Does the system have a documented API?
Look for a developer portal or API reference from the vendor itself. Xero publishes its Accounting API and other APIs on its developer site. MYOB requires you to register an app through my.MYOB to receive an API key and secret for the MYOB Business API. ServiceM8 publishes a REST API and a separate Webhooks API. Simpro publishes a REST API that uses OAuth2 and provides an OpenAPI specification. If you cannot find documentation, ask the vendor's support team in writing whether an API exists, what it covers and whether access depends on your plan. A verbal answer from a sales call is not enough to quote against.
Can the API do the exact job your process needs?
Write down each step of the process as a record and an action: read a job, create a bill, update a contact, attach a file. Then check that each one has a matching endpoint and that the fields you need are exposed, including any custom fields. APIs often cover less than the screen does. Xero's batch payments API, for example, only creates batch payments in the organisation's base currency and cannot include credit notes, prepayments or overpayments. Find limits like that before the build, while they only affect the design and not work already paid for.
How will the automation know something changed?
There are two ways. With polling, the automation asks the system for new or changed records on a schedule, which uses API calls and introduces a delay. With webhooks, the system sends a message when something changes. Check exactly what the webhook contains. ServiceM8's documentation states that its webhook updates only indicate that a field has changed and do not include the field's value, so the automation must call the REST API to read the record. That extra call counts against limits and must handle the case where the record changed again in between.
What rate limits apply?
Every API limits how fast and how often it can be called. Xero allows 5 calls in progress at once, 60 calls a minute and 5,000 calls a day for each connected organisation on its higher developer tiers, or 1,000 a day on the Starter tier. Exceeding a limit returns an HTTP 429 response with a Retry-After header. For daily volumes in a small business these limits rarely matter. They do matter for importing years of history, for polling every few minutes, or for pulling line details, which Xero returns 100 invoices at a time.
Are subscriptions or approvals needed?
API access is not always free or automatic. Xero has moved app developers to five usage-based plans, with the new terms applying to existing developers from 2 March 2026; its Starter plan has no charge and allows up to 5 connections. Xero also limits each organisation to five uncertified apps. A Xero custom connection, used to link one integration to a single organisation, requires an additional monthly subscription bought by that organisation and is available in Australia. Other vendors restrict API access to certain plans or to approved partners. Ask the vendor or your provider to list every subscription the automation depends on, and who pays for each.
Who owns the credentials and permissions?
Register API apps and connections under an account the business controls, not a contractor's personal login. Request only the scopes the workflow needs. Xero is moving custom connections to granular scopes: from 29 April 2026 new custom connections use granular scopes and no longer get the accounting journals read scope, while existing connections can keep broad scopes until September 2027. Record where each secret is stored, when it expires and who renews it. Expired tokens and departed staff accounts are common reasons a working automation stops without warning.
What if a system has no API?
Some job management, booking and industry tools publish no open API, or offer one only to approved partners. Before you rule the process out, check the other routes. Many systems can email a scheduled report or export a CSV file on a timetable, which an automation can pick up and process in batches. Some send notification emails for events such as a new booking, and the automation can read those. Screen automation can drive the user interface as a last resort. Each route is slower and less reliable than an API, so ask the vendor in writing whether API access is planned, and weigh that answer before building around the gap.