Exact Online: payments fail with "AppScopeViolated … financial.cashflow"

If payment or bill payment calls to Exact Online fail with a 403, while customers, invoices and other resources work fine, your Exact Online app registration is probably missing access to Exact's cash-flow area.

• GET /accounting/payments or GET /accounting/bill-payments (and the matching detail and update calls) return 403.

• The error from Exact reads: AppScopeViolated: Application Scope Violated. Cannot read 'financial.cashflow' scope. Exact sends this in a response header named reason, so in the Apideck error you'll find it under detail.responseHeaders.reason.

• Invoices still load, but a single invoice's balance may show the full invoice total instead of the amount still open, because the open balance also comes from the cash-flow area.

• The connection still shows as Connected. A 403 doesn't break the connection, so Vault won't flag anything.

Exact Online apps only get access to the data areas (scopes) selected in their app registration. Payments and bill payments live in Exact's cash-flow area, so an app registered without cash-flow access can read everything except those.

This is a setting on your Exact Online app registration (the OAuth app you configured in Apideck), not on your customer's Exact account. Once fixed, it applies to every customer connected through that app.

1. Sign in to Exact Online with the partner or developer account that owns the app registration. Only that account can change an app's scopes. An app registered under an ordinary customer account can only change its name and redirect URL.

2. Go to Partners > App Store > Manage my apps, open your app, then Submit for review > Data & security review.

3. Add access to the cash-flow area, plus any other area your integration uses, and submit.

4. Once Exact has processed the review, retry the payments call. If it still returns the same error, ask the consumer to re-authorize the connection once so it picks up the new scope.

The App permissions screen in a customer's Exact Online security centre only shows what an app has. You can't change scopes there.

From 2 September 2026, Exact no longer supports its App Store in the United Kingdom, the United States, Spain and France. Existing apps and integrations keep working. We're confirming with Exact whether the steps above still apply to UK app registrations. If you can't find Manage my apps on a UK account, contact Apideck support through the Customer Portal (the Requests link at the top of this help center), your Slack channel with us, or support@apideck.com, and we'll help.

• Exact Online UK configuration guide

• Why did my connection stop working?