Enable read permissions

Choose your system below. Give Last Accounting Company every available read or view permission, then paste the credentials in LAC.

Read-only means no create, edit, approve, pay, delete, or invalidate access. LAC stores credentials securely and never shows them again. If the provider refuses access, LAC keeps the saved credentials and shows Check again, so you only need to fix the setting at the provider. Paste a new key only if the key itself is wrong.

The Fennoa key has no separate scope screen. Access belongs to the API user that owns the key.

Create one API user for LAC

A Fennoa administrator or the current accounting firm opens Users → Create new API user. Choose Yleinen API-käyttäjä (General API user) and name it Last Accounting Company.Open Fennoa’s API-user guide

Give it every read right

If Fennoa shows a bulk read/view choice, use it. Otherwise, enable every permission labelled read or view. Leave every create, change, approve, payment, and delete permission off.Fennoa does not publish one universal read-only preset. Check the wording before you save.

Paste the credentials in LAC

Copy and paste the API username and API key.

Read coverage: 28 available, 23 used today

Area	Available reads	Used today	Grant
Accounting	8	7	All read/view rights
Sales invoices	6	5	All read/view rights
Purchase invoices	8	8	All read/view rights
Customers	3	1	All read/view rights
Dimensions	3	2	All read/view rights
Total	28	23	All read/view rights

Used today

Accounting: GET /accounting_api/get/ledger/{start}/{end}, /accounting_api/get/accounts, /accounting_api/get/vatcodes, /accounting_api/get/periods, /accounting_api/get/opening_balances/{period_id}, /accounting_api/get/locking_periods, /accounting_api/get/budgets
Sales: GET /sales_api/, /sales_api/{id}, /sales_api/get/payments/{start}/{end}, /sales_api/get/pdf/{id}, /sales_api/get/delivery_errors
Purchases: GET /purchases_api/get/list, /purchases_api/{id}, /purchases_api/get/approval_queue, /purchases_api/get/finvoice/{id}, /purchases_api/get/attachment/{id}/{attachment_id}, /purchases_api/get/tags/{id}, /purchases_api/get/unbooked, /purchases_api/get/suppliers
Customers: GET /customer_api/
Dimensions: GET /dimension_api/, /dimension_api/get/types

Available for later

GET /accounting_api/get/account_balance
GET /sales_api/get/invoice_no/{invoice_no}
GET /customer_api/{id}
GET /customer_api/get/customer_no/{customer_no}
GET /dimension_api/{id}

Sources: accounting, sales, purchases, customers, and dimensions.

A Procountor API key has no permission picker. It inherits the rights of the user for whom it was created. Use a dedicated user so access stays read-only and easy to revoke.

Create a dedicated user

A company administrator opens Management → Users and user rights and creates a user named Last Accounting Company.Open Procountor’s user-rights guide

Set all safe viewing rights

Use Management / Auditor as the starting role. Set every available permission to Viewing rights. Set Only allow API M2M login to Yes. Remove personal-invoice and dimension-only limitations.Leave any right that only offers write-capable All rights at No access. In particular, do not grant payment, salary payment, approval, import, or editing authority.

Create and paste the API key

Sign in as a company administrator. Open Basics → API client keys → New API key. Select the dedicated LAC user and paste the LAC client ID shown on the connection screen. Create the key and paste it in LAC.Open Procountor’s API-key guide

Read coverage: 104 available operations, 16 used today

Procountor’s public API currently contains 101 GET operations and three read-only report operations that use POST. Product, role, country, and two-factor rules can limit some operations for an M2M user.

