Kyriba

Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads a Kyriba tenant’s bank accounts, bank and cash balances, cash positions and forecasts, cash flows, payment status and third parties, so treasury agents can answer from the client’s own treasury system. It is read-only, and it is built to refuse an API client that can initiate or approve payments, where Kyriba states that. It reads in place, in your deployment; only ids, hashes and counts reach LightHouse.

At a glance

Collector	Kyriba, version 1.0.0
Reads	Kyriba: Kyriba treasury API (accounts, balances, cash flows, payments) (the vendor's documentation)
Family	Finance
Kind	Treasury
Ways to connect	OAuth approval
Scopes	Read: account-scope, cash-balances-scope, bank-balances-scope, cash-flows-scope, payment-file-scope, payment-transaction-summary-scope, third-party-scope
Read only	Yes, except: [object Object]
Vendor's API can move money	Yes
Personal data	Financial, Contact
Hosts it may contact	*.kyriba.com, {host}
Vendor API versions	Kyriba REST API v1, payment-transaction-summary-details v2
Lowest engine version	0.46.0

What it reads

• Bank accounts that are open, with company, bank, IBAN and type.
• End-of-day bank balances (yesterday’s) and cash positions and forecasts from today for forecast_days (default 30, at most 31), including actual, intraday, confirmed and estimated figures.
• Cash flows (the reconciled actuals are the bank transactions), in windows of at most 31 days, as Kyriba requires, re-reading the last week.
• Payment status: the payment transaction summary (status, UETR, last acknowledgement, counterparty, file, remittance) and payment-file status.
• Third parties: code, name, type, creditor and debtor flags.
• The first read goes back history_days (default 90, at most 3,650).

It does not read FX rates (not in Kyriba’s public reference), and it does not call any payment initiation API.

How to connect

1. Ask your Kyriba administrator for an API client by client credentials, with read permissions only (account-scope, cash-balances-scope, bank-balances-scope, cash-flows-scope, payment-file-scope, payment-transaction-summary-scope, third-party-scope), and the two URLs (for example https://auth.demo.kyriba.com and https://api.demo.kyriba.com/api).
2. In LightHouse, open Setup and admin, Connectors and choose Kyriba.
3. Paste the client id, client secret and the two URLs, and confirm the API client has only read permissions. Your browser seals it to your deployment; LightHouse never sees it.

The credential is JSON in the variable the source names (AAL_KYRIBA by default): client_id, client_secret, auth_url, api_url, and view_only_confirmed (yes).

Permissions

This collector is read-only in what it does: GET requests, and one POST {auth_url}/oauth/token for the access token. Its read-only test proves it on every change. Nothing is initiated, transferred or approved.

• Refused by the code: where the token answer states permissions (its scope), an API client with any permission whose name contains payment-initiation, payment-automation, transfer, approv or fraud-detection-spi (case-insensitive) is refused, naming it. The error is Kyriba: refused: the credential can <permissions>; make a view-only one.
• Not detectable by the code: Kyriba’s permissions are access permissions on the API client, not OAuth scopes, and the collector asks for no scope, so the token answer usually states none. The collector then reads only once you have confirmed the API client has only read permissions (view_only_confirmed); without it the error is Kyriba does not state this key's permissions; confirm the key is view-only (view_only_confirmed) before it is read. Have your Kyriba administrator make the API client read-only: that, not this code, is what stops it from initiating payments.
• Hosts: the two URLs must be https://<host>.kyriba.com addresses without a query (auth_url and api_url are https://<host>.kyriba.com addresses); only those two hosts are contacted, and redirects are never followed.
• Token scheme: the token is sent with the token_type Kyriba answers; on a 401 the collector tries once with the other scheme.

Limits

• 50 calls in 30 seconds and one at a time per API client, and a daily quota per environment. Requests are paced, and a 429 waits until Kyriba-Customer-Rate-Limit-Reset.
• Pages of 100. Balances and cash flows are asked in windows of at most 31 days.
• Amounts are exact decimals; a number that arrives as a float is refused.

Data handling

• Records hold financial data (balances, cash flows, payments) and the names of counterparties and third parties. Documents carry the label you give the source (default confidential).
• Content is read in place, in your deployment. LightHouse receives ids, hashes and counts, never the records, and never opens the credential.
• Errors carry a status and fixed text, never a provider’s body.
• The data is audit-ready for your own agents; nothing here certifies anyone against any regulation.

Troubleshooting

What you see	What it means	What to do
Kyriba: refused: the credential can payment-initiation-spi-scope; make a view-only one	The token states a fund-moving permission (named)	Ask your administrator for a read-only API client
Kyriba does not state this key's permissions; confirm the key is view-only (view_only_confirmed) before it is read	Permissions are not stated and you have not confirmed	Confirm the API client has read permissions only
auth_url and api_url are https://<host>.kyriba.com addresses	A URL is not on kyriba.com, or has a query	Use the addresses your administrator gave
Kyriba answered no token	The token endpoint answered without a token	Check the client id and secret
Kyriba answered HTTP 401	The client was refused	Check the client id and secret
Kyriba answered HTTP 429	Rate limit	Nothing; the collector waits until Kyriba’s reset time
forecast_days is 0 to 31	The forecast window is out of range	Use 0 to 31

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	1.0.0	0.46.0	Kyriba REST API v1; payment-transaction-summary-details v2	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only