




TOTVS is Latin America's leading ERP provider for retail, manufacturing, and services, integrating HR, finance, and operations in Portuguese/Spanish markets.
Have any questions? We’re here to help You
All API requests require authentication via bearer token. After successfully connecting a system through Makini's authentication module, you receive an API token. Include this token in the Authorization header of your requests: `Authorization: Bearer YOUR_API_TOKEN`. Each connection has a unique token, allowing you to manage multiple customer connections independently. Tokens remain valid as long as the underlying system credentials are valid and the connection is active. If a customer changes their system credentials, you'll need to reconnect to obtain a new token.
Makini's purchase order data model includes comprehensive field coverage across all major ERP systems. Standard fields include order number, line items, vendor information, quantities, unit prices, dates (order date, required date, delivery date), status, currency, ship-to and bill-to addresses, payment terms, and custom fields. Each line item includes product/material codes, descriptions, quantities, unit of measure, pricing, and delivery information. The specific fields available depend on the source system's capabilities. You can view the complete field mapping for any connected system in the Makini dashboard, and custom fields can be added as needed for your specific requirements.
Write operation limitations vary by system. Common limitations include: field-level restrictions (some fields may be read-only), business rule validation (orders may require certain fields or valid vendor codes), permission requirements (the connected account needs specific permissions), timing restrictions (some systems prevent modifications after certain workflow states), and rate limits on write operations. Custom fields in target systems may not be writable through standard APIs. Some systems have transactional requirements—for example, purchase order line items must be created in the same transaction as the order header. During implementation, we identify write operation limitations for your specific use cases and design workflows that work within those constraints.
Makini takes a defense-in-depth approach to security. All data in transit uses TLS 1.2 or higher. Data at rest is encrypted using AES-256 encryption. Customer credentials are encrypted using secure key management with separate encryption keys per customer. We implement network segmentation, strict access controls, and follow the principle of least privilege. Our infrastructure undergoes regular security audits, penetration testing, and vulnerability assessments. We're SOC 2 Type 2 certified, demonstrating our commitment to security controls. Employee access to production systems is logged and monitored. For customers with strict compliance requirements, we offer self-hosted deployments where data never leaves your infrastructure, eliminating Makini as a data processor.
