Obtain an access token with the files scope in addition to the standard accounting scope
Upload a file to the Xero Files API by POSTing multipart form data to the Files endpoint, receiving a FileId in the response
Associate the uploaded file with an Invoice by POSTing to the Associations endpoint with the FileId and the Invoice's Xero entity ID and entity type
Alternatively, upload directly as an attachment via the Accounting API Attachments sub-resource by PUTting binary content with the correct Content-Type header and a filename in the URL path
List attachments on an Invoice by GETting the Attachments sub-resource for that Invoice ID
Delete an attachment by sending a DELETE request to the Attachments sub-resource with the specific AttachmentID
Known gotchas
The Xero Files API and the Accounting API Attachments endpoint are separate systems with different attachment IDs; records created via one are not automatically visible via the other
File size limits apply per attachment and per organization; exceeding the limit returns an error, and the limit may vary by Xero subscription tier
Attachments on voided or deleted invoices may still be accessible via the API but cannot be modified; always check invoice status before attempting attachment operations
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp