# Kyriba > Kyriba: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads a Kyriba tenant’s bank accounts, bank and cash balances, cash positions and forecasts, cash flows, payment status and third parties, so treasury agents can answer from the client’s own treasury system. It is read-only, and it is built to refuse an API client that can initiate or approve payments, where Kyriba states that. It reads in place, in your deployment; only ids, hashes and counts reach LightHouse. ## At a glance | Collector | Kyriba, version `1.0.0` | | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Reads | Kyriba: Kyriba treasury API (accounts, balances, cash flows, payments) ([the vendor's documentation](https://developer.kyriba.com/)) | | Family | Finance | | Kind | Treasury | | Ways to connect | OAuth approval | | Scopes | - Read: `account-scope`, `cash-balances-scope`, `bank-balances-scope`, `cash-flows-scope`, `payment-file-scope`, `payment-transaction-summary-scope`, `third-party-scope` | | Read only | Yes, except: \[object Object] | | Vendor's API can move money | Yes | | Personal data | Financial, Contact | | Hosts it may contact | `*.kyriba.com`, `{host}` | | Vendor API versions | Kyriba REST API v1, payment-transaction-summary-details v2 | | Lowest engine version | `0.46.0` | ## What it reads - **Bank accounts** that are open, with company, bank, IBAN and type. - **End-of-day bank balances** (yesterday’s) and **cash positions and forecasts** from today for `forecast_days` (default 30, at most 31), including actual, intraday, confirmed and estimated figures. - **Cash flows** (the reconciled actuals are the bank transactions), in windows of at most 31 days, as Kyriba requires, re-reading the last week. - **Payment status:** the payment transaction summary (status, UETR, last acknowledgement, counterparty, file, remittance) and payment-file status. - **Third parties:** code, name, type, creditor and debtor flags. - The first read goes back `history_days` (default 90, at most 3,650). It does not read FX rates (not in Kyriba’s public reference), and it does not call any payment initiation API. ## How to connect 1. Ask your Kyriba administrator for an API client by client credentials, with read permissions only (`account-scope`, `cash-balances-scope`, `bank-balances-scope`, `cash-flows-scope`, `payment-file-scope`, `payment-transaction-summary-scope`, `third-party-scope`), and the two URLs (for example `https://auth.demo.kyriba.com` and `https://api.demo.kyriba.com/api`). 2. In LightHouse, open **Setup and admin, Connectors** and choose **Kyriba**. 3. Paste the client id, client secret and the two URLs, and confirm the API client has only read permissions. Your browser seals it to your deployment; LightHouse never sees it. The credential is JSON in the variable the source names (`AAL_KYRIBA` by default): `client_id`, `client_secret`, `auth_url`, `api_url`, and `view_only_confirmed` (`yes`). ## Permissions This collector is **read-only** in what it does: `GET` requests, and one `POST {auth_url}/oauth/token` for the access token. Its read-only test proves it on every change. Nothing is initiated, transferred or approved. - **Refused by the code:** where the token answer states permissions (its `scope`), an API client with any permission whose name contains `payment-initiation`, `payment-automation`, `transfer`, `approv` or `fraud-detection-spi` (case-insensitive) is refused, naming it. The error is `Kyriba: refused: the credential can ; make a view-only one`. - **Not detectable by the code:** Kyriba’s permissions are access permissions on the API client, not OAuth scopes, and the collector asks for no scope, so the token answer usually states none. The collector then reads only once you have confirmed the API client has only read permissions (`view_only_confirmed`); without it the error is `Kyriba does not state this key's permissions; confirm the key is view-only (view_only_confirmed) before it is read`. Have your Kyriba administrator make the API client read-only: that, not this code, is what stops it from initiating payments. - **Hosts:** the two URLs must be `https://.kyriba.com` addresses without a query (`auth_url and api_url are https://.kyriba.com addresses`); only those two hosts are contacted, and redirects are never followed. - **Token scheme:** the token is sent with the `token_type` Kyriba answers; on a 401 the collector tries once with the other scheme. ## Limits - 50 calls in 30 seconds and one at a time per API client, and a daily quota per environment. Requests are paced, and a 429 waits until `Kyriba-Customer-Rate-Limit-Reset`. - Pages of 100. Balances and cash flows are asked in windows of at most 31 days. - Amounts are exact decimals; a number that arrives as a float is refused. ## Data handling - Records hold financial data (balances, cash flows, payments) and the names of counterparties and third parties. Documents carry the `label` you give the source (default `confidential`). - Content is read in place, in your deployment. LightHouse receives ids, hashes and counts, never the records, and never opens the credential. - Errors carry a status and fixed text, never a provider’s body. - The data is audit-ready for your own agents; nothing here certifies anyone against any regulation. ## Troubleshooting | What you see | What it means | What to do | | -------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- | ------------------------------------------------------ | | `Kyriba: refused: the credential can payment-initiation-spi-scope; make a view-only one` | The token states a fund-moving permission (named) | Ask your administrator for a read-only API client | | `Kyriba does not state this key's permissions; confirm the key is view-only (view_only_confirmed) before it is read` | Permissions are not stated and you have not confirmed | Confirm the API client has read permissions only | | `auth_url and api_url are https://.kyriba.com addresses` | A URL is not on kyriba.com, or has a query | Use the addresses your administrator gave | | `Kyriba answered no token` | The token endpoint answered without a token | Check the client id and secret | | `Kyriba answered HTTP 401` | The client was refused | Check the client id and secret | | `Kyriba answered HTTP 429` | Rate limit | Nothing; the collector waits until Kyriba’s reset time | | `forecast_days is 0 to 31` | The forecast window is out of range | Use 0 to 31 | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | ---------------------------------------------------------- | ----------------------------------- | -------------- | | 10 November 2026 | `1.0.0` | `0.46.0` | Kyriba REST API v1; payment-transaction-summary-details v2 | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/kyriba/