Xero API Guide for Contractors

One-line verdict: A broad, well-documented accounting API — where the gate isn’t your plan, it’s your builder’s: Xero’s developer plans cap connections, and past 1,000 the app needs certification and a yearly security check. Openness: 4 / 5 — rated 4 because Xero documents REST APIs with OAuth, webhooks, and published rate limits, held back from 5 by that developer-side review-and-pricing ladder.

The connection that works

Rung 1 — Direct connection. Xero publishes a family of documented REST APIs — Accounting, Projects, Payroll, Files, Assets — with the Accounting API as the main road. Sign-in is OAuth 2.0 only; Xero’s own FAQ is blunt: “The Xero API does not support basic API Key authentication… you need to register your app to get a client id and client secret.” Calls are scoped to your organisation through the connections flow. (Dating note, because Xero keeps moving: broad Accounting scopes are being replaced by granular scopes, with existing apps migrating by September 13, 2027, and a new developer pricing model takes effect March 2, 2026 — the figures below are from Xero’s developer pricing page as of this writing.)

Verified: Invoices — read and write, with a vendor best-practice guide for creating them and documented operations like emailing an invoice through the API; Payments — read, plus PUT create/update documented in Xero’s changelog (no delete is claimed on this evidence); Contacts — read verified, with create/update verified in a documented narrow context (creating or updating contact bank-account details via the Contacts or document endpoints, behind a BankAccountAdmin permission) — the general contacts verb table sits on a reference page that wasn’t text-extractable in our pass, so it is flagged below rather than assumed.

Webhooks: documented, with live event families for Invoices, Contacts, Credit Notes, and Prepayments verified from Xero’s guide and changelog; the full catalog wasn’t extractable, so only those families are claimed here.

Rate limits, published: per-organisation daily caps set by the developer’s plan — 1,000 calls/day per org on the free Starter developer plan; 5,000/day per org on Core and above.

The developer-plan ladder (vendor pricing page): Starter is free and capped at 5 connections; Core allows 50; Plus allows 1,000 and requires App Certification; Advanced (10,000 connections) and Enterprise add an initial and annual Security Assessment, with Enterprise also requiring an App Store listing. Core and up carry developer-plan fees. None of this gates your Xero subscription — it’s the price of the builder’s door, and any shop-plan API gate stays UNVERIFIED.

Bridge apps: Zapier lists Xero as a premium app (bridge evidence — its help notes a paid Xero account, Standard or Adviser permissions, and that Zapier doesn’t directly support the Projects API endpoint); Make lists a Xero app too. Convenience routes — the API is the road.

Can automate

• Invoice Chase / AR — invoices are writable and webhook-backed, payments readable and recordable: the chase works from real balances in the books your bookkeeper already trusts.
• Invoice creation from the field side — a completed job in your field system can become a Xero invoice through the documented create path.
• Contact-aware billing — contacts are readable at volume (100 at a time), so invoicing tools bill the right entity.
• Event-driven bookkeeping — invoice and payment-family webhooks keep the office systems in step without nightly exports.

Can’t automate

• Quotes and Projects verbs — UNVERIFIED. Xero publishes a Quotes object in the Accounting API and a whole Projects API (projects, tasks, users) — the reference pages exist; their endpoint verbs weren’t text-extractable in our pass, so read/write specifics stay flagged.
• General contact create/update — UNVERIFIED beyond the documented bank-account-details context.
• Payment deletion — not documented on this evidence; don’t let a quote promise it.
• A deals/CRM object — Xero has none in the sources checked. Pipelines live in your CRM; Xero keeps the books.
• Unlimited scale on a free developer plan — 5 connections and 1,000 calls/day/org is a pilot, not a platform. Past 1,000 connections, certification and annual security assessment are the toll.

Hidden gate: Your builder pays for this door at scale: past 50 connections the developer plan costs money, and past 1,000 Xero can make the app pass certification and a yearly security check before it grows. Ask who holds the developer plan — and which tier — before you build on it.

Build fit — what this platform supports well

• Invoice Chase / AR — the strongest fit: invoices and payments are the API’s home turf.
• Job-to-invoice handoff — documented invoice creation makes the field-to-books handoff a build, not a chore.
• Estimate Follow-Up — UNVERIFIED at the verb level: a Quotes object exists; its operations weren’t confirmable in our pass. Follow-up usually keys off the field system’s quote instead.
• Review Engine — like every platform here, Xero has no verified reviews API, so the review ask runs on our system triggered by a job-completion signal from your field tool.

What this means for your shop

If your books live in Xero — very common for shops with an outside bookkeeper — the money side of your automation is on solid, documented ground. The diligence is one question most owners never think to ask: whose developer plan is this app on, and what tier? The answer decides your connection cap, your daily call allowance, and whether certification stands between you and scale.