openapi: 3.1.0
info:
  title: BILL v3 Authentication API
  description: 'REST API providing access to BILL''s Accounts Payable, Accounts Receivable,

    and Spend & Expense capabilities — bills, invoices, vendors, customers,

    payments, funding accounts, organizations, webhooks, and authentication

    workflows.


    Best-effort OpenAPI reconstruction from BILL''s public developer portal at

    https://developer.bill.com/docs/home. Authoritative reference and Postman

    collection live under https://developer.bill.com/reference and

    https://developer.bill.com/llms.txt.

    '
  version: 3.0.0
  contact:
    name: BILL Developer Portal
    url: https://developer.bill.com/docs/home
  license:
    name: Proprietary
servers:
- url: https://gateway.prod.bill.com/connect/v3
  description: BILL production gateway (Connect v3)
- url: https://gateway.stage.bill.com/connect/v3
  description: BILL sandbox gateway (Connect v3)
- url: https://api.bill.com/v3
  description: BILL production API
- url: https://api-sandbox.bill.com/v3
  description: BILL sandbox API
security:
- sessionAuth: []
tags:
- name: Authentication
paths:
  /login:
    post:
      tags:
      - Authentication
      summary: Sign in to a BILL organization
      description: 'Authenticates a BILL user. Returns a `sessionId` to be used as the

        session identifier on subsequent requests (expires after 35 minutes of

        inactivity).

        '
      operationId: login
      security: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LoginRequest'
      responses:
        '200':
          description: Authenticated session.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LoginResponse'
        4XX:
          $ref: '#/components/responses/Error'
        5XX:
          $ref: '#/components/responses/Error'
  /logout:
    post:
      tags:
      - Authentication
      summary: Sign out of the current session
      operationId: logout
      responses:
        '200':
          description: Signed out.
  /mfa/setup:
    post:
      tags:
      - Authentication
      summary: Add phone for multi-factor authentication
      operationId: setupMfa
      responses:
        '200':
          description: MFA setup initiated.
  /mfa/challenge:
    post:
      tags:
      - Authentication
      summary: Generate an MFA challenge
      operationId: challengeMfa
      responses:
        '200':
          description: MFA challenge issued.
  /session:
    get:
      tags:
      - Authentication
      summary: Retrieve current session details
      operationId: getSession
      responses:
        '200':
          description: Current session.
components:
  schemas:
    LoginResponse:
      type: object
      properties:
        sessionId:
          type: string
        organizationId:
          type: string
        userId:
          type: string
    LoginRequest:
      type: object
      required:
      - devKey
      - username
      - organizationId
      properties:
        devKey:
          type: string
          description: Developer key issued by BILL.
        username:
          type: string
          format: email
        password:
          type: string
          format: password
        consoleApiToken:
          type: string
          description: Token for Accountant Console users.
        organizationId:
          type: string
        rememberMeId:
          type: string
          description: MFA identifier for trusted 30-day sessions.
        device:
          type: string
          description: Mobile device nickname for MFA sessions.
  responses:
    Error:
      description: Error response.
      content:
        application/json:
          schema:
            type: object
            properties:
              errors:
                type: array
                items:
                  type: object
                  properties:
                    code:
                      type: string
                    message:
                      type: string
                    field:
                      type: string
  securitySchemes:
    sessionAuth:
      type: apiKey
      in: header
      name: sessionId
      description: 'Session identifier obtained from `POST /login`. Expires after 35 minutes

        of inactivity. A `devKey` (developer key) is also required on requests

        and is sent alongside `sessionId` in the appropriate header per BILL''s

        official reference.

        '