How do AI agents use Digits through Open Connector?

Your user connects Digits once with one of its cataloged authentication methods. Open Connector stores the credential in an encrypted vault and exposes Digits tools to your agent over MCP or a typed API, with credentials injected server-side on each call.

Is this a Digits MCP server?

Yes. Open Connector can serve Digits as a named MCP server with a scoped allowlist and a per-user connection URL, so any MCP client can call Digits actions with credentials injected server-side.

Where do Digits credentials live?

In your own infrastructure. Open Connector keeps credentials in its own vault and injects them at call time, so they never leave your environment.

Digits integration

Digits integration for AI agents.

Digits integration for AI agents with secure authentication and server-side credential injection. Open Connector runs the OAuth, seals the token in an encrypted vault, and serves Digits tools to your agent over MCP or a typed API — credentials injected server-side, every call audited, nothing leaving your infrastructure. Open source (AGPL-3.0) and self-hostable.

View source on GitHub All integrations →

What your agents can do

Real Digits actions, managed and audited.

Your user connects Digits once; your agent can then secure AI-agent actions — scoped to the OAuth permissions you grant and the tool allowlist you configure. Every action is least-privilege and written to a tamper-evident audit trail.

1
Your user grants Digits access once (OAuth) — the token lands in the vault.
2
Your agent calls a tool over MCP or the typed API; Open Connector injects the credential server-side.
3
Every routed call appends a hash-chained audit record — nothing leaves your infra.

Tools & triggers

Supported Digits tools.

88 tools are generated from the published Digits catalog. Descriptions are plain text; each action remains subject to its configured authentication and tool allowlist.

Showing 88 tools. All published catalog entries are included in this page's server-rendered HTML.

