The Avaza API lets your own software read and change the data in your Avaza account: projects, tasks, timesheets, expenses, invoices, estimates, contacts, schedules and more. It's a REST API that sends and receives JSON over HTTPS.

You don't need to write code to connect most tools. Zapier MCP and the Avaza MCP Server connect AI assistants without any programming. The API is for developers who build their own integration.

Where the documentation lives

The API reference is at api.avaza.com. It lists every endpoint with its parameters and response fields, and you can sign in with your Avaza login there to try calls in the browser. The OpenAPI (Swagger) specification is at https://api.avaza.com/swagger/docs/v1.

Send your requests to https://api.avaza.com/, for example GET https://api.avaza.com/api/Project.

Choose how to authenticate

There are two ways in. Both are managed in Settings › Developer Apps & API Access, and only Administrators can open that page. For everyone else the tile is greyed out.

Personal access token

OAuth app

Best for

Your own scripts and internal tools

Apps that other people connect to their Avaza account

Acts as

The Administrator who created the token

Each person who signs in and approves the app

Expires

No. Delete the token to stop it

Access tokens after 24 hours, refresh tokens after 180 days

Set up

Personal access tokens tab

OAuth tab. See OAuth 2.0 for the Avaza API

Create a personal access token

  1. Go to Settings › Developer Apps & API Access and open the Personal access tokens tab.

  2. Click Add Personal Access Token, and type a Name/Alias that says what the token is for.

  3. Under Select Access Scopes, tick what the token may do (see the table below), then click Save.

    The Add Personal Access Token popup with the empty Name/Alias field and the Select Access Scopes list of read and write boxes for each area, plus Webhook notifications and File Attachment upload, above the Save button

  4. Copy the token from the Token box. Avaza shows it only once.

  5. Send it in the Authorization header of every request.

curl https://api.avaza.com/api/Account \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

You can't change a token's scopes later: create a new token instead. To revoke a token, click the cross at the end of its row and confirm. Anything using it stops working straight away.

Scopes

Scopes decide which parts of the API a token or app can reach.

Scope

Covers

read_contacts, write_contacts

Customers (companies) and contacts

read_account, write_account

Account details and settings

read_users, write_users

User profiles

read_financials, write_financials

Estimates, invoices, payments, credit notes, bills, inventory items, taxes and fixed amounts

read_projects, write_projects

Projects, project members, sections, tasks, task comments, and task types, statuses and priorities

read_schedule, write_schedule

Resource scheduling

read_timesheets, write_timesheets

Timesheets, timers, submission and approval

read_expenses, write_expenses

Expenses and expense settings

webhook_notifications

Webhook subscriptions

upload_attachment

File attachment uploads

A write scope doesn't include read, so tick both if your integration reads and changes the same data. A call without the scope it needs returns 403 with the title "Required Scopes were not found".

Scopes are only half of it. The API respects the roles of the person behind the token and returns only what they could see in Avaza. For example, the invoice endpoints work only for Administrators and Finance Managers.

Limit what the API can do

Administrators can restrict API access further on the API permissions tab of the same page:

  • Account defaults: for each group of endpoints, set Read (GET), Create (POST), Update (PUT) and Delete (DELETE) to Role-based, Admins only or Blocked. Role-based is the default: the person's roles decide.
  • User overrides: stricter settings for one person, or Block all API access for this user. Overrides can only restrict.
  • Limit bulk deletes: at most 25, 50 or 100 API deletes per user per hour.
  • Activity log: every change to these settings, with Export CSV.
The API permissions tab on Account defaults: endpoint permissions for each area of Avaza, all Role-based, and the Limit bulk deletes option at the bottom
The User overrides tab with Jake Morrison selected in the list of people, showing the Block all API access for this user box above his endpoint permissions

These rules apply to personal access tokens, AI assistants connected through the Avaza MCP Server, and third-party apps. The rules never give anyone more than their roles allow. Changes take effect within about a minute.

A blocked request returns 403 with the title "Blocked by account API policy". A person over the delete limit gets 429 until the next full hour.

Limits and errors

  • Rate limits: each app or token gets 250 calls a minute and 5,000 a day on each account, and the account has overall limits too. See API rate limits.
  • Paging: list endpoints return 20 records a page unless you set pageSize (up to 1,000). Most accept UpdatedAfter, so you only fetch what changed.
  • Errors come back as JSON problem details with a title, status and detail. 401 means the token is missing, wrong or expired. 403 means a missing scope, a role that doesn't allow the call, or an API permission rule. 429 means a rate limit.

Next steps