能否通过API/SDK/第三方应用修改Xero/Quickbooks/Plooto员工权限？

Awesome question! Let’s walk through each of these three platforms to confirm if your desired permission changes are doable via APIs, plugins, or extensions:

QuickBooks: Modify "Client Access" Permissions for Any User #

Yes, this is absolutely feasible using the QuickBooks Online API (or third-party plugins that leverage this API).

You’ll work with the CompanyUser endpoints—specifically the UpdateCompanyUser operation. With admin-level credentials, you can adjust the ClientAccess settings for any existing user. The API lets you set granular access levels (full access, read-only, or custom permissions) by specifying the relevant permission enumerations in your request body. Just make sure your API app has the required scopes (like com.intuit.quickbooks.accounting) to manage user permissions.

Plooto: Modify Client-Specific Checkbox Permissions #

Plooto’s v2 API supports exactly this kind of client-specific permission adjustment for individual users.

Their user permission endpoints let you toggle boolean values for each of the permissions you listed: edit_payees, edit_banks, edit_users, edit_payments, and edit_company_details—all scoped to specific customers. You’ll target the user-customer permission relationship, either via a dedicated endpoint or by updating the user’s permission set with customer-specific overrides. Note that you’ll need admin privileges in your Plooto account to make these changes via API.

Xero: Modify "Xero Organisation Access" to Advisor (or Other Roles) #

This is fully supported via the Xero Accounting API.

To update a user’s organisation access role, use the PUT /api.xro/2.0/Users/{UserID} endpoint. In the request body, specify the OrganisationRole field with the desired predefined value—for example, ADVISOR (Xero uses fixed role enums, so you’ll need to stick to their official role strings). Like the others, you’ll need admin-level access to the Xero organisation to run this API call, and your app must have the manage_users scope enabled.

Summary #

All three of your requested permission modification operations are feasible using the respective platform APIs (or plugins built on these APIs), provided you have the necessary administrative credentials and configured the correct API scopes.

内容的提问来源于stack exchange，提问作者Mohit Aggarwal