> ## Documentation Index
> Fetch the complete documentation index at: https://docs.saasybill.com/llms.txt
> Use this file to discover all available pages before exploring further.
# List customers
Requires the `customers:read` scope. See [Authentication](/api-reference/authentication#scopes).
## OpenAPI
````yaml /api-reference/openapi.json get /v1/customers
openapi: 3.1.0
info:
title: Saasybill API
version: 1.0.0
description: >-
Create and manage subscriptions in Saasybill from your own platform.
**Authentication.** `Authorization: Bearer saasybill_live_…`. Create keys
under Developer Settings.
**Idempotency.** Send an `Idempotency-Key` on writes. It is required to
create a subscription.
**Webhooks.** Saasybill calls your URL when something changes. Events:
`customer.created`, `customer.updated`, `customer.deleted`,
`subscription.created`, `subscription.updated`, `subscription.ended`,
`subscription.restored`, `subscription.deleted`, `invoice.created`,
`invoice.updated`, `invoice.paid`, `invoice.voided`, `invoice.deleted`,
`credit_note.created`, `credit_note.updated`, `credit_note.voided`,
`credit_note.deleted`. Each request is signed: `Saasybill-Signature: t=,v1=`, where `v1` is `HMAC-SHA256(secret, ".")`.
Reject a `t` more than five minutes old. Deliveries are at-least-once,
retried for about 20 hours, and unordered: de-duplicate on the event `id`.
Changes are detected about once a minute, so an event can arrive up to a
minute late, and changes inside one minute are combined.
**Testing.** Create a sandbox under Developer Settings → Configuration,
connect it to a Xero Demo Company, and use a test key (`saasybill_test_…`)
created inside it. A test key works only in its sandbox, which sends no
emails and is never billed. Your plans, customers and subscriptions can be
copied into the sandbox when it is created or reset, and its test clock can
be advanced to see renewals without waiting. `GET /v1/organisation` returns
`livemode: false` for a sandbox.
servers:
- url: https://api.saasybill.com
description: Production
security: []
tags:
- name: Organisation
description: The organisation an API key belongs to.
- name: Customers
description: >-
Customers are synced from Xero. Create one only where the organisation
allows it.
- name: Plans
description: Read the pricing plans you can sell.
- name: Charges
description: Read the one-off fees that can be added to a new subscription.
- name: Subscriptions
description: Create subscriptions, change units, and end or restore them.
- name: Invoices
description: Read the invoices Saasybill raises in Xero.
- name: Credit notes
description: >-
Read the credit notes Saasybill raises in Xero, and where their credit was
applied.
- name: Usage
description: Report the usage that is billed in arrears against a subscription.
paths:
/v1/customers:
get:
tags:
- Customers
summary: List customers
operationId: get_v1_customers
parameters:
- name: limit
in: query
schema:
type: integer
minimum: 1
maximum: 100
default: 25
- name: starting_after
in: query
description: The id of the last object on the previous page.
schema:
type: string
- name: code
in: query
description: The customer's code.
schema:
type: string
- name: email
in: query
description: Case-insensitive.
schema:
type: string
- name: status
in: query
description: Only these statuses, comma-separated. Every status when left out.
style: form
explode: false
schema:
type: array
items:
type: string
enum:
- active
- inactive
responses:
'200':
description: Success.
content:
application/json:
schema:
type: object
properties:
data:
type: array
items:
type: object
properties:
id:
type: string
object:
type: string
const: customer
code:
type:
- string
- 'null'
name:
description: >-
The contact's name in Xero. Xero requires one, so
this is null only for a customer imported without
it.
type:
- string
- 'null'
first_name:
description: The contact person's first name, in Xero.
type:
- string
- 'null'
last_name:
description: The contact person's last name, in Xero.
type:
- string
- 'null'
email:
type:
- string
- 'null'
status:
type: string
enum:
- active
- inactive
xero_contact_id:
type:
- string
- 'null'
created:
type: string
format: date-time
description: ISO 8601, UTC.
