# Broad accounting.transactions scope replaced by granular scopes

- **Provider:** Xero
- **Endpoint:** `* /api.xro/2.0/**`
- **Effective:** 2027-09-13
- **Severity:** medium
- **Change:** scope-change
- **Status:** verified

## What changed

Xero split accounting.transactions into granular scopes (invoices, payments, bank transactions, manual journals, classic expenses, each with a .read variant). Apps created after 2026-03-02 must request granular scopes; existing apps keep the broad scopes until September 2027, and each connected user must re-authorize to receive the new ones.

## What to do

Request the granular scopes in the authorization URL and have each connection re-authorize before the cutoff.

## Sources

- Provider notice: https://devblog.xero.com/upcoming-changes-to-xero-accounting-api-scopes-705c5a9621a0
- https://www.apideck.com/blog/xero-scopes

## Machine-readable

- Advisory: https://github.com/SriVarshini09/shapi-advisories/blob/main/advisories/xero-accounting-transactions-scope-split.json
- OSV: https://shapi.dev/osv/xero-accounting-transactions-scope-split.json