Token Exchange: Exchange an authorization code for a refresh token, or a refresh token for a new access token.; AuthorizationService
Bulk Create Client Employees: Create or reactivate multiple client employees' access across multiple client organizations in a single request. Users and client organizations must already exist. This operation is synchronous. An entry for an already-active employee binding succeeds without changing access when the request matches existing access; otherwise, that entry fails with AlreadyExists. Use Update Client Employee to fully replace access for active employee bindings. When reactivating an employee, supplied roles are applied and access omitted from the entry is not removed. Requires scope: `organization:sync`.; ClientEmployeeService
Bulk Delete Client Employees: Remove employee access across multiple client organizations by Digits-assigned user ID or caller-assigned user ID. Maximum 100 per request. Removes matching client employee bindings and entity-role bindings for those clients' entities. Underlying users and affiliation/client roles are not deleted. Requires scope: `organization:sync`.; ClientEmployeeService
Create Client Employee: Create or reactivate a client employee's access to a client organization. Both the user and client organization must already exist. This operation is synchronous. If the client employee binding already exists and is active, the request fails with AlreadyExists; use Update Client Employee to fully replace access for an active employee binding. When reactivating a client employee, supplied roles are applied and access omitted from the request is not removed. Requires scope: `organization:sync`.; ClientEmployeeService
Delete Client Employee: Remove a client employee's access to a client organization. Removes the client employee binding in the client organization and entity-role bindings for that client's entities. The underlying user and affiliation/client roles are not deleted. Requires scope: `organization:sync`.; ClientEmployeeService
Get Client Employee: Get a single client employee within a client organization by their Digits-assigned user ID.; ClientEmployeeService
List Client Employees: List all client employees with access to a client organization.; ClientEmployeeService
Update Client Employee: Replace a client employee's access within a client organization. The client employee binding must already exist and be active. If it does not exist or is not active, the request fails with NotFound; use Create Client Employee to create or reactivate access. This operation is synchronous and declarative: the client employee's organization role and entity-role bindings within this client organization are replaced by the request body. Requires scope: `organization:sync`.; ClientEmployeeService
Bulk Delete Client Entities: Delete multiple client entities by Digits-assigned ID or caller-assigned ID. Maximum 100 per request. Removes all employee entity-role bindings for the specified entities. Requires scope: `organization:sync`.; ClientEntityService
Create Client Entity: Create a new entity within a client organization. The entity object is created synchronously, but data provisioning completes asynchronously. Requires scope: `organization:sync`.; ClientEntityService
Delete Client Entity: Delete an entity within a client organization. Removes all employee entity-role bindings for this entity. Requires scope: `organization:sync`.; ClientEntityService
Get Client Entity: Get a single entity within a client organization by its Digits-assigned ID.; ClientEntityService
List Client Entities: List all entities within a client organization.; ClientEntityService
Create Client Payment Instrument: Create or update a payment instrument owned by a client entity.; ClientPaymentInstrumentService
Delete Client Payment Instruments: Delete client payment instruments by Digits-assigned or caller-assigned IDs. Unknown IDs are skipped. A deleted payment instrument becomes unavailable for any future payments; any in-flight payments continue to use it.; ClientPaymentInstrumentService
Query Client Payment Instruments: Find client payment instruments by Digits-assigned or caller-assigned IDs.; ClientPaymentInstrumentService
Get Company Info: Read endpoint to get company information, including fiscal year start month and earliest transaction date.; CompanyService
List Sources: List all connection sources.; ConnectionSourceService
Sync Sources: Sync endpoint to create, update, and delete connection sources. Connection sources organize transactions (for example, by bank account; or to separate bills and invoices) Labels allow seamless reference to the chart of accounts within the Ledger.; ConnectionSourceService
Create Entity Payment Instrument: Create or update a payment instrument owned by an organization entity. The entity's first instrument becomes its default funding instrument; an existing default is never overwritten.; EntityPaymentInstrumentService
Delete Entity Payment Instruments: Delete entity payment instruments by Digits-assigned or caller-assigned IDs. Unknown IDs are skipped. A deleted payment instrument becomes unavailable for any future payments; any in-flight payments continue to use it.; EntityPaymentInstrumentService
Query Entity Payment Instruments: Find entity payment instruments by Digits-assigned or caller-assigned IDs.; EntityPaymentInstrumentService
Get Category: Get a single category by its ID.; LedgerCategoryService
List Categories: Fetch the full Chart of Accounts from the Ledger.; LedgerCategoryService
Get Department: Get a single ledger department by its ID.; LedgerDepartmentService
List Departments: List ledger departments.; LedgerDepartmentService
Get Location: Get a single ledger location by its ID.; LedgerLocationService
List Locations: List ledger locations.; LedgerLocationService
Get Party: Get a single ledger party by its ID.; LedgerPartyService
List Parties: List ledger parties.; LedgerPartyService
Get Project: Get a single ledger project by its ID.; LedgerProjectService
List Projects: List ledger projects.; LedgerProjectService
A/P Aging: Generate an accounts payable aging report.; LedgerStatementsService
A/R Aging: Generate an accounts receivable aging report.; LedgerStatementsService
Balance Sheet: Generate a balance sheet statement.; LedgerStatementsService
Cash Flow: Generate a cash flow statement.; LedgerStatementsService
Profit and Loss: Generate a profit and loss statement.; LedgerStatementsService
Trial Balance: Generate a trial balance statement.; LedgerStatementsService
Get Summary: Get a summary of ledger transactions.; LedgerSummaryService
List Entries: List ledger entries.; LedgerTransactionService
Get Transaction: Get a ledger transaction by its ID.; LedgerTransactionService
Query Entries: Query ledger entries.; LedgerTransactionService
Bulk Create Clients: Provision multiple client organizations in a single request. Maximum 100 entities total across all clients per request. Each client is created synchronously, but entity data provisioning completes asynchronously. Requires scope: `organization:sync`.; OrganizationClientService
Bulk Delete Clients: Delete multiple client organizations by Digits-assigned ID or caller-assigned ID. Maximum 100 per request. Client organizations and their entities are removed. Employee bindings in each client organization and entity-role bindings on each client's entities are removed. Users are not deleted. Requires scope: `organization:sync`.; OrganizationClientService
Create Client: Provision a new client organization with one or more entities. The client and entity objects are created synchronously, but data provisioning for each entity completes asynchronously. Requires scope: `organization:sync`.; OrganizationClientService
Delete Client: Delete a client organization managed by the caller's organization. The client organization and its entities are removed. Employee bindings in the client organization and entity-role bindings on the client's entities are removed. Users are not deleted. Requires scope: `organization:sync`.; OrganizationClientService
