# Visma

> Visma is a Nordic business-software group (Oslo, Norway) supplying cloud ERP, accounting,
> invoicing, payroll, HR and public-sector software across Europe and Latin America. Its API
> surface is federated across product lines rather than centralised behind one gateway.
> Generated by API Evangelist on 2026-09-13 from Visma's own published specifications and
> documentation. This is a third-party profile, not a Visma publication.

## APIs

- [Visma.net ERP API](https://docs.vismasoftware.no/vismanetapi/): OpenAPI 3.0.4, 395 paths / 511
  operations, base https://api.finance.visma.net. Published in two flavours sharing an identical
  path and schema surface: Service (OAuth client credentials) and Interactive (authorization code
  with named scopes). Covers general ledger, AR/AP, customers, suppliers, sales and purchase
  orders, inventory, shipments, projects, dimensions, expense claims and time cards.
- [Bookkeeping & Invoicing / eAccounting API V2](https://developer.vismaonline.com/): OpenAPI
  3.0.4, 274 paths / 228 operations, base https://eaccountingapi.vismaonline.com/v2/. Operated by
  Spiris (formerly Visma Spcs). 69 tags covering customers, suppliers, articles, invoices, orders,
  quotes, vouchers, accounts, projects, cost centres, attachments and SIE file import/export.
- [Cloud Payroll / Spiris Lon API](https://developer.vismaonline.com/): OpenAPI 3.0.4, V2 (68
  paths / 88 operations) and V1 (73 paths / 63 operations), base https://vlsapi.vismaonline.com/.
- [Business NXT GraphQL API](https://docs.vismasoftware.no/businessnxtapi/):
  https://business.visma.net/api/graphql (user context, authorization code + PKCE) and
  /api/graphql-service (client credentials). Introspection is authentication-gated.

## Agent surfaces

- [Business NXT MCP](https://docs.vismasoftware.no/businessnxtapi/ai/mcp/): remote MCP server at
  https://mcp.business.visma.net/ (streamable HTTP, stateless, OAuth via Visma Connect, scope
  business-nxt-mcp:graphql). 19 documented tools: schema introspection, read-only GraphQL, guarded
  create/update against 17 named tables, documentation search, workflow skills, document handling,
  dashboards. Writes require a per-company AI permission toggle and oldValues on update.
- [Spiris MCP](https://developer.vismaonline.com/docs/spiris-mcp-server): remote MCP server at
  https://mcp.spiris.se/mcp (OAuth via https://auth.mcp.spiris.se, scope mcp:ea, dynamic client
  registration). Beta, free during beta. Tools cover customers, orders, customer invoices,
  articles, suppliers, supplier invoices, vouchers, accounts, attachments, projects, cost centres
  and company settings.
- Neither server exposes an anonymous tools/list; both answer 401 with WWW-Authenticate: Bearer.
- No A2A agent card is published on any Visma host.

## Authentication

- [Visma Connect](https://connect.visma.com/.well-known/openid-configuration): OpenID Connect
  provider for Visma.net ERP and Business NXT. 129 scopes, PKCE, DPoP, device flow, CIBA,
  back-channel logout. Token endpoint https://connect.visma.com/connect/token.
- [Visma Online IdentityServer](https://identity.vismaonline.com/.well-known/openid-configuration):
  OpenID Connect provider for eAccounting and Cloud Payroll. Scopes ea:api, ea:sales,
  ea:sales_readonly, ea:accounting, ea:accounting_readonly, ea:purchase, ea:purchase_readonly,
  ea:settings, vls:api, offline_access.
- Application registration and approval happen in the Visma Developer Portal at
  https://oauth.developers.visma.com/service-registry/.

## Runtime semantics

- [Rate limits](https://docs.vismasoftware.no/vismanetapi/api-reference/rate-limits/): Visma.net ERP
  returns X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset and X-RateLimit-Policy on
  every response, and Retry-After on 429. The standard allowance is per company + client per hour
  and is deliberately not published as a number. eAccounting allows 600 requests per minute per
  client and endpoint, returning 429 with ErrorCode 4010.
- [ETag / If-Match](https://docs.vismasoftware.no/vismanetapi/api-reference/features/etag/):
  optimistic concurrency on 97 Visma.net ERP write operations; 412 Precondition Failed on mismatch.
  There is no Idempotency-Key header anywhere in the Visma API surface.
- [Background calls](https://docs.vismasoftware.no/vismanetapi/api-reference/features/background/):
  the erp-api-background header turns 509 of 511 ERP operations into asynchronous jobs.
- [Pagination](https://docs.vismasoftware.no/vismanetapi/api-reference/features/pagination/):
  pageNumber/pageSize on Visma.net ERP; PaginatedResponseOf<T> envelopes on eAccounting.
- [Error codes](https://developer.vismaonline.com/docs/error-codes-copy-1): eAccounting publishes a
  56-code catalogue in a {ErrorCode, DeveloperErrorMessage, ErrorId} envelope. No API uses RFC 9457.
- [Webhooks](https://docs.vismasoftware.no/vismanetapi/webhooks/event-and-entities/): Visma.net ERP
  publishes 58 events across 31 entities from two publishers. Subscriptions are managed in the
  Developer Portal. No AsyncAPI document is published.

## Lifecycle

- [End of life notices](https://docs.vismasoftware.no/vismanetapi/end-of-life-notices/): the
  integration.visma.net base URL is retired in favour of https://api.finance.visma.net and has been
  throttled to 500 calls/hour per application since 2026-02-01; SalesOrder V1/V2 are deprecated in
  favour of V3. Visma retires by progressive throttling, not by a Sunset header.
- [Status page](https://status.visma.com/): Atlassian Statuspage, "Visma Cloud Services", with a
  machine-readable summary at https://status.visma.com/api/v2/summary.json.

## Security and compliance

- [security.txt](https://connect.visma.com/.well-known/security.txt): canonical on the identity
  host, not the apex domain. Contact security@visma.com.
- [Bug bounty and responsible disclosure](https://www.visma.com/trust-centre/security/products-and-services/bug-bounty-and-responsible-disclosure/):
  two Intigriti programmes with an explicit safe-harbour statement and a hall of fame.
- [Trust Centre](https://www.visma.com/trust-centre): per-product pages. Visma Net (ERP) carries
  ISO 9001, ISO 27001 and ISAE 3402 Type II under the Visma Cloud Delivery Model, hosted on Azure
  in the EU/EEA (Netherlands), with 19 named subprocessors.

## Notes and gaps

- Visma publishes no first-party API client SDK on any package registry. The first-party npm
  packages are design-system and web-component libraries (@vismaux/*, @visma-swno/*).
- The eAccounting and Payroll specs declare no operationId on any operation.
- No API pricing is published; API access is an attribute of a product subscription plus an
  approved Developer Portal application.