Xero · Agentic Access
Xero Agentic Access

x-agentic-access generated
Xero exposes 466 API operations that an AI agent could call, of which 214 are state-changing ‘acting’ operations. This is a recommended x-agentic-access execution contract — the scope, audience, consequence tier, short-lived token constraints, and escalation each action should carry before it is handed to an autonomous agent.
By consequence: 252 read, 173 write, and 41 physical.
Contracts are classified heuristically from the provider’s OpenAPI and refresh on every APIs.io network build; audience is bound per deployment. The model follows Curity’s Access Intelligence (apidays Munich 2026). Browse every provider’s agent contracts at agentic-access.apis.io.
AccountingBank FeedsFinanceFinancial ServicesInvoicingPayrollSmall Business
Operations: 466 Acting: 214 Human-in-the-loop: 0 Method: generated
By consequence

read 252 write 173 physical 41
Highest-consequence actions

The physical and safety-critical operations an agent could invoke — the ones that most warrant scoped tokens, tight TTLs, and escalation. Full per-operation contracts are in the source below.
Method	Path	Consequence	Human-in-loop
PUT	/BankTransfers	physical	conditional
POST	/BankTransfers/{BankTransferID}/Attachments/{FileName}	physical	conditional
PUT	/BankTransfers/{BankTransferID}/Attachments/{FileName}	physical	conditional
PUT	/BankTransfers/{BankTransferID}/History	physical	conditional
PUT	/BatchPayments	physical	conditional
POST	/BatchPayments	physical	conditional
POST	/BatchPayments/{BatchPaymentID}	physical	conditional
PUT	/BatchPayments/{BatchPaymentID}/History	physical	conditional
POST	/BrandingThemes/{BrandingThemeID}/PaymentServices	physical	conditional
POST	/Employees/{EmployeeID}/PaymentMethods	physical	conditional
POST	/Employees/{EmployeeID}/PaymentMethods	physical	conditional
PUT	/Invoices	physical	conditional
POST	/Invoices	physical	conditional
POST	/Invoices/{InvoiceID}	physical	conditional
POST	/Invoices/{InvoiceID}/Attachments/{FileName}	physical	conditional
PUT	/Invoices/{InvoiceID}/Attachments/{FileName}	physical	conditional
POST	/Invoices/{InvoiceID}/Email	physical	conditional
PUT	/Invoices/{InvoiceID}/History	physical	conditional
PUT	/Overpayments/{OverpaymentID}/Allocations	physical	conditional
DELETE	/Overpayments/{OverpaymentID}/Allocations/{AllocationID}	physical	conditional
PUT	/Overpayments/{OverpaymentID}/History	physical	conditional
PUT	/PaymentServices	physical	conditional
PUT	/Payments	physical	conditional
POST	/Payments	physical	conditional
POST	/Payments/{PaymentID}	physical	conditional
Source

Agentic Access

generated: '2026-07-15'
method: generated
source: openapi/xero-accounting-openapi.yml, openapi/xero-assets-openapi.yml, openapi/xero-bankfeeds-openapi.yml,
  openapi/xero-files-openapi.yml, openapi/xero-finance-openapi.yml, openapi/xero-identity-openapi.yml,
  openapi/xero-payroll-au-openapi.yml, openapi/xero-payroll-nz-openapi.yml, openapi/xero-payroll-uk-openapi.yml,
  openapi/xero-projects-openapi.yml
description: Recommended x-agentic-access execution contracts, classified heuristically from
  the OpenAPI. A governance starting point for exposing this API to AI agents — review and bind
  audience per deployment. See research/curity/agentic-governance/.
summary:
  operations: 466
  by_action_class:
    connected: 252
    acting: 214
  by_consequence:
    read: 252
    write: 173
    physical: 41
  human_in_the_loop_required: 0
operations:
- path: /Accounts
  method: get
  operationId: getAccounts
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.settings
    - accounting.settings.read
    token:
      max-ttl: 3600
    audit: none
- path: /Accounts
  method: put
  operationId: createAccount
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.settings
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /Accounts/{AccountID}
  method: get
  operationId: getAccount
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.settings
    - accounting.settings.read
    token:
      max-ttl: 3600
    audit: none
- path: /Accounts/{AccountID}
  method: post
  operationId: updateAccount
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.settings
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /Accounts/{AccountID}
  method: delete
  operationId: deleteAccount
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.settings
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /Accounts/{AccountID}/Attachments
  method: get
  operationId: getAccountAttachments
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.attachments
    - accounting.attachments.read
    token:
      max-ttl: 3600
    audit: none
- path: /Accounts/{AccountID}/Attachments/{AttachmentID}
  method: get
  operationId: getAccountAttachmentById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.attachments
    - accounting.attachments.read
    token:
      max-ttl: 3600
    audit: none
- path: /Accounts/{AccountID}/Attachments/{FileName}
  method: get
  operationId: getAccountAttachmentByFileName
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.attachments
    - accounting.attachments.read
    token:
      max-ttl: 3600
    audit: none
- path: /Accounts/{AccountID}/Attachments/{FileName}
  method: post
  operationId: updateAccountAttachmentByFileName
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.attachments
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /Accounts/{AccountID}/Attachments/{FileName}
  method: put
  operationId: createAccountAttachmentByFileName
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.attachments
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /BatchPayments
  method: get
  operationId: getBatchPayments
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.transactions
    - accounting.transactions.read
    token:
      max-ttl: 3600
    audit: none
- path: /BatchPayments
  method: put
  operationId: createBatchPayment
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    scope:
    - accounting.transactions
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /BatchPayments
  method: post
  operationId: deleteBatchPayment
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    scope:
    - accounting.transactions
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /BatchPayments/{BatchPaymentID}
  method: get
  operationId: getBatchPayment
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.transactions
    - accounting.transactions.read
    token:
      max-ttl: 3600
    audit: none
- path: /BatchPayments/{BatchPaymentID}
  method: post
  operationId: deleteBatchPaymentByUrlParam
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    scope:
    - accounting.transactions
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /BatchPayments/{BatchPaymentID}/History
  method: get
  operationId: getBatchPaymentHistory
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.transactions
    - accounting.transactions.read
    token:
      max-ttl: 3600
    audit: none
- path: /BatchPayments/{BatchPaymentID}/History
  method: put
  operationId: createBatchPaymentHistoryRecord
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    scope:
    - accounting.transactions
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /BankTransactions
  method: get
  operationId: getBankTransactions
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.transactions
    - accounting.transactions.read
    token:
      max-ttl: 3600
    audit: none
- path: /BankTransactions
  method: put
  operationId: createBankTransactions
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.transactions
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /BankTransactions
  method: post
  operationId: updateOrCreateBankTransactions
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.transactions
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /BankTransactions/{BankTransactionID}
  method: get
  operationId: getBankTransaction
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.transactions
    - accounting.transactions.read
    token:
      max-ttl: 3600
    audit: none
- path: /BankTransactions/{BankTransactionID}
  method: post
  operationId: updateBankTransaction
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.transactions
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /BankTransactions/{BankTransactionID}/Attachments
  method: get
  operationId: getBankTransactionAttachments
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.attachments
    - accounting.attachments.read
    token:
      max-ttl: 3600
    audit: none
- path: /BankTransactions/{BankTransactionID}/Attachments/{AttachmentID}
  method: get
  operationId: getBankTransactionAttachmentById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.attachments
    - accounting.attachments.read
    token:
      max-ttl: 3600
    audit: none
- path: /BankTransactions/{BankTransactionID}/Attachments/{FileName}
  method: get
  operationId: getBankTransactionAttachmentByFileName
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.attachments
    - accounting.attachments.read
    token:
      max-ttl: 3600
    audit: none
- path: /BankTransactions/{BankTransactionID}/Attachments/{FileName}
  method: post
  operationId: updateBankTransactionAttachmentByFileName
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.attachments
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /BankTransactions/{BankTransactionID}/Attachments/{FileName}
  method: put
  operationId: createBankTransactionAttachmentByFileName
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.attachments
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /BankTransactions/{BankTransactionID}/History
  method: get
  operationId: getBankTransactionsHistory
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.transactions
    - accounting.transactions.read
    token:
      max-ttl: 3600
    audit: none
- path: /BankTransactions/{BankTransactionID}/History
  method: put
  operationId: createBankTransactionHistoryRecord
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.transactions
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /BankTransfers
  method: get
  operationId: getBankTransfers
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.transactions
    - accounting.transactions.read