Get Client: Get a single client organization by its Digits-assigned ID.; OrganizationClientService
List Clients: List all client organizations affiliated with the organization.; OrganizationClientService
Bulk Delete Employees: Delete multiple employee bindings by Digits-assigned user ID or caller-assigned user ID. Maximum 100 per request. Deletes matching employee bindings and removes their entity-role and client-role bindings. Underlying users are not deleted. Requires scope: `organization:sync`.; OrganizationEmployeeService
Create Employee: Create or reactivate an employee binding. The user must already exist (either provisioned via SSO or as an existing Digits user). This operation is synchronous. If the employee binding already exists and is active, the request fails with AlreadyExists; use Update Employee to fully replace access for an active employee binding. When reactivating an employee, supplied roles are applied and access omitted from the request is not removed. Requires scope: `organization:sync`.; OrganizationEmployeeService
Delete Employee: Delete an employee binding in the caller's organization. Removes all of the employee's entity-role and client-role bindings. The underlying user is not deleted. Requires scope: `organization:sync`.; OrganizationEmployeeService
Get Employee: Get a single employee by their Digits-assigned ID.; OrganizationEmployeeService
List Employees: List all employees in the organization.; OrganizationEmployeeService
Update Employee: Fully replace an employee binding. The user must already exist and have an active employee binding. The request must identify the employee by Digits-assigned ID or caller-assigned user ID, include the employee's organization role, and may include entity access (`entities` and/or `entityRole`), client access (`clients` and/or `clientRole`), or both. `entityRole` and `clientRole` are stored as employee-level defaults for future entities or client entities and are applied to current access unless explicit `entities` or `clients` entries override them. Access omitted from the request is removed. Requires scope: `organization:sync`.; OrganizationEmployeeService
Create Entity: Create a new entity within the organization. The entity object is created synchronously, but data provisioning (chart of accounts, etc.) completes asynchronously. Requires scope: `organization:sync`.; OrganizationEntityService
Delete Entity: Delete an entity. Deleting an entity also removes all employee access bindings for that entity. Requires scope: `organization:sync`.; OrganizationEntityService
Get Entity: Get a single entity by its Digits-assigned ID.; OrganizationEntityService
List Entities: List all entities in the organization.; OrganizationEntityService
Get Organization: Returns the caller's organization, including its Digits-assigned ID and, when set, its caller-assigned ID.; OrganizationService
List Departments: List the departments provided by this source.; SourceDepartmentService
Sync Departments: Batch sync endpoint to create, update, and delete departments. Idempotence and deduplication is handled via the external_id field on each department.; SourceDepartmentService
List Locations: List the locations provided by this source.; SourceLocationService
Sync Locations: Batch sync endpoint to create, update, and delete locations. Idempotence and deduplication is handled via the external_id field on each location.; SourceLocationService
Store Samples: Batch endpoint to store time series metric samples.; SourceMetricService
List Parties: List the parties provided by this source.; SourcePartyService
Sync Parties: Batch sync endpoint to create, update, and delete parties. Idempotence and deduplication is handled via the external_id field on each party.; SourcePartyService
List Products: List the products provided by this source.; SourceProductService
Sync Products: Batch sync endpoint to create, update, and delete products. Idempotence and deduplication is handled via the external_id field on each product.; SourceProductService
List Projects: List the projects provided by this source.; SourceProjectService
Sync Projects: Batch sync endpoint to create, update, and delete projects. Idempotence and deduplication is handled via the external_id field on each project.; SourceProjectService
Delete Transactions: Delete transactions by external ID.; SourceTransactionService
Sync Transactions: Batch sync endpoint to create or update transactions. Idempotence and deduplication is handled via the external_id field on each transaction.; SourceTransactionService
Audit SSO Users: Audit all SSO users in the organization with their current client organization access.; SSOAuditService
Get SSO Config: Returns the SSO configuration for the organization. The organization must have SSO previously configured.; SSOConfigService
Bulk Delete SSO Users: Delete multiple SSO users by Digits-assigned ID or caller-assigned ID. The organization must have SSO configured. Removes each user and their employee and entity access from the organization and its client organizations. This operation is synchronous. Requires scope: `user:sync`.; SSOUserService
Create SSO User: Create a new SSO user. The organization must have SSO configured. A deleted user is reactivated when recreated by the same identity provider, whether under the previous subject identifier or a new one. Recreation from a different identity provider is rejected. Returns the Digits-assigned ID and caller-assigned ID mapping. This operation is synchronous. Requires scope: `user:sync`.; SSOUserService
Delete SSO User: Delete an SSO user. The organization must have SSO configured. Removes the user and their employee and entity access from the organization and its client organizations. This operation is synchronous. Requires scope: `user:sync`.; SSOUserService
Get SSO User: Get a single SSO user by their Digits-assigned ID. The organization must have SSO configured.; SSOUserService
List SSO Users: List all SSO users in the organization. The organization must have SSO configured.; SSOUserService
Approve Workflow Bills: Approve one or more bills awaiting approval. Requires scope: `bills:manage`.; WorkflowBillService
Delete Workflow Bills: Delete one or more pre-approval bills. Requires scope: `bills:manage`.; WorkflowBillService
Get Workflow Bill: Get a workflow bill by its Digits-assigned ID. Requires scope: `bills:manage`.; WorkflowBillService
Pay Workflow Bills: Pay one or more approved bills, either through Digits-managed payment rails or by recording an external/manual payment. Requires scope: `bills:manage`.; WorkflowBillService
Query Workflow Bills: Query workflow bills visible to the caller. Requires scope: `bills:manage`.; WorkflowBillService
Reject Workflow Bills: Reject one or more bills awaiting approval. Requires scope: `bills:manage`.; WorkflowBillService
Submit Workflow Bills: Submit one or more draft bills for approval. Requires scope: `bills:manage`.; WorkflowBillService
Update Workflow Bill Payment Status: Report externally managed payment lifecycle updates for one or more bills. Requires scope: `bills:manage`.; WorkflowBillService
Void Workflow Bills: Void one or more eligible bills. Requires scope: `bills:manage`.; WorkflowBillService

FAQ

Digits integration, answered

How do AI agents use Digits through Open Connector?: Your user connects Digits once with one of its cataloged authentication methods. Open Connector stores the credential in an encrypted vault and exposes Digits tools to your agent over MCP or a typed API, with credentials injected server-side on each call.
Is this a Digits MCP server?: Yes. Open Connector can serve Digits as a named MCP server with a scoped allowlist and a per-user connection URL, so any MCP client can call Digits actions with credentials injected server-side.
Where do Digits credentials live?: In your own infrastructure. Open Connector keeps credentials in its own vault and injects them at call time, so they never leave your environment.

Give your agents Digits — keep the keys.

Open source, self-hostable, with Digits credentials that never leave your infrastructure. Run it from source today.

View source on GitHub How the MCP gateway works →