# Allocations between documents of different contacts are rejected

- **Provider:** Xero
- **Endpoint:** `PUT /api.xro/2.0/*/{id}/Allocations`
- **Effective:** 2026-10-08
- **Severity:** medium
- **Change:** status-code
- **Status:** verified

## What changed

Xero is beginning to require (notice of 2026-10-08) a credit note, prepayment or overpayment to belong to the same contact as the invoice or bill it is allocated to. Allocation requests that create a new contact mismatch return a validation error (HTTP 400). The notice is dated 2026-10-08 and gives no separate enforcement date.

## What to do

Before calling PUT /CreditNotes/{CreditNoteID}/Allocations, /Prepayments/{PrepaymentID}/Allocations or /Overpayments/{OverpaymentID}/Allocations, check that Contact.ContactID is the same on the source document and on the target invoice or bill. On a validation error, show the user the mismatch instead of retrying, because the unchanged request keeps failing.

## Sources

- Provider notice (2026-10-08): https://developer.xero.com/changelog
- https://raw.githubusercontent.com/XeroAPI/Xero-OpenAPI/master/xero_accounting.yaml

## Machine-readable

- Advisory: https://github.com/SriVarshini09/shapi-advisories/blob/main/advisories/xero-allocations-contact-mismatch-rejected.json
- OSV: https://shapi.dev/osv/xero-allocations-contact-mismatch-rejected.json