Xero Proxy

Developer documentation

Point your existing Xero integration at us

The proxy is a one-to-one passthrough. Change the base URL and the credential; leave every path, query string, header and body exactly as they are. 573 endpoints are mapped across 10 API families, each with the scope the proxy will actually check.

Ask the documentation

Searches every page and returns the passages that answer the question, with the section each came from.

Documentation

Overview

What the proxy does, what it deliberately does not do, and how a request travels through it.

Getting started

Swap the base URL and the credential. Nothing else in your integration moves.

Authentication and keys

Key format, the Xero-Tenant-Id rule, rotation with a grace window, and instant revocation.

Scopes

Xero's own scope strings, used unchanged, and how a key's grant is narrowed by the connection.

Route reference

Every mapped endpoint and the scope it requires, generated from the enforcement table.

Errors

How to tell our refusal from Xero's, and what every proxy error code means.

Rate limits and quota

What Xero limits, what we forward untouched, and how an account divides one shared budget between several applications.

MCP servers

Two Model Context Protocol endpoints: a management control plane, and a public documentation server.

Machine-readable docs

OpenAPI, markdown variants and llms.txt, for tooling and for language models.

Alerting

The built-in rules, how they are evaluated, and where notifications go.

Read caching

How repeat reads are served without spending Xero quota, what invalidates them, and how to opt out per request.

Diagnosing a request

Every response carries an id. What it is for, and how to get from a failure to the reason for it.

Idempotent writes

How to retry a write that timed out without creating it twice, and what the proxy does with an Idempotency-Key.

Deferred execution

Ask to be queued instead of refused: how a 429 becomes a 202 with a handle, and how to collect the answer.

Completion callbacks

Be told when deferred work finishes, instead of polling for it: registering an endpoint, verifying the signature, and what a callback deliberately does not contain.

Event webhooks

Xero events fanned out to as many of your own endpoints as you like, signed, retried and deduplicated.

Built for tooling as well as people

Every page has a markdown variant at the same path plus .md, and the whole set is available in the formats an agent would rather read. The route and scope tables in all of them are generated from the same table the enforcement middleware checks, so none of it can drift: 56 scopes, 573 endpoints, one source.