required:
- id
- object
- code
- name
- first_name
- last_name
- email
- status
- xero_contact_id
- created
additionalProperties: false
has_more:
type: boolean
required:
- data
- has_more
additionalProperties: false
example:
data:
- id: 3b9f1c1e-6a52-4c0e-9d7e-1f6f2f0b7a11
object: customer
code: ACME-001
name: Acme Pty Ltd
first_name: null
last_name: null
email: accounts@acme.example
status: active
xero_contact_id: d5f2a8c1-6b73-4e09-8a1d-4c7e9b3f0a12
created: '2026-08-14T02:31:08.000Z'
has_more: false
headers:
Request-Id:
$ref: '#/components/headers/Request-Id'
RateLimit-Limit:
$ref: '#/components/headers/RateLimit-Limit'
RateLimit-Remaining:
$ref: '#/components/headers/RateLimit-Remaining'
RateLimit-Reset:
$ref: '#/components/headers/RateLimit-Reset'
'401':
description: The key is missing, malformed, revoked or expired.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
example:
error:
type: authentication_error
code: invalid_api_key
message: 'Provide a valid API key as `Authorization: Bearer `.'
request_id: req_4f1a9c2e7b8d3a605e1c9f02
headers:
Request-Id:
$ref: '#/components/headers/Request-Id'
'403':
description: >-
The key lacks the scope, is a test key, or the organisation has not
allowed this.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
example:
error:
type: permission_error
code: insufficient_scope
message: This API key does not have the `subscriptions:write` scope.
request_id: req_4f1a9c2e7b8d3a605e1c9f02
headers:
Request-Id:
$ref: '#/components/headers/Request-Id'
'404':
description: No such object.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
example:
error:
type: not_found
code: customer_not_found
message: There is no customer with that id.
request_id: req_4f1a9c2e7b8d3a605e1c9f02
headers:
Request-Id:
$ref: '#/components/headers/Request-Id'
'409':
description: >-
The request conflicts with the current state, or with an earlier
request using the same `Idempotency-Key`.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
example:
error:
type: conflict
code: idempotency_conflict
message: >-
This `Idempotency-Key` was used with a different request.
Use a new key for a different request.
request_id: req_4f1a9c2e7b8d3a605e1c9f02
headers:
Request-Id:
$ref: '#/components/headers/Request-Id'
'422':
description: A field is missing or invalid. `error.param` names it.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
example:
error:
type: invalid_request_error
code: invalid_parameter
message: '`units`: Invalid input: expected number, received string'
param: units
request_id: req_4f1a9c2e7b8d3a605e1c9f02
headers:
Request-Id:
$ref: '#/components/headers/Request-Id'
'429':
description: 'Rate limited: 120 requests a minute per key. See `Retry-After`.'
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
example:
error:
type: rate_limit_error
code: rate_limited
message: Too many requests. Try again in 12 seconds.
request_id: req_4f1a9c2e7b8d3a605e1c9f02
headers:
Request-Id:
$ref: '#/components/headers/Request-Id'
'500':
description: >-
Something went wrong on our side. Retry; quote `error.request_id` if
it persists.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
example:
error:
type: api_error
code: internal_error
message: >-
Something went wrong on our side. Retry the request; if it
keeps failing, quote the request id.
request_id: req_4f1a9c2e7b8d3a605e1c9f02
headers:
Request-Id:
$ref: '#/components/headers/Request-Id'
security:
- bearerAuth:
- customers:read
components:
headers:
Request-Id:
description: A unique id for the request. Quote it when you contact support.
schema:
type: string
example: req_4f1a9c2e7b8d3a605e1c9f02
RateLimit-Limit:
description: Requests allowed per minute for this key.
schema:
type: integer
example: 120
RateLimit-Remaining:
description: Requests left in the current window.
schema:
type: integer
example: 117
RateLimit-Reset:
description: Seconds until the oldest counted request stops counting.
schema:
type: integer
example: 41
schemas:
Error:
type: object
properties:
error:
type: object
properties:
type:
type: string
enum:
- authentication_error
- permission_error
- invalid_request_error
- not_found
- conflict
- rate_limit_error
- api_error
code:
type: string
description: Stable. Branch on this, never on `message`.
message:
type: string
param:
type: string
request_id:
type: string
required:
- type
- code
- message
- request_id
additionalProperties: false
required:
- error
additionalProperties: false
description: >-
Every failed request answers with this shape. Branch on `error.code`,
never on `error.message`.
securitySchemes:
bearerAuth:
type: http
scheme: bearer
description: >-
An API key. Its scopes decide what it may call: `customers:read` (List
and look up customers.) `customers:write` (Create customers, and Xero
contacts where the organisation allows it.) `catalogue:read` (List plans
and charges.) `subscriptions:read` (List and look up subscriptions.)
`subscriptions:write` (Create subscriptions, change units, end and
restore them.) `invoices:read` (List and look up invoices.)
`credit_notes:read` (List and look up credit notes, and where their
credit was applied.)
````
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.