Start from: Your server?to?server integration (API client).
The Cashrec API
The Cashrec API is a RESTful service for fetching cash sheet data for specific business centers and date ranges.
Key Benefits:
- Get detailed shift-level cash and sales info.
- Secure, encrypted server-to-server integration (HTTPS + JWT).
- Supports high-volume, real-time requests.
Generate a JWT token
POST to: https://login.mapal-os.com/connect/token
Parameters:
- grant_type=password
- username=<your_username>
- password=<your_password>
- client_id=wf_wap_tp
- client_secret=<shared_client_secret> (contact Customer Support to obtain)
Successful response fields: access_token, expires_in, token_type, refresh_token, scope.
Include the token in requests
- Add the header: Authorization: Bearer {access_token}
Get cash sheet information
- Base domain (OpenAPI): https://cashrec.api.pro.mapal-os.com
- Endpoint path: /api/v1/cashSheet
- Method: GET
- Description: Retrieves detailed cash sheet information for a specified period and list of business centres.
Query parameters
- startDate (format: yyyy-MM-ddTHH:mm:ss)
- endDate (format: yyyy-MM-ddTHH:mm:ss)
- centersList (comma?separated list of centre IDs)
- Response: 200 OK with cash sheet records for the requested period and centres.
Notes: Parameter naming may be case?sensitive. Use the exact names shown in your OpenAPI specification if they differ (for example, StartDate vs startDate). For the full request/response schema and interactive documentation, see the OpenAPI specification at: https://cashrec.api.pro.mapal-os.com/swagger/index.html
API errors
- 400 Bad Request: missing or invalid parameters. Example message code 100: “Invalid parameters. You must provide valid StartDate, EndDate and CenterLists.”
- 401 Unauthorized: invalid or missing token.
- 404 Not Found: tenant not found. Example message code 0: “Tenant configuration not found.”
- 500 Internal Server Error: unexpected server error.
Notes: All requests must use HTTPS. Tokens expire (see expires_in) and must be refreshed when expired. If a token is compromised, it can be revoked by the API provider