    token:
      max-ttl: 3600
    audit: none
- path: /BankTransfers
  method: put
  operationId: createBankTransfer
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    scope:
    - accounting.transactions
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /BankTransfers/{BankTransferID}
  method: get
  operationId: getBankTransfer
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.transactions
    - accounting.transactions.read
    token:
      max-ttl: 3600
    audit: none
- path: /BankTransfers/{BankTransferID}/Attachments
  method: get
  operationId: getBankTransferAttachments
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.attachments
    - accounting.attachments.read
    token:
      max-ttl: 3600
    audit: none
- path: /BankTransfers/{BankTransferID}/Attachments/{AttachmentID}
  method: get
  operationId: getBankTransferAttachmentById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.attachments
    - accounting.attachments.read
    token:
      max-ttl: 3600
    audit: none
- path: /BankTransfers/{BankTransferID}/Attachments/{FileName}
  method: get
  operationId: getBankTransferAttachmentByFileName
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.attachments
    - accounting.attachments.read
    token:
      max-ttl: 3600
    audit: none
- path: /BankTransfers/{BankTransferID}/Attachments/{FileName}
  method: post
  operationId: updateBankTransferAttachmentByFileName
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    scope:
    - accounting.attachments
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /BankTransfers/{BankTransferID}/Attachments/{FileName}
  method: put
  operationId: createBankTransferAttachmentByFileName
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    scope:
    - accounting.attachments
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /BankTransfers/{BankTransferID}/History
  method: get
  operationId: getBankTransferHistory
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.transactions
    - accounting.transactions.read
    token:
      max-ttl: 3600
    audit: none
- path: /BankTransfers/{BankTransferID}/History
  method: put
  operationId: createBankTransferHistoryRecord
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    scope:
    - accounting.transactions
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /BrandingThemes
  method: get
  operationId: getBrandingThemes
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.settings
    - accounting.settings.read
    token:
      max-ttl: 3600
    audit: none
- path: /BrandingThemes/{BrandingThemeID}
  method: get
  operationId: getBrandingTheme
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.settings
    - accounting.settings.read
    token:
      max-ttl: 3600
    audit: none
- path: /BrandingThemes/{BrandingThemeID}/PaymentServices
  method: get
  operationId: getBrandingThemePaymentServices
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - paymentservices
    token:
      max-ttl: 3600
    audit: none
- path: /BrandingThemes/{BrandingThemeID}/PaymentServices
  method: post
  operationId: createBrandingThemePaymentServices
  x-agentic-access:
    action-class: acting
    consequence: physical
    subject: required
    scope:
    - paymentservices
    audience: null
    token:
      max-ttl: 300
      exchange: true
      purpose-required: true
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /Budgets
  method: get
  operationId: getBudgets
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.budgets.read
    token:
      max-ttl: 3600
    audit: none
- path: /Budgets/{BudgetID}
  method: get
  operationId: getBudget
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.budgets.read
    token:
      max-ttl: 3600
    audit: none
- path: /Contacts
  method: get
  operationId: getContacts
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.contacts
    - accounting.contacts.read
    token:
      max-ttl: 3600
    audit: none
- path: /Contacts
  method: put
  operationId: createContacts
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.contacts
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /Contacts
  method: post
  operationId: updateOrCreateContacts
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.contacts
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /Contacts/{ContactNumber}
  method: get
  operationId: getContactByContactNumber
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.contacts
    - accounting.contacts.read
    token:
      max-ttl: 3600
    audit: none
- path: /Contacts/{ContactID}
  method: get
  operationId: getContact
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.contacts
    - accounting.contacts.read
    token:
      max-ttl: 3600
    audit: none
- path: /Contacts/{ContactID}
  method: post
  operationId: updateContact
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.contacts
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /Contacts/{ContactID}/Attachments
  method: get
  operationId: getContactAttachments
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.attachments
    - accounting.attachments.read
    token:
      max-ttl: 3600
    audit: none
- path: /Contacts/{ContactID}/Attachments/{AttachmentID}
  method: get
  operationId: getContactAttachmentById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.attachments
    - accounting.attachments.read
    token:
      max-ttl: 3600
    audit: none
- path: /Contacts/{ContactID}/Attachments/{FileName}
  method: get
  operationId: getContactAttachmentByFileName
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.attachments
    - accounting.attachments.read
    token:
      max-ttl: 3600
    audit: none
- path: /Contacts/{ContactID}/Attachments/{FileName}
  method: post
  operationId: updateContactAttachmentByFileName
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.attachments
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /Contacts/{ContactID}/Attachments/{FileName}
  method: put
  operationId: createContactAttachmentByFileName
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.attachments
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /Contacts/{ContactID}/CISSettings
  method: get
  operationId: getContactCISSettings
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.settings
    - accounting.settings.read
    token:
      max-ttl: 3600
    audit: none
- path: /Contacts/{ContactID}/History
  method: get
  operationId: getContactHistory
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.contacts
    - accounting.contacts.read
    token:
      max-ttl: 3600
    audit: none
- path: /Contacts/{ContactID}/History
  method: put
  operationId: createContactHistory
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.contacts
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /ContactGroups
  method: get
  operationId: getContactGroups
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.contacts
    - accounting.contacts.read
    token:
      max-ttl: 3600
    audit: none
- path: /ContactGroups
  method: put
  operationId: createContactGroup
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.contacts
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /ContactGroups/{ContactGroupID}
  method: get
  operationId: getContactGroup
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.contacts
    - accounting.contacts.read
    token:
      max-ttl: 3600
    audit: none
- path: /ContactGroups/{ContactGroupID}
  method: post
  operationId: updateContactGroup
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.contacts
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /ContactGroups/{ContactGroupID}/Contacts
  method: put
  operationId: createContactGroupContacts
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.contacts
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /ContactGroups/{ContactGroupID}/Contacts
  method: delete
  operationId: deleteContactGroupContacts
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.contacts
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /ContactGroups/{ContactGroupID}/Contacts/{ContactID}
  method: delete
  operationId: deleteContactGroupContact
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.contacts
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /CreditNotes
  method: get
  operationId: getCreditNotes
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.transactions
    - accounting.transactions.read
    token:
      max-ttl: 3600
    audit: none
- path: /CreditNotes
  method: put
  operationId: createCreditNotes
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.transactions
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /CreditNotes
  method: post
  operationId: updateOrCreateCreditNotes
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.transactions
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /CreditNotes/{CreditNoteID}
  method: get
  operationId: getCreditNote
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.transactions
    - accounting.transactions.read
    token:
      max-ttl: 3600
    audit: none
- path: /CreditNotes/{CreditNoteID}
  method: post
  operationId: updateCreditNote
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.transactions
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /CreditNotes/{CreditNoteID}/Attachments
  method: get
  operationId: getCreditNoteAttachments
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.attachments
    - accounting.attachments.read
    token:
      max-ttl: 3600
    audit: none
- path: /CreditNotes/{CreditNoteID}/Attachments/{AttachmentID}
  method: get
  operationId: getCreditNoteAttachmentById
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.attachments
    - accounting.attachments.read
    token:
      max-ttl: 3600
    audit: none
- path: /CreditNotes/{CreditNoteID}/Attachments/{FileName}
  method: get
  operationId: getCreditNoteAttachmentByFileName
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.attachments
    - accounting.attachments.read
    token:
      max-ttl: 3600
    audit: none
- path: /CreditNotes/{CreditNoteID}/Attachments/{FileName}
  method: post
  operationId: updateCreditNoteAttachmentByFileName
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.attachments
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /CreditNotes/{CreditNoteID}/Attachments/{FileName}
  method: put
  operationId: createCreditNoteAttachmentByFileName
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.attachments
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /CreditNotes/{CreditNoteID}/pdf
  method: get
  operationId: getCreditNoteAsPdf
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.transactions
    - accounting.transactions.read
    token:
      max-ttl: 3600
    audit: none
- path: /CreditNotes/{CreditNoteID}/Allocations
  method: put
  operationId: createCreditNoteAllocation
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.transactions
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /CreditNotes/{CreditNoteID}/Allocations/{AllocationID}
  method: delete
  operationId: deleteCreditNoteAllocations
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.transactions
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /CreditNotes/{CreditNoteID}/History
  method: get
  operationId: getCreditNoteHistory
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.transactions
    - accounting.transactions.read
    token:
      max-ttl: 3600
    audit: none
- path: /CreditNotes/{CreditNoteID}/History
  method: put
  operationId: createCreditNoteHistory
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.transactions
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /Currencies
  method: get
  operationId: getCurrencies
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.settings
    - accounting.settings.read
    token:
      max-ttl: 3600
    audit: none
- path: /Currencies
  method: put
  operationId: createCurrency
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.settings
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /Employees
  method: get
  operationId: getEmployees
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.settings
    - accounting.settings.read
    token:
      max-ttl: 3600
    audit: none
- path: /Employees
  method: put
  operationId: createEmployees
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.settings
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /Employees
  method: post
  operationId: updateOrCreateEmployees
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.settings
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /Employees/{EmployeeID}
  method: get
  operationId: getEmployee
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.settings
    - accounting.settings.read
    token:
      max-ttl: 3600
    audit: none
- path: /ExpenseClaims
  method: get
  operationId: getExpenseClaims
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.transactions
    - accounting.transactions.read
    token:
      max-ttl: 3600
    audit: none
- path: /ExpenseClaims
  method: put
  operationId: createExpenseClaims
  x-agentic-access:
    action-class: acting
    consequence: write
    subject: required
    scope:
    - accounting.transactions
    audience: null
    token:
      max-ttl: 900
    escalation:
      human-in-the-loop: conditional
      triggers:
      - abnormal
      - high-value
    audit: required
- path: /ExpenseClaims/{ExpenseClaimID}
  method: get
  operationId: getExpenseClaim
  x-agentic-access:
    action-class: connected
    consequence: read
    subject: optional
    scope:
    - accounting.transactions
    - accounting.transactions.read
    token:
      max-ttl: 3600
    audit: none
- path: /ExpenseClaims/{ExpenseClaimID}
  method: post
  operationId: updateExpenseClaim
  x-agentic-access:
    action-class: acting
    consequence: writ

# --- truncated at 32 KB (155 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/xero/refs/heads/main/agentic-access/xero-agentic-access.yml