API guide

Varavil · Last updated 7 November 2026

Your own website or tool can read your follow-up lists from Varavil, and send in new enquiries, quotations and customers. The base address is https://varavil.in/api/v1.

Use it from your own server, never from a web page: the key is a password, and a browser on another site is not allowed to call the API.

Keys

The owner of the company makes a key in Settings, under API access. The whole key is shown once; Varavil keeps only a hash of it.
Send it with every call: Authorization: Bearer vrv_live_...
Each key belongs to one company and can do only what the owner ticked. It can stop on a date, work only from addresses the owner lists, and be revoked at once.
A wrong, revoked or expired key always gets the same answer: 401 invalid_key.

What a key can do

Call	Permission it needs	What it does
GET /v1/followups	followups:read	Who needs a follow-up now, the same list as the Home screen
GET /v1/enquiries	enquiries:read	The enquiries
GET /v1/quotations	quotations:read	The quotations
GET /v1/customers	customers:read	The customers
GET /v1/invoices	invoices:read	The invoices, with their totals
POST /v1/enquiries	enquiries:create	Send in a new enquiry
POST /v1/quotations	quotations:create	Send in a new quotation
POST /v1/customers	customers:create	Send in a new customer

Nothing here changes or deletes a record, and no invoice can be made. The calls read the company's main books.

Reading

GET /v1/enquiries?limit=50&offset=0 answers { "data": [...], "count": 50, "total": 120, "next_offset": 50 }. limit is 1 to 200 (100 if left out). Newest first. Money is in rupees.

Sending in a record

Send JSON with Content-Type: application/json. The fields are checked exactly as the forms in Varavil check them, so a bad date or amount, a missing required field, or a quotation whose amount is not the total of its items is refused with a 422 that names the field.

Enquiry fields: date, name, contact, source, about, value, note. Only name is required.
Quotation fields: number, date, customer, contact, description, items, amount, valid_until, note. number, customer and amount are required.
Customer fields: name, contact, address, since, note. Only name is required.

The answer is 202 Accepted: the record waits in Varavil, and a person who can write the company's books takes it in (or throws it away). It is never added behind their back.

Send an Idempotency-Key header (letters, digits, dots, dashes, up to 64) and a retry of the same call adds nothing twice.

curl -X POST https://varavil.in/api/v1/enquiries -H "Authorization: Bearer $VARAVIL_KEY" -H "Content-Type: application/json" -H "Idempotency-Key: website-form-1001" -d '{"name":"Asha Fabrics","contact":"98400 12345","about":"Bulk order","value":15000}'

The answer:

{ "id": "kQ3x9...", "status": "waiting", "message": "Received. It will appear in Varavil for the owner to take in." }

Limits

Reading: 60 calls a minute and 5000 a day, for each key.
Sending in: 20 calls a minute and 500 a day, for each key.
A caller that sends too many wrong keys is shut out for a while.
Over a limit you get 429 with a Retry-After header (seconds).
Sending in stops while a great many records are still waiting to be taken in, and while the company's plan is read-only.

Answers

Status	Meaning
200	Read
202	Received, waiting for the owner
400	The request is not in the expected form
401	Invalid key
403	The key was not given that permission, the plan is read-only, or the call came from an address the key does not allow
404	No such address
405	Only GET and POST are used
422	A field is not valid (the answer names it)
429	Too many calls

Every call is logged for the owner (the time, the key, the address and the result, never what was sent) for 30 days. See the Terms and the Privacy Policy.

Start your 30-day free trial No card needed.