.svg)
An AP automation API covers the requests other software can make of an accounts payable system: pulling bill data, writing records back and triggering steps that would otherwise take a click. More and more, that software is an AI agent. Gartner predicts that 40% of enterprise applications will be integrated with task-specific AI agents before 2026 is out, compared with under 5% in 2025.
Whether a vendor has an API is now the first question. The next ones are what it lets an agent touch, what it leaves for people to decide, and whether every change leaves a record. MakersHub is set up around how your business already works, and our team configures it with you.
Here is the short version of where an agent fits and where it doesn't:
| Action in AP | Fine for an agent? | Why |
|---|---|---|
| Read bills, lines and status | Yes | Read-only access can't move money, and it's most of what reporting and reconciliation need |
| Suggest or update line coding | Yes, with limits | Useful at volume, as long as each change is logged and a person can see and reverse it |
| Create purchase orders from your ERP | Yes, with limits | A system-to-system feed, scoped to the entities and vendors it should touch |
| Add a vendor or change bank details | No | Changed bank details are one of the oldest routes to paying a fraudster |
| Approve a bill | No | Approval is a person confirming the charge is right, and it should stay one |
| Release a payment | Never | No connection should be able to send money on its own |
Lately Charley Howe, our co-founder and President, keeps getting a new kind of request from customers:
Twice in the last week, a customer who has never written a line of code asked us for an API token.
One was from a finance manager at a pool construction company in the Pacific Northwest. A few days earlier, the owner of a residential builder sent a nearly identical note. Both emails were written by an AI agent and wanted the same thing: a scheduled script that could read bills out of our system, update the line-item coding, and push approvals through without anyone logging in.
As far as I know, neither company employs a developer.
Two years ago the fear in our corner of software was that this is how it ends: a company sits down with a coding model, builds its own AP tool over a weekend, and cancels the subscription. I have now watched a year of this from inside the business, and that is not what people are building. They are building the lines between the AP tool and everything else. A guitar-pedal maker used a coding agent to fix the ERP install he’d paid a consultant eight thousand dollars to botch. A veterinary distributor wants its ERP to push purchase orders into us by API instead of through QuickBooks. A fractional CFO who has never touched an API asked, before anything about features, whether we had an endpoint.
The existential fear got the layer wrong. Writing the code was never the expensive part of AP software. The expensive part is being the system of record. The moat has always sat, and will always sit, with whoever holds that record most cleanly and exposes it through the most frictionless door. Opening the door properly is a real lift, but we are doing it anyway because the risk to companies like ours is not being killed by an AI-coded replacement. It is being beaten by a competitor that is easier for an AI to work with than we are.
His post is about where the lasting value in AP software sits. This article is for the finance team sending that kind of email: what an agent needs from your AP system, what it should never be handed, and what to ask a vendor before you connect one.
What is an AP automation API?
An API, or application programming interface, is a set of defined requests one program can make of another. In accounts payable, those requests look like "list every bill from this vendor this month," "attach this receipt to bill 4417" or "mark this bill as exported." A few related terms come up in every conversation about connecting software:
- Endpoint: one specific request the API accepts, such as listing bills or updating a line.
- Access token: a long string that works like a key. Whoever holds it can make the requests it allows, so it's handled like a password.
- Scope: the limits on a token. A read-only scope can list bills but not change them.
- Webhook: a message the AP system sends out when something happens, such as a bill being approved, so the other system doesn't have to keep asking.
- MCP: the Model Context Protocol, an open standard for connecting AI applications such as Claude or ChatGPT to outside tools and data.
The Model Context Protocol documentation describes it as "a USB-C port for AI applications," a standard plug instead of a custom cable for every pairing. For a finance team, that means an agent can now connect to an outside system in a fraction of the time a custom integration used to take.
An API is different from an accounting system integration. An integration, such as a two-way sync with QuickBooks, is a finished connection the vendor builds and maintains. An API is the raw access you or your tools build on. Our explainer on two-way QuickBooks sync covers what a finished integration should do.
Why are finance teams asking for API access now?
Because the person asking no longer has to be a developer. An AI agent can draft the request, read the documentation and write the script, so a finance manager can ask for something only an IT team would have asked for a few years ago.
The requests in the post above fall into a few patterns. Each needs something different from the AP system:
| Pattern in the request | What the AP system has to offer | Reads or writes |
|---|---|---|
| A scheduled script that reads bills, updates coding and moves approvals | Bill and line data, a way to change coding, and a clear line on what approval means | Both |
| An ERP pushing purchase orders in directly | A way to create POs from outside, with matching against later bills | Writes |
| A CFO checking for an endpoint before features | Documented access to start from, even if the first use is read-only | Reads first |
The tool is new. The work isn't. Finance teams have always moved data between AP and the systems around it: job costing, purchasing, inventory, the bank. What changed is who can build the connection and how fast.
Why is a clean record worth more than the code around it?
An AI agent can write a script in an afternoon. It can't create the history the script reads from. The system of record, the place your official numbers live, holds years of coded bills, approvals, vendor details and the decisions behind them. That record is what an auditor checks and what a controller closes the month from.
This is why the record matters more than the scripts around it. An agent working from a clean record, with every line coded to the right job, location, program or entity, can do useful work. An agent working from a messy one automates the mess, faster.
It's also why a connection is only as safe as the record behind it. If an agent can change coding, the record has to show which change came from the agent, when, and what it replaced. If it can't show that, the books are now partly written by something nobody can question.
“As agentic AI matures, standardized protocols and frameworks will enable seamless interoperability, allowing agents to sense their environments, orchestrate projects and support a wide range of business scenarios.”
Anushree Verma, Sr Director Analyst, GartnerStandard protocols make connecting easier. They don't decide what a connection should be allowed to do. That decision stays with the finance team, and the AP system has to make it enforceable.
What should an AI agent be allowed to do in your AP system?
Start from nothing and add permissions one at a time. The OWASP Foundation, which publishes widely used security guidance for software, puts it this way in its API Security Top 10: "The enforcement mechanism(s) should deny all access by default, requiring explicit grants to specific roles." For AP, that translates into a short list of rules:
- Read before write. Start every new connection with read-only access and widen it only once what it reads has proven useful and correct.
- Coding, not approval. An agent can suggest or set coding. Approving a bill stays with the person who owns the cost.
- No payment release. Releasing money should require a person, every time, no matter what the token allows elsewhere.
- No vendor bank changes. Adding vendors or changing where their money goes stays behind a person and a verification step.
- One token per job. A separate token for each script, so you can switch one off without breaking the rest.
- Every change attributed. The audit trail shows which connection made each change, not just that a change happened.
Some of these requests want approvals to happen without a login. That part doesn't require handing approval to a script. Approvers use MakersHub without training. They approve from email in one click, and see only the bills that are theirs. The person still decides; they just don't need a login to do it.
Vendor bills also can't be taken at face value. A bill is a document someone outside your company wrote, and an agent that reads it can be steered by text hidden in it, a risk called prompt injection. Our guide to AI agents in accounts payable covers that risk in detail. The practical defense is the list above: whatever a bill says, the agent's permissions don't include approving it or paying it.
What should you ask an AP vendor about API access?
Eight questions cover most of what you need to know. Ask them before you connect anything, and get the answers in writing:
| Question | A good answer sounds like |
|---|---|
| Can a token be limited to reading only? | Yes, and read-only is the default for new tokens |
| Can a token be limited to one entity or location? | Yes, scopes follow the same structure as your coding |
| Can a connection approve bills or release payments? | No, both stay with people |
| Does the audit trail show which connection made a change? | Yes, each token or integration is named in the history |
| How do I switch off one connection? | From settings, immediately, without touching the others |
| Is there a test environment? | Yes, so scripts can be tried on sample data first |
| What happens when two systems change the same bill? | A clear rule, documented, with the conflict flagged rather than silently overwritten |
| Who helps when a script breaks something? | A named team that knows your setup, not a ticket queue |
The last question matters more than it looks. A finance manager who had an agent write the script may not be able to debug it. Either way, the vendor's team ends up involved, so find out before you start whether they'll actually help.
Also ask what the vendor builds and maintains itself. A connection that runs through a third-party connector adds another company's changes and outages to your close. An integration the AP vendor owns end to end has one team to call.
How does MakersHub connect to other systems today?
MakersHub is AP automation for organizations that track spend by project, location, program or entity. MakersHub reads every part of every bill, codes each cost to the right place and puts it in front of the right people before it's paid. We build the connections around it the same way, starting from the record.
We build and maintain our accounting integrations ourselves, without a third-party connector in between: QuickBooks Online, QuickBooks Desktop through the Web Connector, NetSuite, Sage Intacct, Xero and Intuit Enterprise Suite. The MakersHub integration hub has the details for each. For any other system, Smart Data Connect imports bills, purchase orders and receipts from files in your own format and exports to whatever your system accepts. That's how a petrochemical company runs about 800 bills a month into a legacy internal ERP with no cloud connector.
Direct API access is available today for select use cases after a discovery conversation with our team. As Charley's post says, we're opening that door further. Which of the answers in the table above apply to a given use case is something we work through with you in that conversation.
We build the controls into the record itself. A bill's approval and its payment authorization are two different steps, held apart by design. Vendors never need a MakersHub login. MakersHub is SOC 2 Type II certified, with Positive Pay protection on check payments and encrypted collection of vendor bank details. There are no limits on users, entities or bill count, and no per-user pricing, so adding an approver in the field doesn't add a seat fee.
When is a direct connection the wrong tool?
When the job happens once. Cleaning up a vendor list, reconciling a messy quarter or reformatting an export are good work for an agent and a spreadsheet, with a person checking the result. A permanent connection adds a token to manage, a script to maintain and a new path into your books.
It's also the wrong tool when the record isn't ready. If your coding rules are still changing, an agent will apply the inconsistency at speed. Settle them first. You set your coding rules once, and MakersHub applies them everywhere. Our post on deterministic coding rules versus AI drift explains why the same bill should get the same answer every time.
Charley wrote earlier about why CFOs keep AI at the edges of finance, and the same instinct applies here. Let agents read widely, let them suggest and code inside clear limits, and keep a person where the money moves.
Frequently asked questions
What is an AP automation API?
An AP automation API is the interface that lets other software, including AI agents, read bills, update coding and create records in an accounts payable system without someone working in the app. Access is controlled with tokens and scopes. MakersHub offers direct API access for select use cases after a discovery conversation, alongside its in-house accounting integrations.
Can an AI agent approve bills?
Sometimes it's technically possible, but approval should stay with a person, because approval is someone confirming the charge is right. An agent can read, code and route bills, and people approve them. MakersHub routes each bill to whoever owns that job or budget and lets them approve from email in one click, so approvals stay fast without a login.
How should an AI agent's access to accounts payable be limited?
Start every connection read-only, give each token narrow scopes, make sure the audit trail names the connection behind every change, and keep approving and paying out of any token's reach. A bill can contain hidden text that tries to steer an agent, so what the agent is allowed to do matters more than what it's told. MakersHub keeps approval and payment as separate steps and is SOC 2 Type II certified.
What is MCP in accounts payable?
MCP, the Model Context Protocol, is an open standard for connecting AI applications such as Claude or ChatGPT to outside tools and data. In accounts payable, it's one way an agent could reach an AP system's data and actions. Whatever the connection method, the controls belong in the AP system, and MakersHub keeps approving a bill and authorizing its payment as two separate steps.
Does an API replace an accounting system integration?
No. An integration is a finished connection the vendor builds and maintains, while an API is raw access you build on. Most teams need the integration for daily sync and the API for specific extra jobs. MakersHub builds its QuickBooks Online, QuickBooks Desktop, NetSuite, Sage Intacct, Xero and Intuit Enterprise Suite integrations in-house.
Does MakersHub have an API?
Yes, for select use cases after a discovery conversation with our team, and we're expanding it. MakersHub also connects to any other system through Smart Data Connect, which imports and exports files in your own format. We build and run its accounting integrations ourselves.
The question used to be which AP tool to buy. More and more, it's which AP tool your other software can work with safely. We built MakersHub so its record is clean enough for other software to rely on, and so approving a bill and authorizing its payment stay separate steps, whatever is connected. If your team is already asking an agent to do AP work, we'd like to hear what it's trying to do. Get started with MakersHub.
Sources: Gartner press release, August 26, 2025 (updated September 5, 2025); OWASP API Security Top 10, 2023 edition, API5: Broken Function Level Authorization; Model Context Protocol documentation, What is the Model Context Protocol.
Table of Contents
About MakersHub
MakersHub is AI-first accounts payable automation for businesses that track spend by job, project, program or entity. It captures every line of every bill, codes it, routes approvals and pays vendors, with native two-way integrations to QuickBooks Desktop, QuickBooks Online, NetSuite, Sage Intacct, Xero and Intuit Enterprise Suite. MakersHub is rated 4.9 out of 5 on G2 (October 2026). Every dollar has a job. Hold yours accountable.