API area	Available	Used today
Attachments	2	1
Bank accounts	2	0
Bank statements	1	1
Business partners	9	2
Chart of accounts	1	1
Company	9	1
Currencies	4	0
Dimensions	2	1
Employees	11	0
Factoring contracts	2	0
Fiscal years	1	1
Health status	1	0
Integrations	2	0
Invoices	12	3
Journal	1	0
Ledger receipts	2	2
Multi-factor authentication	1	0
Payments	6	0
Payrolls	10	0
Persons	5	0
Products	6	0
Reference payments	1	1
Reports	3	1
SIE file	2	0
Session information	1	0
Users	3	0
VAT	3	1
Webhooks	1	0
Total	104	16

Used todayGET /company, GET /fiscalyears, GET /coa, GET /dimensions, GET /vats/default, GET /businesspartners, GET /businesspartners/{id}, GET /ledgerreceipts, GET /ledgerreceipts/{receiptId}, GET /invoices, GET /invoices/{invoiceId}, POST /reports/ledgeraccounts, GET /bankstatements, GET /referencepayments, GET /attachments/{attachmentId}, GET /invoices/{invoiceId}/image.All available read operations

Attachments: GET /attachments, GET /attachments/{attachmentId}
Bank accounts: GET /bankaccounts, GET /bankaccounts/{id}
Bank statements: GET /bankstatements
Business partners: GET /businesspartners, /businesspartners/groups, /businesspartners/groups/{id}, /businesspartners/personaldetails, /businesspartners/{id}, /businesspartners/{id}/defaults/accounts, /businesspartners/{id}/defaults/dimensions, /businesspartners/{id}/defaults/dimensions/{dimensionId}, /businesspartners/{id}/defaults/products
Chart of accounts: GET /coa
Company: GET /company, /company/deliveryterms, /company/einvoiceaddresses, /company/expenses/collectionpenal/settings, /company/invoicecirculation/settings, /company/invoicecirculation/verifierlists, /company/invoicecirculation/verifierlists/{id}, /company/invoicetemplates, /company/usagesettings
Currencies: GET /currencies, /currencies/company, /currencies/exchangerate, /currencies/latest
Dimensions: GET /dimensions, GET /dimensions/{dimensionId}
Employees: GET /payrolls/employees, /payrolls/employees/{id}/holidaypay, /payrolls/employees/{id}/salarybase, /payrolls/employees/{id}/salaryinfo, /payrolls/employees/{id}/salaryinfo/employments, /payrolls/employees/{id}/salaryinfo/employments/{employmentId}, /payrolls/employees/{id}/salaryinfo/laborunionmemberships, /payrolls/employees/{id}/salaryinfo/laborunionmemberships/{laborUnionMembershipId}, /payrolls/employees/{id}/salaryinfo/taxcards, /payrolls/employees/{id}/salaryinfo/taxcards/{taxCardId}, /payrolls/employees/{id}/workinghourreduction
Factoring contracts: GET /factoringcontracts, GET /se/factoringcontracts
Fiscal years: GET /fiscalyears
Health status: GET /status
Integrations: GET /integrations/{integrationId}/customers, GET /integrations/{requestId}
Invoices: GET /invoices, /invoices/personalapprovals, /invoices/personalverifications, /invoices/transactions, /invoices/{invoiceId}, /invoices/{invoiceId}/comments, /invoices/{invoiceId}/comments/taggableusers, /invoices/{invoiceId}/comments/{commentId}, /invoices/{invoiceId}/image, /invoices/{invoiceId}/paymentevents, /invoices/{invoiceId}/paymentevents/{paymentEventId}, /invoices/{invoiceId}/transactions
Journal: GET /journals
Ledger receipts: GET /ledgerreceipts, GET /ledgerreceipts/{receiptId}
Multi-factor authentication: GET /mfatransactionresult/{transactionIdentifier}
Payments: GET /payments, /payments/directsalarypayments, /payments/directsalarypayments/{paymentListId}, /payments/errormessages, /payments/paymentevents, /payments/{paymentId}
Payrolls: GET /payrolls/laborunionsettings, /payrolls/salariesbasicinfo, /payrolls/salarylists, /payrolls/salarylists/{id}, /payrolls/salaryperiods, /payrolls/salaryperiods/{id}, /payrolls/salaryslips, /payrolls/salaryslips/{id}, /payrolls/salaryslips/{id}/accounting, /payrolls/salarytypes
Persons: GET /persons, /persons/{id}, /persons/{id}/defaults/dimensions, /persons/{id}/defaults/dimensions/{dimensionId}, /persons/{id}/defaults/products
Products: GET /products, /products/groups, /products/groups/{groupId}, /products/{productId}, /products/{productId}/defaults/dimensions, /products/{productId}/defaults/dimensions/{dimensionId}
Reference payments: GET /referencepayments
Reports: POST /reports/accounting, POST /reports/generalledger/{id}, POST /reports/ledgeraccounts
SIE file: GET /sie/availability, GET /sie/file
Session information: GET /sessioninfo
Users: GET /users, /users/profiles/{userId}, /users/rights
VAT: GET /vats/country, /vats/default, /vats/settings
Webhooks: GET /webhooks

