canonical: https://jentic.com/apis/frappe.io/frappe

# Frappe Framework REST API

Frappe is the open-source Python framework that powers ERPNext, and every site automatically exposes its DocTypes through a REST API. The 10 endpoints in this spec cover authentication, generic CRUD on any DocType via `/api/resource`, dotted-path remote method calls via `/api/method`, file uploads, and the current logged-in user lookup. Because every business object - Sales Invoice, Purchase Order, Customer, Item, Employee - is a DocType, the same handful of endpoints reach hundreds of resources without a per-resource wrapper.

## For AI agents

Read, create, update, and delete any DocType on a Frappe or ERPNext site, plus invoke server-side methods and upload files. Authentication is token (api_key:api_secret) or OAuth2 bearer.

## Scope

Does not handle real-time messaging, payment processing, or external email delivery - use for CRUD on Frappe DocTypes and server-method invocation only.

## Capabilities

- List, filter, and paginate any DocType via GET `/api/resource/{doctype}`
- Create new records of any DocType with POST `/api/resource/{doctype}`
- Read, update, and delete a specific record by name via `/api/resource/{doctype}/{name}`
- Invoke any whitelisted server-side method via `/api/method/{dotted_path}`
- Upload a file and attach it to a DocType through `/api/method/upload_file`
- Authenticate a session using username and password via `/api/method/login`
- Identify the current authenticated user via `/api/method/frappe.auth.get_logged_user`

## Use cases

### ERPNext Automation

An operations team automates routine ERPNext tasks like creating Sales Invoices from external orders, updating stock entries, and running monthly close reports. Because every ERPNext document is a Frappe DocType, the same `/api/resource` pattern handles all of them with a consistent JSON schema and filter syntax.

Example prompt: POST `/api/resource/Sales` Invoice with customer, items, and posting_date, then update its status with PUT `/api/resource/Sales` Invoice/{name}

### Custom Business App Backend

A team building a custom ERPNext app exposes server-side Python methods for complex workflows that a single CRUD call cannot express. The `/api/method` endpoint lets the frontend or an external integration trigger that method by its dotted Python path, with the Frappe permission system enforced on every call.

Example prompt: POST `/api/method/{dotted_path}` with the JSON arguments expected by the Python method, then read the resulting message from the response

### Data Sync to External Systems

An integration script keeps ERPNext customers and items in sync with an external CRM or e-commerce store. The script paginates GET `/api/resource/{doctype}` with a modified filter, fetches changed records since the last run, and pushes them downstream. The same pattern works in reverse for inbound sync.

Example prompt: GET `/api/resource/Customer`?filters=[["modified",">","2026-06-01"]]&limit_page_length=100 and post each result to the downstream CRM

### AI Agent ERP Operator

An agent receives natural-language requests like 'create a quote for Acme for 10 widgets at 50 each' and translates them into Frappe API calls through Jentic. The agent never sees the api_key or api_secret - Jentic injects them at execution time - and gets a structured response it can read back to the user.

Example prompt: Search Jentic for 'create a Sales Invoice in ERPNext', load the resource schema, and execute POST `/api/resource/Sales` Invoice with the parsed line items

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/api/resource/{doctype}` | List records of a DocType with filters and pagination |
| POST | `/api/resource/{doctype}` | Create a new record of a DocType |
| GET | `/api/resource/{doctype}/{name}` | Read a single record by name |
| POST | `/api/method/{dotted_path}` | Invoke a whitelisted server-side method |
| POST | `/api/method/upload_file` | Upload a file and attach it to a DocType |
| POST | `/api/method/login` | Authenticate by username and password |
| GET | `/api/method/frappe.auth.get_logged_user` | Identify the currently authenticated user |

## Key resources

- **Documents** — Generic CRUD across every DocType through `/api/resource/{doctype}`
- **Methods** — Invoke whitelisted server-side Python methods by dotted path
- **Auth** — Login by credentials and read the currently authenticated user
- **Files** — Upload files and attach them to DocType records

## Why Jentic

- **Setup:** Wiring the Frappe Framework REST API by hand means choosing between its api_key/api_secret token header and OAuth2 bearer auth, resolving your own site host into the {site} base URL, and building your own retry and error handling. Through Jentic you install once, import Frappe from the API Directory, store the chosen credential once, and your agent calls it.
- **Permission scoping:** Frappe puts the DocType and record name in the URL path (`/api/resource/{doctype}/{name}`), so a rule can pin your agent to one DocType: it can read and create records of that type. You choose the operations it may call, so arbitrary server-method invocation via `/api/method` is not included unless you add it.
- **Credential handling:** Your Frappe api_key/api_secret pair or OAuth2 bearer token is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'create a Sales Invoice' or 'find all Customers', and Jentic returns the matching `/api/resource` or `/api/method` operation with its input schema so the agent does not need to know the dotted path or DocType name in advance.

## Related APIs

- **Salesforce** — Salesforce offers a richer per-resource REST API but is closed-source and significantly more expensive
- **HubSpot CRM Contacts** — HubSpot covers marketing-led CRM that frequently needs to sync customers into ERPNext
- **Zoho CRM** — Zoho CRM is a SaaS CRM and operations suite that overlaps with ERPNext modules

## FAQ

### What authentication does the Frappe REST API use?

Frappe supports two schemes: a token header in the form 'Authorization: token api_key:api_secret', and OAuth2 bearer tokens for apps that go through the Frappe OAuth flow. Through Jentic, both kinds of credential are stored encrypted in the vault and the agent only sees a scoped execution token.

### Can I create any DocType record with the Frappe REST API?

Yes. POST to `/api/resource/{doctype}` with a JSON body containing the field values. The same endpoint pattern works for Sales Invoice, Customer, Item, Employee, or any custom DocType - Frappe enforces the DocType's own validation and permission rules on the call.

### What are the rate limits for the Frappe REST API?

Frappe does not impose framework-level rate limits in the spec. ERPNext Cloud applies per-site fair-use limits and a Frappe site administrator can configure rate limiting through the System Settings DocType for self-hosted installations.

### How do I call a custom server method through Jentic?

Search Jentic for 'call a Frappe server method', load the `/api/method/{dotted_path}` schema, and execute it with the dotted Python path of the whitelisted method (for example erpnext.stock.get_item_details.get_item_details) plus the JSON arguments. The response carries whatever the Python function returned.

### Is the Frappe REST API free?

Frappe and ERPNext are open source under the GNU GPLv3, so self-hosted installations have no licensing cost for API access. ERPNext Cloud is a paid hosted plan and the same REST API is included with every paid tier.

### How do I upload a file and attach it to a DocType?

POST to `/api/method/upload_file` as multipart/form-data with the file payload plus the doctype and docname fields that name the parent record. Frappe stores the file and creates the attachment link automatically.

### Can I limit what my agent is allowed to do with the Frappe Framework REST API?

Yes. Because Frappe puts the DocType and record name directly in the URL path (`/api/resource/{doctype}/{name}`), a rule in your self-hosted Jentic One can pin the agent to a single DocType and let it only read and create records of that type. You decide which operations the agent may call, so arbitrary server-method invocation through `/api/method` is excluded unless you explicitly add it. Your api_key/api_secret pair or OAuth2 bearer token stays with your own instance and is injected at execution time, never entering the agent's prompt or context.