E Conomic Visma e-conomic OpenAPI

What authentication does the Visma e-conomic OpenAPI use?

Every request requires two API keys passed as headers: 'X-AppSecretToken' identifies the integration and 'X-AgreementGrantToken' identifies the e-conomic agreement (tenant) the call acts on. Through Jentic, both are stored encrypted in the vault and injected per-call rather than handed to the agent.

Can I create mileage entries with the Visma e-conomic API?

Yes. POST /mileages creates a mileage entry, PUT /mileages updates one, DELETE /mileages/{number} removes it, and POST /mileages/approve marks a batch approved. Pricing for the entries is read from /mileageprices and /mileageprices/{number}.

What are the rate limits for the Visma e-conomic OpenAPI?

The OpenAPI spec does not declare numeric rate limits. Visma e-conomic applies tenant-level fair-use throttling - high-volume integrations should use the /paged endpoints (e.g. /employees/paged, /mileages/paged) rather than repeatedly calling the unpaged list.

How do I post a mileage entry through Jentic?

Run pip install jentic, search for 'create a mileage entry in e-conomic', load the operation for POST /mileages, then execute it with the employee number, date, and distance. Jentic injects both the X-AppSecretToken and X-AgreementGrantToken headers automatically.

Can I page through employees instead of pulling them all at once?

Yes. GET /employees/paged returns a page-based response and GET /employees/count returns the total count, so a sync job can iterate pages rather than fetching the unpaged /employees list. The same paged + count pattern applies to mileages, activities, project activities, and project customers.

Can I limit what my agent is allowed to do with the Visma e-conomic API?

Yes. Because you run Jentic One yourself, your own rules decide exactly which e-conomic operations the agent may call, so you can allow read-only work like GET /employees/paged or GET /project-customers/paged while withholding write actions. If the agent only needs to create mileage entries, grant POST /mileages and leave riskier operations such as POST /mileages/approve, POST /employees, or POST /employeegroups out of the allowed set. Since the API targets the agreement and records through the X-AppSecretToken and X-AgreementGrantToken headers and request bodies rather than the URL path, you scope by choosing operations rather than by editing paths. The two tokens are stored by your own instance and injected at execution time, so the agent never sees them.