Source: Procountor API reference, version 26.08.

Netvisor grants access to a custom integration, not to a generic key scope. The connection screen shows the LAC integration key that identifies the correct resource list.

Create the LAC integration

Open Company menu → Software API identifiers. Create a dedicated identifier named Last Accounting Company. Then open Company menu → API resource permissions → Custom integrations and add LAC with the LAC integration key shown on the connection screen.Open Netvisor’s resource-permissions guide

Enable the complete LAC read bundle

First scan the resource actions shown inside the LAC integration.

If every action is read or export, turn on Integration allowed. This is Netvisor’s clean bulk option.
If you see any import, add, create, edit, update, approve, pay, delete, or invalidate action, leave Integration allowed off. Enable only the 22 read/export resources listed below.

If the LAC panel is missing one of the 22 resources, stop and message us. LAC must correct the registered integration bundle with Netvisor; you should not need to troubleshoot our setup.

Finish in LAC

Paste the API identifier and API key. LAC already knows your company Business ID.

Read coverage: 22 requested resources, 10 used today

Area	Requested	Used today
Sales invoices and payments	5	2
Purchase invoices and payments	6	2
Accounting and dimensions	11	6
Total	22	10

Used todayaccountlist.nv, accountingperiodlist.nv, getaccountdimensionlist.nv, accountingledger.nv, accountbalance.nv, getvoucherattachments.nv, salesinvoicelist.nv, getsalesinvoice.nv, purchaseinvoicelist.nv, getpurchaseinvoice.nv.Complete requested bundle

Sales invoices and payments: salesinvoicelist.nv, getsalesinvoice.nv, deletedsalesinvoices.nv, salespaymentlist.nv, deletedsalespayments.nv
Purchase invoices and payments: purchaseinvoicelist.nv, getpurchaseinvoice.nv, getattachments.nv, deletedpurchaseinvoices.nv, paymentlist.nv, deletedpurchasepayments.nv
Accounting and dimensions: accountingledger.nv, deletedvouchers.nv, accountlist.nv, accountingperiodlist.nv, vouchertypelist.nv, dimensionlist.nv, accountbalance.nv, getbankaccounts.nv, getvoucherattachments.nv, getaccountdimensionlist.nv, financialobligationstatus.nv

The extra reads are limited to accounting completeness: source deletion detection, bank-account identity, invoice payment links, purchase evidence, voucher/dimension interpretation, and Netvisor’s obligation and ledger-reconciliation status. “Deleted…” resources only read deletion history; they do not delete data. Several of Netvisor’s deletion reads expose only a seven-day history, so LAC must poll them without gaps.Payroll, user administration, customer/vendor masters, orders, products, warehouse data, imports, approvals, payment initiation, and every source mutation are excluded. If one of the 22 resources is missing from the LAC panel, message us: only Netvisor partner support can add it to the registered integration bundle.Sources: Netvisor’s accounting, sales, and purchase resource guides; its deleted-voucher guide documents the seven-day deletion-history constraint.

