AI-built integrations: what broke in QuickBooks and Xero

Between August 2025 and October 2026, Intuit and Xero shipped more than a dozen changes that alter how an existing integration behaves. Some fail loudly with a 400 or a 401. Others fail silently: since 1 August 2025, QuickBooks Online ignores any minor version below 75 and answers in version 75 without an error. AI-built integrations, written once in a coding assistant and shipped, meet all of these changes the same way a hand-written one would, except that nobody on the team may remember how the code works.

More of them are being written. In its June 2026 developer update, Xero said new app registrations were up fourfold since January, in a section about vibe coding. Our vibe coding guide covers how to build the first version. This post covers the year after: the dated changes, and the public reports from developers who ran into them.

QuickBooks Online: four changes that needed code

The minor version floor is the quiet one. Intuit announced in January 2025 that from 1 August 2025 "previous minor versions will be ignored", and it added that new fields would no longer trigger a minor version update. Twelve days after the cutover, a developer reported a parse failure in Intuit's own PHP SDK. Code that parses responses strictly gets version 75 data without any warning.

Webhooks changed format. In November 2025 Intuit announced a mandatory move from its eventNotifications payload to CloudEvents, first due by 15 May 2026 and then extended to 31 July 2026. One notification can now carry events for several companies. An app that never migrated "will no longer be able to process webhooks notifications from Intuit", in Intuit's words. The new format had problems of its own: in May 2026 Intuit staff described intermittent delivery of CloudEvents webhooks as "a known active issue" in a developer community thread.

Refresh tokens got a ceiling. Until late 2025 a QuickBooks refresh token stayed valid as long as it was used every 100 days. Intuit's refresh token policy change caps every token at five years. The first hard expiries arrive in February 2027 for apps on granular or restricted scopes, and in October 2028 for apps on the accounting or payments scopes. A Reconnect URL becomes a mandatory app setting, so an integration needs a path for customers to re-authorise before their token runs out.

Reads now cost money. The Intuit App Partner Program meters "data-out" calls, including reads and reports, and has charged for them since November 2025. On the free Builder tier, read calls above 500,000 a month are blocked until the next month. Paid tiers charge for overage instead. Developers have hit the cap: a July 2026 change to an open-source data connector describes access token refreshes returning 429 until the month rolled over once the budget was spent.

Smaller changes landed in between. From 31 October 2025, ID queries with operators other than = and IN are "ignored and all values will be returned", which turns a filtered read into a full read without an error. Country codes in the company address fields switched to three-letter ISO values on the same date. The Reports API moved to a new service by 31 August 2026, where Intuit tells developers not to rely on row positions and always returns missing values as empty strings. The day after that cutover, a developer reported missing account IDs in report rows, and three days later Intuit staff confirmed it as a "Known defect".

Xero: the March 2026 changes

Xero's biggest changes took effect on one date. On 2 March 2026 Xero replaced its revenue-share model with developer pricing tiers. The free Starter tier allows five connections and 1,000 API calls per day per organisation. Adding a sixth connection needs payment details, larger plans need App Certification, and the Journals endpoint is only available on the Advanced tier and above.

The same day, Xero stopped accepting broad scopes such as accounting.transactions for new apps, and Custom Connections followed on 29 April. Apps created earlier have until September 2027 to switch, per the Xero changelog. Granular scopes are not applied to existing tokens automatically. They need the customer's consent again, so the migration is a reconnect for every customer, and a call made without the right granular scope returns a 401 with insufficient_scope in the header. Apps that still ask for a broad scope fail earlier, at sign-in. Ten days after the change, an open-source time tracker logged Xero rejecting accounting.transactions for a new app with "Invalid scope for client", and in May Xero's own MCP server failed the same way for new Custom Connections.

One clause matters for anyone building with AI. Xero's developer platform terms now say "You must not use API Data sourced from the Xero developer platform to train or fine tune any artificial intelligence models". A product that feeds ledger data into a model needs to check that its use stays on the right side of that sentence.

New enum values break code that expects a fixed list. On 30 June 2026 the changelog added a new organisation class and warned that "Integrations that assume only existing values may fail to maintain their connection to Xero." Developers using Xero's official .NET SDK had already reported that value crashing on 21 April, and an unlisted business type value had done the same in March. Other changelog entries turned previously accepted requests into 400 errors.

Auth errors that look like revocations

The hardest failures to handle are the ones that look like a customer disconnecting. On 1 September 2026 Intuit's status page logged OAuth connection failures and timeouts from 13:00 to 20:45 Pacific time, and noted the problem appeared to be on Intuit's side. Intuit's own help article on invalid_grant says the error can be returned during a service outage, which means the code an integration sees during an incident can be identical to the one it sees when a customer revokes access.

Refresh tokens make this worse. QuickBooks rotates the refresh token, so if Intuit issues a new one and the response never arrives, the stored token no longer works and the connection can't recover without the customer, as a developer explained in an issue on Intuit's .NET SDK. In a community thread opened in July 2026, another developer reported refreshed access tokens being intermittently rejected with a 401. From 3 August every call for that company failed, even after a full reconnect, and it stayed that way for 18 days until access came back on 21 August, after what the developer concluded was a change on Intuit's side. An integration that disconnects customers on the first 401 turns each of these incidents into a reconnect request to every affected customer.

Keeping AI-built integrations working

For one or two connectors, building direct can be the right decision, and a coding assistant makes the first version cheap. It stays right if someone owns the connector after launch. In practice that owner subscribes to the Intuit developer blog and the Xero changelog, keeps a budget for CorePlus reads and Xero's tiers, stores token expiry and refresh state per connection, and treats auth errors as possibly transient before disconnecting anyone. Our build vs buy guide puts numbers on that ongoing cost.

The case for a unified API grows with the number of ledgers, because the change history above multiplies with each one. NetSuite adds its own: new integrations can't use token-based authentication from release 2027.1, and existing ones lose support around release 2028.2. The same release is when SOAP integrations stop working.

If your roadmap has more than two accounting systems on it, run the comparison before the third one. Apideck's Accounting API handles token refresh and platform changes per connector, and the 30-day free trial is enough time to put your own QuickBooks and Xero test companies through it.