--- title: "AI-built integrations: what broke in QuickBooks and Xero" description: "AI-built integrations meet every API change after launch. What QuickBooks Online and Xero changed in 2025-26, and what it takes to keep a connector working." author: "Saurabh Rai" published: "2026-10-16" updated: "2026-10-16T12:14:56.881Z" url: "https://www.apideck.com/blog/ai-built-accounting-integrations-maintenance" category: "Accounting" tags: ["Accounting", "Guides & Tutorials"] --- # AI-built integrations: what broke in QuickBooks and Xero Between August 2025 and October 2026, Intuit and Xero shipped more than a dozen changes that alter how an existing integration behaves. Some fail loudly with a 400 or a 401. Others fail silently: since 1 August 2025, QuickBooks Online [ignores any minor version below 75](https://medium.com/intuitdev/changes-to-our-accounting-api-that-may-impact-your-application-c330bd1a06f5) and answers in version 75 without an error. AI-built integrations, written once in a coding assistant and shipped, meet all of these changes the same way a hand-written one would, except that nobody on the team may remember how the code works. More of them are being written. In its [June 2026 developer update](https://devblog.xero.com/webinar-recap-june-2026-developer-update-a89f96798914), Xero said new app registrations were up fourfold since January, in a section about vibe coding. Our [vibe coding guide](https://www.apideck.com/blog/how-to-vibecode-api-integrations) covers how to build the first version. This post covers the year after: the dated changes, and the public reports from developers who ran into them. ![Timeline of QuickBooks Online and Xero API changes from August 2025 to September 2027 that affect an integration written once](https://images.ctfassets.net/d6o5ai4eeewt/4pUFrcMJXmpqtgFiTrGPlB/08659d69e91d043e302b4dc0f0442962/platform-changes.png) ## QuickBooks Online: four changes that needed code The minor version floor is the quiet one. Intuit announced in January 2025 that from 1 August 2025 "previous minor versions will be ignored", and it added that new fields would no longer trigger a minor version update. Twelve days after the cutover, a developer reported a parse failure in [Intuit's own PHP SDK](https://github.com/intuit/QuickBooks-V3-PHP-SDK/issues/556). Code that parses responses strictly gets version 75 data without any warning. Webhooks changed format. In November 2025 Intuit [announced](https://medium.com/intuitdev/upcoming-change-to-webhooks-payload-structure-2a87dab642d0) a mandatory move from its `eventNotifications` payload to CloudEvents, first due by 15 May 2026 and then extended to 31 July 2026. One notification can now carry events for several companies. An app that never migrated "will no longer be able to process webhooks notifications from Intuit", in Intuit's words. The new format had problems of its own: in May 2026 Intuit staff described intermittent delivery of CloudEvents webhooks as "a known active issue" in a [developer community thread](https://help.developer.intuit.com/s/question/0D5TR00001IwVwy0AF). Refresh tokens got a ceiling. Until late 2025 a QuickBooks refresh token stayed valid as long as it was used every 100 days. Intuit's [refresh token policy change](https://blogs.intuit.com/2025/11/12/important-changes-to-refresh-token-policy) caps every token at five years. The first hard expiries arrive in February 2027 for apps on granular or restricted scopes, and in October 2028 for apps on the accounting or payments scopes. A Reconnect URL becomes a mandatory app setting, so an integration needs a path for customers to re-authorise before their token runs out. Reads now cost money. The [Intuit App Partner Program](https://www.apideck.com/blog/quickbooks-api-pricing-and-the-intuit-app-partner-program) meters "data-out" calls, including reads and reports, and has charged for them since November 2025. On the free Builder tier, read calls above 500,000 a month are blocked until the next month. Paid tiers charge for overage instead. Developers have hit the cap: a July 2026 change to an [open-source data connector](https://github.com/estuary/connectors/pull/4780) describes access token refreshes returning 429 until the month rolled over once the budget was spent. Smaller changes landed in between. From 31 October 2025, ID queries with operators other than `=` and `IN` are "ignored and all values will be returned", which turns a filtered read into a full read without an error. Country codes in the company address fields switched to three-letter ISO values on the same date. The Reports API moved to a new service by 31 August 2026, where Intuit tells developers not to rely on row positions and always returns missing values as empty strings. The day after that cutover, a developer reported [missing account IDs](https://help.developer.intuit.com/s/question/0D5TR00001VcUpj0AF) in report rows, and three days later Intuit staff confirmed it as a "Known defect". ## Xero: the March 2026 changes Xero's biggest changes took effect on one date. On 2 March 2026 Xero replaced its revenue-share model with [developer pricing tiers](https://developer.xero.com/pricing). The free Starter tier allows five connections and 1,000 API calls per day per organisation. Adding a sixth connection needs payment details, larger plans