Changes to MYOB API Scopes
MYOB have recently introduced a change to the authentication scopes for MYOB Business API integrations commencing 1 September 2026. They are replacing the CompanyFile scope with more granular scopes to enhance data privacy and security. They have also removed access to the Company Files endpoint for cloud hosted MYOB files. The URL:
https://api.myob.com/accountright/
no longer returns a list of company files.
All MYOB Business API integrations must be updated to use the new granular scopes before 1 September 2026.
We have released an updated version of fmAccounting Link (MYOB AccountRight Edition) - v2.3 - that supports authenticating with the new granular scopes. If you are still within the 12 month period of complimentary updates from the date of purchase, or you have purchased another 12 months of maintenance updates, you can download this using the download link from your original order confirmation email. If you created an account when placing your order on our website you can also login to your Databuzz account to access your downloads.
You can purchase another 12 months of updates one year after your initial purchase or at any subsequent stage. This allows you to stay up-to-date with any changes to the MYOB Business API as well as new features added to the fmAccounting Link file.
Here is a summary of the changes you will need to make - you can copy/paste these from the v2.3 file which contains these updates.
Interface table: we added a new fieldBusinessName to store the Business Name returned during the authentication flow
Granular Scopes: you will need to update the MYOB Authentication - OAuth 2.0 Start script. Copy the calculation for the $url variable which contains the new granular scopes as well as the prompt=consent parameter.
You will also need to update the script MYOB Authentication - OAuth 2.0 Complete which has been updated to retrieve thebusinessId and businessName parameters returned in the redirect URI. It has also been updated to create a new record in the CompanyFiles table if required and set this as the selected Company. We recommend replacing the contents of this script completely as the calculation for the $state variable has also been updated.
Company Files: the GET request for Company Files no longer returns a list of company files. We've updated the GET All Company Files script to not run when the APIType field is set to 'Cloud'. For Cloud hosted files the authentication flow now creates the CompanyFiles record for the file you selected during the authentication flow.
OAuth Flow Authentication: once you have made the changes above you will need to re-authenticate with the MYOB Business API to get a new access token that uses the new granular scopes before 1 September 2026! You will notice a change in the contents of the Web Viewer which will now list out the granular scopes:
There are no changes required here - please ensure your re-authenticate with the new granular scopes before 1 September 2026 to avoid any disruption to your integration.
You can get more information about these changes on the MYOB website here: