Is XPM API access the same as Xero Accounting API access?

No. While both use the same OAuth 2.0 model, XPM APIs require a separate approval process, including a security assessment and formal scope request. Xero Accounting API scopes are available immediately after app creation.

How long does the XPM approval process take?

There is no fixed timeline. Responses can take days to weeks. It is recommended to apply on Day 1 of your project and build mock-driven architecture while waiting.

Can I bypass the security assessment for a proof of concept?

No. Xero requires a security assessment even for internal tools and proof-of-concept projects. There are no exemptions to this requirement.

What pricing tier is required for XPM API access?

XPM API access is limited to apps on the Advanced tier or higher. Check Xero's developer FAQ for current pricing and policy details.

Xero Practice Manager API Integration: Access, Scopes & Approval Guide

April 23, 2026 7 min read

API access workflow with security review, approval process, and pricing tier setup for secure integration and data access

Xero Practice Manager (XPM) API Integration Guide

Integration with Xero Practice Manager (XPM) is not a typical API implementation.

While it uses the same OAuth model as Xero Accounting APIs, scope access is restricted and controlled through an approval-driven process.

This creates a gap between what developers expect and what actually happens.

This guide documents the actual process, key constraints, and the impact on development, with a focus on the real blocker: access and communication.

What Developers Usually Expect from Xero Practice Manager API

Expected XPM API integration flow showing create Xero app, implement OAuth 2.0, add scopes, and start building process

Most developers start with this mindset:

Create a Xero app
Implement OAuth 2.0
Add required scopes: practicemanager.client, practicemanager.contact
Start building APIs

This works perfectly for Xero Accounting APIs. But not for XPM.

Reality Check: XPM APIs are not openly accessible. Even after a successful OAuth setup and scope configuration, you will NOT get access immediately. Access is gated behind manual approval, security validation, and commercial requirements.

Actual XPM API access process showing OAuth setup, scope request issues, approval delay, security assessment, and access granted

Many developers assume that Xero Practice Manager API access works the same way as the standard Xero Accounting API.

That assumption is one of the biggest reasons XPM integration timelines get underestimated.

With Xero Accounting APIs, developers can usually create an app, configure OAuth 2.0, add the required scopes, and begin development. Xero Practice Manager API works differently.

Even after OAuth is configured, XPM-related scopes may not be available until Xero reviews and approves the access request.

Area	Xero Accounting API	Xero Practice Manager API
OAuth 2.0 setup	Required	Required
Scope configuration	Usually available from the developer app	Requires additional approval
Manual access request	Usually not required for standard scopes	Required
Security assessment	Depends on the app and use case	Required for XPM API access
Development start	Can usually begin earlier	May be blocked until approval
Timeline risk	Lower	Higher because approval is external

This is why Xero Practice Manager API integration should be planned as an approval-led integration, not only a development task.

1. How Xero Practice Manager API Scope Access Actually Works

Requesting scopes such as these practicemanager.client.read does not grant access. You must submit the Xero Practice Manager API Access Form as the initial step.

After submission:

Your request is acknowledged.
You are redirected to a formal approval pipeline.
Development effectively pauses until approval is granted.

Even for an internal app, Xero confirms that this is the required process, and access is not granted without completing all steps.

Common Xero Practice Manager API Scopes You May Need

Before submitting the access request, it is important to identify which XPM scopes your integration actually needs.

Requesting unclear or unnecessary scopes can create extra back-and-forth during approval, while missing required scopes can delay development later.

Common XPM API scope requirements may include:

Scope	Purpose
`practicemanager.client.read`	Read client records from Xero Practice Manager
`practicemanager.client`	Create or update client-related data, depending on the API use case
`practicemanager.contact.read`	Read contact records linked with clients
`practicemanager.contact`	Create or update contact-related data, depending on the API use case

For example, if your application only needs to pull client and contact details into another system, read-only scopes may be enough.

But if your application needs to create or update records inside XPM, write-level access may be required.

The best approach is to define the integration use case first, map each feature to the required scope, and then submit the access request with a clear explanation.

2. Security Requirements for Xero Practice Manager API Access

This is the biggest and most underestimated requirement. To access XPM APIs, you must complete the Xero API Consumer Annual Security Assessment.

This includes approximately 21 detailed questions provided by Xero (see XPM Access Security Assessment Sample Document), covering:

Multi-Factor Authentication (MFA)
Secure token storage (encrypted at rest)
Secure coding and infrastructure practices

Important: Even for internal tools or proof of concept projects, this step is mandatory. There are no exemptions.

These requirements align with modern secure API integration practices, especially when dealing with financial and client-sensitive data.

How to Prepare for the XPM API Security Assessment

The security assessment should not be treated as a formality. It can directly affect how quickly your XPM API access request moves forward.

Before submitting your request, prepare answers and supporting details around these areas:

Security area	What to prepare
Authentication	Explain how users log in and how access is controlled
MFA	Confirm whether multi-factor authentication is enabled
Token storage	Describe how access tokens and refresh tokens are stored securely
Encryption	Explain whether sensitive data is encrypted at rest and in transit
Logging	Show how API activity, errors, and access events are monitored
Access control	Define who can access client or contact data inside your system
Data retention	Explain how long XPM data is stored and how it is removed when no longer needed
Infrastructure security	Share how servers, environments, and deployments are protected

For SaaS products and client-facing applications, it is also useful to prepare a short architecture summary.

This helps explain how XPM data moves between systems and how sensitive information is protected.

Preparing these details early can reduce review delays and avoid repeated clarification requests.

3. Xero Practice Manager API Pricing and Tier Requirements

Access to XPM APIs is limited to apps on the Advanced tier or higher. You can read more about this in the Xero Developer FAQs on pricing and policy updates.

This is a non-technical blocker that can delay projects if not planned early.

In many cases, businesses that are already investing in ERP to accounting integration solutions should factor in these additional API access costs during planning.

4. Step-by-Step Process to Access Xero Practice Manager API

Here is the real-world process you must follow:

Create Xero app
Implement OAuth 2.0
Connect to a Xero organization (demo org allowed)
Build working API calls.
Submit the XPM access request form.
Wait for the review response.
Complete security assessment
Address feedback (if any)
Get approval
XPM scopes enabled
Start actual API integration development.

End to end XPM API integration process with OAuth setup, request access, security review, approval, and API endpoint access

Xero Practice Manager API Integration Checklist

Use this checklist before starting XPM API integration:

Checklist item	Status
Xero developer app created	Pending / Done
OAuth 2.0 flow implemented	Pending / Done
Demo or test organization connected	Pending / Done
Required XPM scopes identified	Pending / Done
XPM access request form submitted	Pending / Done
Security assessment details prepared	Pending / Done
Advanced tier or higher requirement reviewed	Pending / Done
Mock API response structure prepared	Pending / Done
Client communication plan created	Pending / Done
Buffer added for approval delays	Pending / Done

This checklist is especially useful when the project has a fixed delivery timeline.

Since XPM scope approval is outside the development team’s control, teams should avoid committing to production dates before access is confirmed.

5. How Long Does Xero Practice Manager API Approval Take?

After submission:

No fixed timeline is provided
Responses may take days or weeks.
Follow-ups are required

This introduces uncertainty in delivery planning.

How Xero Practice Manager API Impacts Development

Development Limitations Without API Access

You cannot fully test unless you have scope approval for:

Clients API
Contacts API

Blocked API Calls

APIs may fail or return empty/unauthorized responses until scopes are approved.

Timeline Risks Due to Approval Delays

External dependency on Xero approval creates unpredictable delivery dates.

What to Do While Waiting for XPM API Approval

XPM approval delays do not mean development has to stop completely.

While waiting for scope access, the development team can still prepare the integration foundation.

Here are practical tasks to complete during the approval period:

Task	Why it matters
Build the OAuth 2.0 flow	Keeps the authentication layer ready
Create mock API responses	Allows frontend and business logic development to continue
Finalize data mapping	Reduces rework once real API access is available
Prepare error handling	Helps manage unauthorized, empty, or failed API responses
Define retry and logging logic	Makes testing easier once access is approved
Document scope assumptions	Keeps clients and internal teams aligned
Prepare test scenarios	Speeds up validation after scopes are enabled

This approach helps reduce idle time and keeps the project moving even when final API access is pending.

Key Insights Before Starting XPM API Integration

XPM is not only an API. It is:

A controlled ecosystem
With compliance requirements
And approval-driven access

Think of it as: A partner integration, not a plug-and-play API. Plan your timelines and architecture accordingly.

What I Would Do Differently for XPM API Integration

If starting again:

Apply for XPM access on Day 1
Prepare security readiness in parallel.
Avoid committing to fixed timelines early.
Build a mock-driven architecture while awaiting scope approval.

XPM integration is less about coding and more about process navigation. If you are working on XPM integration and facing similar blockers, you are not alone. This process is not obvious until you go through it.

This is where a structured integration consulting approach can significantly reduce delays and rework.

Final Thoughts on Xero Practice Manager API Integration

Once you complete the required process, including approval and security checks, XPM scopes are enabled. After that, integration works as expected. The key is to follow the process early to avert delays.

Xero Practice Manager API FAQs

Is XPM API access the same as Xero Accounting API access?: No. While both use the same OAuth 2.0 model, XPM APIs require a separate approval process, including a security assessment and formal scope request. Xero Accounting API scopes are available immediately after app creation.
How long does the XPM approval process take?: There is no fixed timeline. Responses can take days to weeks. It is recommended to apply on Day 1 of your project and build mock-driven architecture while waiting.
Can I bypass the security assessment for a proof of concept?: No. Xero requires a security assessment even for internal tools and proof-of-concept projects. There are no exemptions to this requirement.
What pricing tier is required for XPM API access?: XPM API access is limited to apps on the Advanced tier or higher. Check Xero’s developer FAQ for current pricing and policy details.