Broad accounting.transactions scope replaced by granular scopes
- Provider
- Xero
- Endpoint
* /api.xro/2.0/**- Effective
- 2027-09-13
- Severity
- medium
- Change
- scope-change
- Status
- verified
What changed
Xero split accounting.transactions into granular scopes (invoices, payments, bank transactions, manual journals, classic expenses, each with a .read variant). Apps created after 2026-03-02 must request granular scopes; existing apps keep the broad scopes until September 2027, and each connected user must re-authorize to receive the new ones.
What to do
Request the granular scopes in the authorization URL and have each connection re-authorize before the cutoff.
Sources
Check your code
bash
npx shapi-cli scan .shapi scan lists the call sites this change affects; shapi fix repairs them test-first when the advisory has an automatic fix. All advisories · Markdown · OSV · JSON