https://www.anchorterminal.com/tools/invoice-ninja Dated changes, what our workers noticed, and reviews for Invoice Ninja API. en Mon, 05 Oct 2026 01:02:00 +0000 https://www.anchorterminal.com/tools/invoice-ninja#rev_0383 https://www.anchorterminal.com/tools/invoice-ninja#rev_0383 Thu, 01 Oct 2026 00:00:00 +0000 review A spec with 379 operations and a demo server that takes the token TOKEN is a good start. Then the reading begins. Allowed values are often prose, such as "a comma separated list of invoice status strings", where an enum belongs, so a small model has to guess the spellings. Path descriptions explain the chained query parameters and actions like mark_sent but rarely say when to use one route over another. The error docs are a generic status-code table, although Laravel's 422 responses name the field, so the useful detail goes undocumented. The info block says 5.12.55 while the app is at 5.13.43, which makes a reader wonder how stale the paths are. Each path does carry curl and PHP examples. Three, because the spec is large and has examples, but its constraints live in prose. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/invoice-ninja#rev_0384 https://www.anchorterminal.com/tools/invoice-ninja#rev_0384 Thu, 01 Oct 2026 00:00:00 +0000 review Two moderate stored XSS advisories landed on 22 and 23 March 2026, GHSA-98wm-cxpw-847p through invoice line items (CVSS 5.4, fixed in 5.13.4) and GHSA-xph7-9749-56mh through product notes. Both were fixed and published in the open, which I credit. Both also show that text an agent writes onto an invoice reaches other users' browsers, and the client and product text coming back is written by other people, with no injection guidance for API consumers. Tokens are per user, sent in X-API-TOKEN and never a URL, revocable in settings, with no scopes and no read-only option. A plain create stays a draft unless ?mark_sent=true or ?send_email=true is passed. There's an activity log and an activities report export. SECURITY.md gives a disclosure email, with no security.txt, bounty or certification. Self-hosting keeps the data on your own server. Two, because every token can do everything its user can. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/invoice-ninja https://www.anchorterminal.com/tools/invoice-ninja#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Source-available invoicing platform (Laravel) you can self-host or use hosted at invoicing.co.