Wise puts the access choice directly on the token. You do not need to choose individual API routes.

Open API tokens in a browser

Sign in to the correct Wise Business profile on the web. Open Your account → Connect and manage apps → API tokens. Wise does not offer token creation in the mobile app.Open Wise’s API-token guide

Create the safe bulk token

Choose Add new token, name it Last Accounting Company, and set the access level to Read only. Complete two-step verification.

Paste it in LAC

Wise shows the token only once. Copy it and paste the API token in LAC before you close the dialog.

Read coverage: one read-only token, 4 routes used today

Wise does not ask you to grant routes one by one. The Read only access level is the full safe choice. LAC currently uses:

GET /v2/profiles
GET /v4/profiles/{profile_id}/balances
GET /v1/profiles/{profile_id}/balance-statements/{balance_id}/statement.json
GET /v1/transfers

Wise can limit statement access by account country and token product. LAC shows any missing statement months after the first sync.

Adyen grants access through roles on an API credential. A Report user with one report-download role can read settlement reports and can do nothing else: it cannot take payments, refund, or change settings.

Create a Report user

A Customer Area user with Merchant admin or Manage API credentials opens Developers → API credentials → Create new credential and chooses Report user. Under Roles (or Permissions), keep only Merchant Report Download role, and limit Accounts to the merchant account you connect. Leave Allowed IP range empty: LAC’s report reads do not come from a fixed address.Open Adyen’s API-credential guide

Turn on settlement reports

Switch to the merchant account and open Reports → Settlement details → Manage report → Automatic. Turn it on At batch close, for Current account, as CSV, without report encryption. A report for several accounts or in another format has a file name or layout LAC cannot read. LAC reads one report per closed payout batch; if a batch has no report, generate it under Manual → Single batch.Open Adyen’s Settlement details guide

Paste it in LAC

Generate the Report user’s API key, copy it, and save the credential: Adyen shows the key only once. Paste it in LAC with the merchant account code exactly as Customer Area shows it. One connection reads one merchant account.

Read coverage: one report, one route

LAC downloads each closed batch’s Settlement details report and nothing else:

GET https://ca-live.adyen.com/reports/download/MerchantAccount/{merchant_account}/settlement_detail_report_batch_{n}.csv

Each report is checked before it is used: a closed batch nets to zero, so its payments, refunds, chargebacks, fees and carried balances must add up exactly to its payout. Adyen keeps generated reports for two years. To read older batches, generate their reports again in Customer Area (Manual → Single batch).

PayPal has no read-only key. You create an app in your own PayPal business account, and the features you turn on for that app decide what its credentials can do. LAC only reads with them, so turn on only what LAC reads and leave the payment features you don’t use off.

Create a Live app

Sign in to the PayPal Developer Dashboard with your PayPal business account. Switch to Live, open Apps & Credentials, and choose Create App. Name it Last Accounting Company.

Turn on Transaction search

Under the app’s Features, keep Transaction search on, and Disputes if PayPal offers it. Leave payment features you don’t use off: LAC never uses them. PayPal can take a few hours to apply a feature change. If you pasted the credentials before turning the feature on, select Check again on the PayPal connection once it has applied; a connected app is checked again on every sync.

Paste the credentials in LAC

Copy the app’s Client ID and Secret and paste both in LAC. LAC checks them with PayPal and reads the PayPal account the app belongs to. One PayPal account belongs to one company.

Read coverage: 3 reads used today

LAC asks PayPal for a token with the app’s credentials, then only reads:

GET /v1/reporting/transactions: transactions and fees, up to three years back
GET /v1/reporting/balances: balances by currency
GET /v1/customer/disputes: refunds and disputes, when Disputes is on for the app

If Transaction search is off, PayPal tells LAC in the token itself, and the connection shows what to turn on. Without Disputes, LAC reads everything else.

Getting started

Guides

MCP