DATEV Online APIs

Important — this connector is NOT plug-and-play. DATEV's Online APIs require:

1. A registered app on the DATEV-Entwicklerportal (https://developer.datev.de) → Confidential client + OpenID Connect Authorization Code Flow. Set the redirect URI to <your-server>/api/mcp-oauth/callback.
2. A subscription to each API product you want to use — currently accounting-clients v2.0 and accounting-documents v2.0. Both are Already subscribed checks on the product page.
3. A real DATEV-Konto user with SmartLogin or SmartCard/mIDentity. DATEV does NOT expose client_credentials — every call is on-behalf-of a human accountant. Confidential clients get 2-year rolling refresh tokens (the engine refreshes proactively).
4. For *.api.datev.de (production) you must complete DATEV's production-approval review. Until then, point the connector at the sandbox (see below).

Authentication endpoints (canonical, from https://login.datev.de/openid/.well-known/openid-configuration):

• Production: authorize=https://login.datev.de/openid/authorize, token=https://api.datev.de/token
• Sandbox: authorize=https://login.datev.de/openidsandbox/authorize, token=https://sandbox-api.datev.de/token

Setup:

1. Set DATEV_CLIENT_ID and DATEV_CLIENT_SECRET (from the DATEV portal).
2. Import this adapter — defaults to production auth URLs.
3. Run the one-time OAuth flow: POST /api/connectors/{id}/oauth/authorize → open the returned URL → log in with your DATEV-Konto → the platform stores an encrypted refresh token automatically.
4. From now on every call sends Authorization: Bearer <token> AND the mandatory X-DATEV-Client-Id: <DATEV_CLIENT_ID> header automatically.

Testing first? Every DATEV app runs in the sandbox until DATEV grants production approval. For sandbox testing use the dedicated DATEV Online APIs (Sandbox) connector (pre-configured for the sandbox endpoints) rather than editing this one — then switch to this production connector once approved, using the same credentials.

Scopes requested: datev:accounting:clients accounting:clients:read accounting:documents. These cover both API products in one consent screen. Note: the current DATEV datev_openid flow does NOT include openid in its scope list (it's the issuer name, not a requested scope) — confirmed in the OpenAPI security schemes.

Mandant scoping: every per-client tool takes a clientId parameter — that's the Mandant UUID (RFC4122 8-4-4-4-12), returned by datev_list_clients. Distinct from DATEV_CLIENT_ID (the OAuth app identifier, sent in the header).

Not exposed here (engine limitation):

• POST /clients/{id}/documents, PUT /clients/{id}/documents/{guid}, PUT /clients/{id}/documents/stapled: all require multipart/form-data with a binary file part. The REST engine currently serializes form-data field values via String(v), which corrupts binary PDFs/images. These upload tools land once the engine accepts Buffer/base64 in form-data values.
• accounting:dataexchange, accounting:dxso-jobs, accounting:extf-files, HR / Lohn, DMS, addressee: separate adapters per product line.
• The datev_idp_next security option (next-gen signin.datev.de/datevam/... IdP) is defined in the spec but not yet exposed here.