need App Certification, and the Journals endpoint is only available on the Advanced tier and above. The same day, Xero stopped accepting broad scopes such as `accounting.transactions` for new apps, and Custom Connections followed on 29 April. Apps created earlier have until September 2027 to switch, per the [Xero changelog](https://developer.xero.com/changelog). Granular scopes are not applied to existing tokens automatically. They need the customer's consent again, so the migration is a reconnect for every customer, and a call made without the right granular scope returns a 401 with `insufficient_scope` in the header. Apps that still ask for a broad scope fail earlier, at sign-in. Ten days after the change, an open-source time tracker [logged](https://github.com/DRYTRIX/TimeTracker/issues/567) Xero rejecting `accounting.transactions` for a new app with "Invalid scope for client", and in May Xero's own [MCP server](https://github.com/XeroAPI/xero-mcp-server/issues/175) failed the same way for new Custom Connections. One clause matters for anyone building with AI. Xero's [developer platform terms](https://developer.xero.com/xero-developer-platform-terms-conditions) now say "You must not use API Data sourced from the Xero developer platform to train or fine tune any artificial intelligence models". A product that feeds ledger data into a model needs to check that its use stays on the right side of that sentence. New enum values break code that expects a fixed list. On 30 June 2026 the changelog added a new organisation class and warned that "Integrations that assume only existing values may fail to maintain their connection to Xero." Developers using Xero's official .NET SDK had already [reported that value crashing](https://github.com/XeroAPI/Xero-NetStandard/issues/647) on 21 April, and an unlisted [business type value](https://github.com/XeroAPI/Xero-NetStandard/issues/642) had done the same in March. Other changelog entries turned previously accepted requests into 400 errors. ## Auth errors that look like revocations The hardest failures to handle are the ones that look like a customer disconnecting. On 1 September 2026 Intuit's [status page](https://status.developer.intuit.com/incidents/ppq8m14fqzq5) logged OAuth connection failures and timeouts from 13:00 to 20:45 Pacific time, and noted the problem appeared to be on Intuit's side. Intuit's own help article on [invalid_grant](https://help.developer.intuit.com/s/article/400-invalid-grant) says the error can be returned during a service outage, which means the code an integration sees during an incident can be identical to the one it sees when a customer revokes access. Refresh tokens make this worse. QuickBooks rotates the refresh token, so if Intuit issues a new one and the response never arrives, the stored token no longer works and the connection can't recover without the customer, as a developer explained in an [issue on Intuit's .NET SDK](https://github.com/intuit/QuickBooks-V3-DotNET-SDK/issues/342). In a [community thread](https://help.developer.intuit.com/s/question/0D5TR00001Rqqnj0AB) opened in July 2026, another developer reported refreshed access tokens being intermittently rejected with a 401. From 3 August every call for that company failed, even after a full reconnect, and it stayed that way for 18 days until access came back on 21 August, after what the developer concluded was a change on Intuit's side. An integration that disconnects customers on the first 401 turns each of these incidents into a reconnect request to every affected customer. ![Timeline of public developer reports on QuickBooks Online and Xero changes from August 2025 to September 2026, ending with the 1 September OAuth outage and a Reports API defect](https://images.ctfassets.net/d6o5ai4eeewt/3Gxp1gZ9vtSPJgPW6HwBHn/a48d74c062df489eb61d292d1b6f2540/public-reports.png) ## Keeping AI-built integrations working For one or two connectors, building direct can be the right decision, and a coding assistant makes the first version cheap. It stays right if someone owns the connector after launch. In practice that owner subscribes to the [Intuit developer blog](https://medium.com/intuitdev) and the Xero changelog, keeps a budget for CorePlus reads and Xero's tiers, stores token expiry and refresh state per connection, and treats auth errors as possibly transient before disconnecting anyone. Our [build vs buy guide](https://www.apideck.com/blog/build-vs-buy-accounting-integrations) puts numbers on that ongoing cost. The case for a unified API grows with the number of ledgers, because the change history above multiplies with each one. NetSuite adds its own: [new integrations can't use token-based authentication](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_158921905537.html) from release 2027.1, and existing ones lose support around release 2028.2. The same release is when [SOAP integrations stop working](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/article_2104046421.html). If your roadmap has more than two accounting systems on it, run the comparison before the third one. Apideck's [Accounting API](https://www.apideck.com/accounting-api) handles token refresh and platform changes per connector, and the 30-day free trial is enough time to put your own QuickBooks and Xero test companies through it.