Overview

The ac-co.ai Public API is a client-facing REST gateway at api.ac-co.ai that exposes a curated, versioned subset of the platform over oRPC — legal entities, accounting, banking, landlord/property, assets, document vault, billing, and accounting periods. It's a deliberately smaller and more stable surface than the internal platform contract: every endpoint listed here is one we're committed to keeping working.

A restricted hmrc.* read surface (VAT, ITSA, Self Assessment) is also exposed, forwarded to the HMRC filing service — see HMRC compliance before building against it.

What you can build

• Entities — read and create legal entities and businesses/activities for an organization (entities:read / entities:write).
• Accounting — list invoices and clients, create invoices and clients (accounting:read / accounting:write).
• Banking — read-only access to connected institutions, accounts, and transactions (banking:read).
• Landlord & assets — properties, tenancies, mortgages, certificates, portfolios, and investment accounts (entities:read / entities:write — landlord and assets share the entities scope).
• Document vault — list, search, and upload documents (vault:read / vault:write).
• Billing — read-only credits balance, ledger, usage, and plans (billing:read).
• Periods & obligations — read-only accounting period and filing-obligation status (periods:read).
• HMRC (restricted) — read-only VAT/ITSA/Self Assessment status and filing summaries (hmrc:read).

Every endpoint is documented with its request/response schema, an interactive try-it-out playground, and generated TypeScript types under API Reference.

Authentication

Two ways to authenticate a request, both documented in full on the Authentication page:

1. API keys (ac_…) — created per-organization in Accounting → Settings → Developers, with a scope picker. Simplest option for server-to-server integrations and scripts.
2. OAuth 2.0 (authorization-code + PKCE) — for apps acting on behalf of a user, with dynamic client registration and refresh tokens via offline_access.

Every request needs a bearer token: Authorization: Bearer <token>.

Where to go next

• Authentication — API keys and OAuth 2.0, with curl examples.
• Scopes — the full scope catalog, generated from the source of truth.
• HMRC compliance — read this before touching the hmrc.* endpoints.
• Errors — 401 / 403 / 404 semantics with example payloads.
• API Reference — every endpoint, generated from the live OpenAPI schema.
• SDK and CLI — the @repo/sdk MCP client and the ac-co command line (a different, complementary surface — see that page for how it relates to this REST API).

Looking for product guides instead of API docs? Head back to product docs.