This document is for developers integrating with Systima. It describes how to register a new customer - user and company in a single call - and how to land that user in Systima already signed in.

You need credentials from Systima before you start; see Authentication.

All endpoints below are relative to the base URL. Test your integration against staging first; staging credentials do not work in production.

Every request must carry three headers:

Authorization: Bearer <integrator token> X-Provisioning-Client-Id: <your client id> X-Provisioning-Key: <your provisioning key>

Systima issues all three to you. The provisioning key is a secret: keep it server-side, never ship it in a browser or mobile app, and never log it. If it leaks, contact Systima - a new key can be issued and the old one deactivated immediately.

Returns the subscription plans that can be activated for a new company. Use it to render a plan picker. Optional, but recommended over hardcoding plans, because prices change over time.

Request

curl 'https://api.systima.no/api-external/subscription-plans' \  -H 'Authorization: Bearer <integrator token>' \  -H 'X-Provisioning-Client-Id: <your client id>' \  -H 'X-Provisioning-Key: <your provisioning key>'

Response 200

[  { "code": "small",  "name": "Invoicing",    "prices": [{ "period": "MONTHLY", "price": 0 },     { "period": "YEARLY", "price": 0 }] },  { "code": "medium", "name": "Invoicing and accounting",    "prices": [{ "period": "MONTHLY", "price": 19900 }, { "period": "YEARLY", "price": 214800 }] },  { "code": "large",  "name": "Invoicing, accounting and salary",    "prices": [{ "period": "MONTHLY", "price": 24900 }, { "period": "YEARLY", "price": 268800 }] } ]

A company has exactly one plan at a time. The response may also contain medium_sb and salary; a plan picker should normally show only small, medium and large.

Creates the user and the company, optionally activates a subscription plan, and returns a one-time URL that logs the user in.

Request

curl -X POST 'https://api.systima.no/api-external/onboarding' \  -H 'Authorization: Bearer <integrator token>' \  -H 'X-Provisioning-Client-Id: <your client id>' \  -H 'X-Provisioning-Key: <your provisioning key>' \  -H 'Content-Type: application/json' \  -d '{
    "user": {
      "firstName": "Edvard",
      "lastName": "Munch",
      "email": "edvard@example.no",
      "phone": "+4721422121"
    },
    "company": {
      "organizationNumber": "999999999",
      "name": "Operahuset AS",
      "phone": "+4721422121",
      "email": "post@example.no",
      "billingEmail": "faktura@example.no",
      "type": "AS",
      "addressLine1": "Kirsten Flagstads Plass 1",
      "addressLine2": null,
      "postalCode": "0150",
      "city": "Oslo",
      "country": "Norway",
      "vatPaymentFrequency": "BIMONTHLY",
      "registeredAt": "1996-10-15",
      "sicCode": "12.99",
      "accountingStartDate": "2026-01-01"
    },
    "plan": "medium",
    "period": "MONTHLY"
  }'

user - the person who becomes the owner of the company.

There is no password field. Systima creates the account with a random password and e-mails the user a link to set their own.

company

Plan selection

Response 200

{  "userId": "6d91d632-2174-4717-97fb-0e3bc11c620d",  "companyId": "fd036958-0872-4dba-b777-0a52442e3131",  "redirectUrl": "https://app.systima.no/integrator-login#ticket=4ca77872fbe74fe3aa3860c5df3e543a"
}

Store userId and companyId if you need to reference the customer later.

Send the user to redirectUrl immediately after the call - a browser redirect, not a link saved for later.

• The ticket in the URL fragment (#ticket=...) is single-use and expires after 60 seconds.
• Systima's web app exchanges it for a real session; the user lands inside their new company, signed in, with no password step.
• Never store, log, e-mail or forward the ticket. If it expires, the user can still sign in normally via the "set your password" e-mail.

Errors are returned as JSON: { "code": "...", "message": "...", "status": ... }.

The whole registration runs in a single database transaction: if the call does not return 200, nothing was created - no user, no company, no subscription. It is safe to fix the payload and retry.

1. Fetch /api-external/subscription-plans and render the plan choice (prices in øre).
2. Collect user and company details; validate the organisation number and e-mail on your side to avoid predictable 422s.
3. Call /api-external/onboarding server-side with the three auth headers.
4. Redirect the browser to redirectUrl right away.
5. Handle 422 by showing the message to the end user, and 401/403 as a configuration error on your side - contact Systima.