget variance** `operationId: BudgetController_variance` Budget against actual for a period — where spending has diverged from plan. Actuals come from posted journals, so unposted entries do not appear. #### Signature ```http GET /business-made/budgets/{id}/variance (id: string) -> Budget variance ``` #### Access Requires a bearer JWT (`Authorization: Bearer `). #### Errors | Status | Code | Message | When | What to do | | --- | --- | --- | --- | --- | | `404` | — | Budget not found | No budget has that id. | — | Plus the standard platform errors: `401`, `403`, `429`, `500`. #### See also - `GET /business-made/books/reports/pl` ### Parameters | Name | In | Type | Required | Description | | --- | --- | --- | --- | --- | | `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. | | `id` | path | string | yes | Record id. | ### Responses | Status | Meaning | | --- | --- | | `200` | Budget variance | | `401` | Authentication failed: Invalid or expired token — The `Authorization` header is missing, malformed, or the JWT has expired. | | `403` | You do not have permission to perform this action — The caller is authenticated but lacks the role required by the endpoint, or is acting on another org. | | `404` | Budget not found — No budget has that id. | | `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. | | `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |