xero-ruby 2.9.0 → 3.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c675f5570117bebac6707f82b0c2e45f96fd534ba4dbb8a2d2babc8adbdf1661
-  data.tar.gz: 810b2d8317158471ab824cb1a8cba37cd19f3f36a48096012953c2142c26452d
+  metadata.gz: 318fb48f176b7958600aff1846180a94028bcafd1802e7620622c5bfaa3598a9
+  data.tar.gz: 3d6cf058f85c0ab341932ae6ca4f838a6915a8fb2f75dcd45269cf9d5bbdeee0
 SHA512:
-  metadata.gz: eff76c0592c7bcdfb8f60b8b97407bb523d21b6ca3f9ad5e6c8c858bee3415c630a7ede34f50c2ed7d1b1717d349165cb751b4a56f6562c666d44f698a951f70
-  data.tar.gz: f46138e8871e805d640a456089c901b597656aee376c13099c5dc8bc28e610250c811742f6978fe56d4835e405f9bee66510276e8ed94e63074fd18e9d5557f1
+  metadata.gz: 06d8ad44f3611f0d4c403916ff8f67c456225d8dca591c9ef7a25062fbcd77c638f5ffd6c408d63a0dac5307d1ecc9d5e274bdc9c22b517273363dc6859f4517
+  data.tar.gz: 4556718e67afd15190357406cba150b83cb901bbbfd677752a12a10053dd400167d23b7fc373a6e1dd987c2fef5be9467ddfd8b2df944e3d6180ac79a737ae12

data/README.md

@@ -5,45 +5,36 @@ Xero Ruby SDK for OAuth 2.0 generated from [Xero API OpenAPI Spec](https://githu
 
 # Documentation
 Xero Ruby SDK supports Xero's OAuth2.0 authentication and the following Xero API sets.
-
-## SDK Documentation
+### API Client Documentation
 * [API client methods](https://xeroapi.github.io/xero-ruby/accounting/index.html)
----
-## API Model Docs
-* [Accounting Models](/docs/accounting)
-* [Asset Api Docs](/docs/assets/)
-* [Project Api Docs](docs/projects/)
-* [Files Api Docs](docs/files/)
-* [Payroll Docs (AU)](docs/payroll_au/)
-* [Payroll Docs (NZ)](docs/payroll_nz/)
-* [Payroll Docs (UK)](docs/payroll_uk/)
-
+> This describes to ~200+ accounting API endpoints and their expected params. There are also method reference docs for the Assets, Files, Projects, and Payroll endpoints sets, though we are still working on accurately generating usable parameter examples for all! (feedback welcome)
+### Model Docs
+* [Models](/docs/)
+> Directory of markdown files, describing the object models for the Accounting, Asset, Projects, Files, Payroll (AU, UK, NZ) Xero API sets.
 ## Sample Apps
-We have two apps showing SDK usage.
-* https://github.com/XeroAPI/xero-ruby-oauth2-starter (**Sinatra** - session based / getting started)
-* https://github.com/XeroAPI/xero-ruby-oauth2-app (**Rails** - token management / full examples)
+We have two sample apps showing SDK usage:
+* https://github.com/XeroAPI/xero-ruby-oauth2-starter (**Sinatra** - bare minimum to hello world and simple session based storage)
+* https://github.com/XeroAPI/xero-ruby-oauth2-app (**Rails** - token management with robust usage examples)
 
 ![sample-app](https://i.imgur.com/OOEn55G.png)
 
----
+## Xero Pre-Requisites
+* Create a [free Xero user account](https://www.xero.com/us/signup/api/)
+* Login to your Xero developer [/myapps](https://developer.xero.com/myapps) dashboard & create an API application
+* Copy the credentials from your API app and store/access them using a secure ENV variable strategy
+* Resaearch and include the [neccesary scopes](https://developer.xero.com/documentation/oauth2/scopes) for your app's functionality as a space-seperated list, ex. "`SCOPES="openid profile email accounting.transactions accounting.settings"`"
 ## Installation
-To install this gem to your current gemset.
+To install this gem to your project:
 ```
 gem install 'xero-ruby'
 ```
-Or add to your gemfile and run `bundle install`.
+Or more commonly in Ruby on Rails usage add to your gemfile and run `bundle install`:
 ```
 gem 'xero-ruby'
 ```
 
-## Getting Started
-* Create a [free Xero user account](https://www.xero.com/us/signup/api/)
-* Login to your Xero developer [/myapps](https://developer.xero.com/myapps) dashboard & create an API application and note your API app's credentials.
-
-### Creating a client
-* Get the credential values from an API application at https://developer.xero.com/myapps/.
-* Include [neccesary scopes](https://developer.xero.com/documentation/oauth2/scopes) as a space-seperated list
-    * example => "`openid profile email accounting.transactions accounting.settings`"
+---
+## Usage
 ```
 require 'xero-ruby'
 ```
@@ -58,56 +49,77 @@ creds = {
 xero_client ||= XeroRuby::ApiClient.new(credentials: creds)
 ```
 
-If you want additional logging or timeout, you can add/override any configuration option by passing the optional named parameter object `config`.
+For additional logging or timeout, add or override any [config](/lib/xero-ruby/configuration.rb) option by passing an optional named parameter `config: {..}`.
 ```ruby
 config = { timeout: 30, debugging: true }
 @xero_client ||= XeroRuby::ApiClient.new(credentials: creds, config: config)
 ```
 
-## User Authorization & Callback
-All API requests require a valid access token to be set on the client.
+## OAuth2.0 Authorization & Callback
+All API requests require a valid access token to be set on the xero_client.
 
-To generate a valid `token_set` send a user to the `authorization_url`:
+### Step 1
+Send the user to the `authorization_url` after you have configured your xero_client
 ```ruby
 @authorization_url = xero_client.authorization_url
 
 redirect_to @authorization_url
 ```
 
-Xero will then redirect back to the URI defined in your `redirect_uri` config.
-
-*This must match **exactly** with the variable in your /myapps dashboard.*
-
-In your callback, calling `get_token_set_from_callback` will exchange the temporary code Xero return, with a valid `token_set` that you can use to make API calls.
+### Step 2
+On successful authorization, Xero identity will redirect to the URI defined in your `redirect_uri` config which must match **exactly** with the variable in your /myapps dashboard.
+```
+=> /oauth/redirect_uri
+```
+### Step 3
+In your server defined callback route, exchange the temporary code for a valid `token_set` that will get set on your client. 
 ```ruby
-# => http://localhost:3000/oauth/callback
-
 token_set = xero_client.get_token_set_from_callback(params)
+```
+At this point you should save the token_set as JSON in a datastore in relation to the authenticating user or entity.
 
-# save token_set JSON in a datastore in relation to the user authentication
-
-puts params['state']
-=> "this-can-be-a-custom-state-parameter"
+The sample [Rails app](https://github.com/XeroAPI/xero-ruby-oauth2-app/blob/master/app/controllers/application_controller.rb#L11) shows a solid pattern you can tweak to fit your needs:
+```ruby
+# /oauth/redirect_uri -> 'application#callback'
+def callback
+  @token_set = @xero_client.get_token_set_from_callback(params)
+
+  current_user.token_set = @token_set
+  current_user.token_set['connections'] = @xero_client.connections
+  current_user.active_tenant_id = latest_connection(current_user.token_set['connections'])
+  current_user.save!
+  flash.notice = "Successfully authenticated with Xero!"
+end
 ```
+---
+### What is a Token Set?
+A `token_set` is what we call the XeroAPI response that contains data about your API connection:
+```json
+{
+  "id_token": "xxx.yyy.zz", (if you requested `openid profile email` scope)
+  "access_token": "xxx.yyy.zzz",
+  "expires_in": 1800,
+  "token_type": "Bearer",
+  "refresh_token": "xxxxxx", (if you requested `offline_access` scope)
+  "scope": "email profile openid accounting.transactions offline_access"
+}
+```
+
+Note that an `access_token` is valid for 30 minutes but a `refresh_token` can be used once in up to a 60 day window. If a refresh_token is used to refresh access you must replace the entire token_set.
 
-## Making API calls once you have a token_set
-Once you already have a token_set stored from this initual user interaction, you can setup a new client by passing the whole token_set to `refresh_token_set` or `set_token_set`.
+Both the `id_token` & `access_token` are JWT's, and can be decoded to see additional metadata described in the Token Helpers section:
+## Making API calls with a valid token_set
+After the initial user interaction you can simply setup a xero_client by passing the whole token_set to the client.
 ```ruby
 xero_client.set_token_set(user.token_set)
 
 xero_client.refresh_token_set(user.token_set)
-# this will set the access_token on the client, and return a refreshed `token_set` you need to save.
 ```
-A `token_set` contains data about your API connection most importantly :
-* `access_token`
-* `refresh_token`
-* `expiry`
-
-**An `access_token` is valid 30 minutes and a `refresh_token` is valid for 60 days**
-
-Example Token set:
-> You can decode the `id_token` & `access_token` for additional metadata by using a [decoding library](https://github.com/jwt/ruby-jwt):
-```json
+This sets the access_token on the client, and returns a refreshed `token_set` that you should save in your datastore for the next time you need to connect to Xero's API.
+## Token Helpers
+```ruby
+xero_client.token_set
+=>
 {
   "id_token": "xxx.yyy.zz",
   "access_token": "xxx.yyy.zzz",
@@ -116,17 +128,63 @@ Example Token set:
   "refresh_token": "xxxxxx",
   "scope": "email profile openid accounting.transactions offline_access"
 }
-```
 
-## Token & SDK Helpers
-Refresh/connection helpers
+xero_client.access_token
+=> "xxx.yyy.zzz"
+
+xero_client.decoded_access_token
+=> {
+    "exp": 1619715843,
+    "xero_userid": "xero-user-uuid",
+    "scope": [
+      "email",
+      "profile",
+      "openid",
+      "accounting.transactions",
+      "offline_access"
+    ]
+  }
+
+
+xero_client.id_token
+=> "aaa.bbb.ccc"
+
+xero_client.decoded_id_token
+=> {
+    "iss": "https://identity.xero.com",
+    "email": "luca.pacioli@accounting-services.com",
+    "given_name": "Luca",
+    "family_name": "Pacioli"
+  }
+
+xero_client.set_token_set(token_set)
+=> true
+
+xero_client.get_token_set_from_callback(callback_url_params)
+=> new_xero_token_set
+
+xero_client.refresh_token_set(token_set)
+=> new_xero_token_set
+
+# These are automatically populated with `set_token_set`
+# But if you need to set just an access or id token on the client
+xero_client.set_access_token(access_token)
+xero_client.set_id_token(id_token)
+
+# Automatically run on initial OAuth flow - can be called its own if desired
+# Read about why we have included this in the default library: https://auth0.com/docs/tokens/access-tokens/validate-access-tokens
+xero_client.validate_tokens(token_set)
+xero_client.decode_jwt(tkn)
+```
+# Connection Helpers
 ```ruby
-@token_set = xero_client.refresh_token_set(user.token_set)
+xero_client.authorization_url
+=> # https://login.xero.com/identity/connect/authorize?response_type=code&client_id=<client_id>&redirect_uri=<redirect_uri>&scope=<scopes>&state=<my-state>
 
-# Xero's tokens can potentially facilitate (n) org connections in a single token.
-# It is important to store the `tenantId` of the Organisation your user wants to read/write data.
+# To completely Revoke a user's access token and all their connections
+xero_client.revoke_token(token_set)
 
-# The `updatedDateUtc` will show you the most recently authorized Tenant (AKA Organisation)
+# In case there are > 1 tenants connected the `updatedDateUtc` will show you the most recently authorized tenant (aka organisation) - it is important to store the `tenantId` of the Org your user specified in their API authorization
 connections = xero_client.connections
 [{
   "id" => "xxx-yyy-zzz",
@@ -137,38 +195,19 @@ connections = xero_client.connections
   "updatedDateUtc" => "2020-04-15T22:37:10.4943410"
 }]
 
-# To completely Revoke a user's access token and all their connections
-# pass in the users token set to the #revoke_token api_client method
-
-xero_client.revoke_token(user.token_set)
-
-# disconnect an org from a user's connections. Pass the connection ['id'] not ['tenantId'].
-# Useful if you want to enforce only a single org connection per token.
+# To disconnect a single org from a user's active connections pass the connection ['id'] (not ['tenantId'])
+# If you want to enforce only a single org connection per token do this prior to sending user through Xero authorize flow a 2nd time.
 remaining_connections = xero_client.disconnect(connections[0]['id'])
 
-# set a refreshed token_set
-token_set = xero_client.set_token_set(user.token_set)
-
-# access token_set once it is set on the client
-token_set = xero_client.token_set
-```
-
-Example token expiry helper
-```ruby
-require 'jwt'
-
-def token_expired?
-  token_expiry = Time.at(decoded_access_token['exp'])
-  token_expiry < Time.now
-end
+xero_client.token_expired?
+=> true || false
 
-def decoded_access_token
-  JWT.decode(token_set['access_token'], nil, false)[0]
-end
+# This will check against the following logic
+token_expiry = Time.at(decoded_access_token['exp'])
+token_expiry < Time.now
 ```
 
-## API Usage
-
+# API Usage
 ### Accounting API
 > https://xeroapi.github.io/xero-ruby/accounting/index.html
 ```ruby
@@ -177,7 +216,7 @@ require 'xero-ruby'
 xero_client.refresh_token_set(user.token_set)
 
 tenant_id = user.active_tenant_id
-# example of how to store the `tenantId` of the specific tenant (aka organisation)
+# Example 'active tenant' logic storage of the tenant the user specified, xero_client.connections[0] is not a safe assumption in case they authorized multiple orgs.
 
 # Get Accounts
 accounts = xero_client.accounting_api.get_accounts(tenant_id).accounts
@@ -186,10 +225,13 @@ accounts = xero_client.accounting_api.get_accounts(tenant_id).accounts
 invoices = { invoices: [{ type: XeroRuby::Accounting::Invoice::ACCREC, contact: { contact_id: contacts[0].contact_id }, line_items: [{ description: "Big Agency", quantity: BigDecimal("2.0"), unit_amount: BigDecimal("50.99"), account_code: "600", tax_type: XeroRuby::Accounting::TaxType::NONE }], date: "2019-03-11", due_date: "2018-12-10", reference: "Website Design", status: XeroRuby::Accounting::Invoice::DRAFT }]}
 invoice = xero_client.accounting_api.create_invoices(tenant_id, invoices).invoices.first
 
-# display out all the serialized data as a hash
+# display out all the serialized data as a snake_case hash
 puts invoices.to_attributes
 => {type: 'ACCREC', line_items: [...]}
 
+puts invoices.to_hash(downcase: false)
+=> {'Type': 'ACCREC', 'LineItems': [...]}
+
 # Create History
 payment = xero_client.accounting_api.get_payments(tenant_id).payments.first
 history_records = { history_records: [{ details: "This payment now has some History!" }]}
@@ -331,19 +373,13 @@ opts = {
 }
 xero_client.accounting_api.get_bank_transfers(tenant_id, opts).bank_transfers
 ```
-### NOTE
+
 1) Not all `opts` parameter combinations are available for all endpoints, and there are likely some undiscovered edge cases. If you encounter a filter / sort / where clause that seems buggy open an issue and we will dig.
 
 2) Some opts string values may need PascalCasing to match casing defined in our [core API docs](https://developer.xero.com/documentation/api/api-overview).
 * `opts = { order: 'UpdatedDateUtc DESC'}`
 
 3) If you have use cases outside of these examples let us know.
-
-## Sample App
-The best resource to understanding how to best leverage this SDK is the sample applications showing all the features of the gem.
-> https://github.com/XeroAPI/xero-ruby-oauth2-starter (Sinatra - simple getting started)
-> https://github.com/XeroAPI/xero-ruby-oauth2-app (Rails - full featured examples)
-
 ## Developing locally
 To develop this gem locally against your project you can use the following development pattern:
 

data/lib/xero-ruby/api/accounting_api.rb

@@ -7728,6 +7728,7 @@ module XeroRuby
     # @option opts [Array<String>] :i_ds Filter by a comma separated list of ContactIDs. Allows you to retrieve a specific set of contacts in a single call.
     # @option opts [Integer] :page e.g. page&#x3D;1 - Up to 100 contacts will be returned in a single API call.
     # @option opts [Boolean] :include_archived e.g. includeArchived&#x3D;true - Contacts with a status of ARCHIVED will be included in the response
+    # @option opts [Boolean] :summary_only Use summaryOnly&#x3D;true in GET Contacts and Invoices endpoint to retrieve a smaller version of the response object. This returns only lightweight fields, excluding computation-heavy fields from the response, making the API calls quick and efficient. (default to false)
     # @return [Contacts]
     def get_contacts(xero_tenant_id, opts = {})
       data, _status_code, _headers = get_contacts_with_http_info(xero_tenant_id, opts)
@@ -7743,6 +7744,7 @@ module XeroRuby
     # @option opts [Array<String>] :i_ds Filter by a comma separated list of ContactIDs. Allows you to retrieve a specific set of contacts in a single call.
     # @option opts [Integer] :page e.g. page&#x3D;1 - Up to 100 contacts will be returned in a single API call.
     # @option opts [Boolean] :include_archived e.g. includeArchived&#x3D;true - Contacts with a status of ARCHIVED will be included in the response
+    # @option opts [Boolean] :summary_only Use summaryOnly&#x3D;true in GET Contacts and Invoices endpoint to retrieve a smaller version of the response object. This returns only lightweight fields, excluding computation-heavy fields from the response, making the API calls quick and efficient.
     # @return [Array<(Contacts, Integer, Hash)>] Contacts data, response status code and response headers
     def get_contacts_with_http_info(xero_tenant_id, options = {})
       opts = options.dup
@@ -7766,6 +7768,7 @@ module XeroRuby
       query_params[:'IDs'] = @api_client.build_collection_param(opts[:'i_ds'], :csv) if !opts[:'i_ds'].nil?
       query_params[:'page'] = opts[:'page'] if !opts[:'page'].nil?
       query_params[:'includeArchived'] = opts[:'include_archived'] if !opts[:'include_archived'].nil?
+      query_params[:'summaryOnly'] = opts[:'summary_only'] if !opts[:'summary_only'].nil?
       
       # XeroAPI's `IDs` convention openapi-generator does not snake_case properly.. manual over-riding `i_ds` malformations:
       query_params[:'IDs'] = @api_client.build_collection_param(opts[:'ids'], :csv) if !opts[:'ids'].nil?
@@ -9386,6 +9389,7 @@ module XeroRuby
     # @option opts [Integer] :page e.g. page&#x3D;1 – Up to 100 invoices will be returned in a single API call with line items shown for each invoice
     # @option opts [Boolean] :include_archived e.g. includeArchived&#x3D;true - Invoices with a status of ARCHIVED will be included in the response
     # @option opts [Boolean] :created_by_my_app When set to true you&#39;ll only retrieve Invoices created by your app
+    # @option opts [Boolean] :summary_only Use summaryOnly&#x3D;true in GET Contacts and Invoices endpoint to retrieve a smaller version of the response object. This returns only lightweight fields, excluding computation-heavy fields from the response, making the API calls quick and efficient. (default to false)
     # @option opts [Integer] :unitdp e.g. unitdp&#x3D;4 – (Unit Decimal Places) You can opt in to use four decimal places for unit amounts
     # @return [Invoices]
     def get_invoices(xero_tenant_id, opts = {})
@@ -9406,6 +9410,7 @@ module XeroRuby
     # @option opts [Integer] :page e.g. page&#x3D;1 – Up to 100 invoices will be returned in a single API call with line items shown for each invoice
     # @option opts [Boolean] :include_archived e.g. includeArchived&#x3D;true - Invoices with a status of ARCHIVED will be included in the response
     # @option opts [Boolean] :created_by_my_app When set to true you&#39;ll only retrieve Invoices created by your app
+    # @option opts [Boolean] :summary_only Use summaryOnly&#x3D;true in GET Contacts and Invoices endpoint to retrieve a smaller version of the response object. This returns only lightweight fields, excluding computation-heavy fields from the response, making the API calls quick and efficient.
     # @option opts [Integer] :unitdp e.g. unitdp&#x3D;4 – (Unit Decimal Places) You can opt in to use four decimal places for unit amounts
     # @return [Array<(Invoices, Integer, Hash)>] Invoices data, response status code and response headers
     def get_invoices_with_http_info(xero_tenant_id, options = {})
@@ -9434,6 +9439,7 @@ module XeroRuby
       query_params[:'page'] = opts[:'page'] if !opts[:'page'].nil?
       query_params[:'includeArchived'] = opts[:'include_archived'] if !opts[:'include_archived'].nil?
       query_params[:'createdByMyApp'] = opts[:'created_by_my_app'] if !opts[:'created_by_my_app'].nil?
+      query_params[:'summaryOnly'] = opts[:'summary_only'] if !opts[:'summary_only'].nil?
       query_params[:'unitdp'] = opts[:'unitdp'] if !opts[:'unitdp'].nil?
       
       # XeroAPI's `IDs` convention openapi-generator does not snake_case properly.. manual over-riding `i_ds` malformations:

data/lib/xero-ruby/api_client.rb

@@ -17,6 +17,7 @@ require 'find'
 require 'faraday'
 require 'base64'
 require 'cgi'
+require 'json/jwt'
 
 module XeroRuby
   class ApiClient
@@ -38,7 +39,8 @@ module XeroRuby
       @redirect_uri = credentials[:redirect_uri]
       @scopes = credentials[:scopes]
       @state = credentials[:state]
-      @config = append_to_default_config(config)
+      default_config = Configuration.default.clone
+      @config = append_to_default_config(default_config, config)
 
       @user_agent = "xero-ruby-#{VERSION}"
       @default_headers = {
@@ -47,9 +49,9 @@ module XeroRuby
       }
     end
 
-    def append_to_default_config(user_config)
-      config = Configuration.default
-      user_config.each{|k,v| config.send("#{k}=", v) } if user_config
+    def append_to_default_config(default_config, user_config)
+      config = default_config
+      user_config.each{|k,v| config.send("#{k}=", v)}
       config
     end
 
@@ -96,22 +98,41 @@ module XeroRuby
 
     # Token Helpers
     def token_set
-      XeroRuby.configure.token_set
+      @config.token_set
     end
 
     def access_token
-      XeroRuby.configure.access_token
+      @config.access_token
+    end
+
+    def id_token
+      @config.id_token
+    end
+
+    def decoded_access_token
+      decode_jwt(@config.access_token, false)
+    end
+
+    def decoded_id_token
+      decode_jwt(@config.id_token, false)
     end
 
     def set_token_set(token_set)
-      # helper to set the token_set on a client once the user
-      # has a valid token set ( access_token & refresh_token )
-      XeroRuby.configure.token_set = token_set
-      set_access_token(token_set['access_token'])
+      token_set = token_set.with_indifferent_access
+      @config.token_set = token_set
+
+      set_access_token(token_set[:access_token]) if token_set[:access_token]
+      set_id_token(token_set[:id_token]) if token_set[:id_token]
+      
+      return true
     end
 
     def set_access_token(access_token)
-      XeroRuby.configure.access_token = access_token
+      @config.access_token = access_token
+    end
+
+    def set_id_token(id_token)
+      @config.id_token = id_token
     end
 
     def get_token_set_from_callback(params)
@@ -120,20 +141,59 @@ module XeroRuby
         code: params['code'],
         redirect_uri: @redirect_uri
       }
-      return token_request(data, '/token')
+      token_set = token_request(data, '/token')
+
+      validate_tokens(token_set)
+      validate_state(params)
+      return token_set
+    end
+
+    def validate_tokens(token_set)
+      token_set = token_set.with_indifferent_access
+      id_token = token_set[:id_token]
+      access_token = token_set[:access_token]
+      if id_token || access_token
+        decode_jwt(access_token) if access_token
+        decode_jwt(id_token) if id_token
+      end
+      return true
+    end
+
+    def validate_state(params)
+      if params[:state] != @state
+        raise StandardError.new "WARNING: @config.state: #{@state} and OAuth callback state: #{params['state']} do not match!"
+      end
+      return true
+    end
+
+    def decode_jwt(tkn, verify=true)
+      if verify == true
+        jwks_data = JSON.parse(Faraday.get('https://identity.xero.com/.well-known/openid-configuration/jwks').body)
+        jwk_set = JSON::JWK::Set.new(jwks_data)
+        JSON::JWT.decode(tkn, jwk_set)
+      else
+        JSON::JWT.decode(tkn, :skip_verification)
+      end
+    end
+
+    def token_expired?
+      token_expiry = Time.at(decoded_access_token['exp'])
+      token_expiry < Time.now
     end
 
     def refresh_token_set(token_set)
+      token_set = token_set.with_indifferent_access
       data = {
         grant_type: 'refresh_token',
-        refresh_token: token_set['refresh_token']
+        refresh_token: token_set[:refresh_token]
       }
       return token_request(data, '/token')
     end
 
     def revoke_token(token_set)
+      token_set = token_set.with_indifferent_access
       data = {
-        token: token_set['refresh_token']
+        token: token_set[:refresh_token]
       }
       return token_request(data, '/revocation')
     end
@@ -182,7 +242,26 @@ module XeroRuby
         :client_key => @config.ssl_client_key
       }
 
-      connection = Faraday.new(:url => config.base_url, :ssl => ssl_options) do |conn|
+      case api_client
+      when "AccountingApi"
+        method_base_url = @config.accounting_url
+      when "AssetApi"
+        method_base_url = @config.asset_url
+      when "FilesApi"
+       method_base_url = @config.files_url
+      when "PayrollAuApi"
+        method_base_url = @config.payroll_au_url
+      when "PayrollNzApi"
+        method_base_url = @config.payroll_nz_url
+      when "PayrollUkApi"
+        method_base_url = @config.payroll_uk_url
+      when "ProjectApi"
+        method_base_url = @config.project_url
+      else
+        method_base_url = @config.accounting_url
+      end
+
+      connection = Faraday.new(:url => method_base_url, :ssl => ssl_options) do |conn|
         conn.basic_auth(config.username, config.password)
         if opts[:header_params]["Content-Type"] == "multipart/form-data"
           conn.request :multipart
@@ -265,7 +344,8 @@ module XeroRuby
         end
       end
       request.headers = header_params
-      request.options.timeout = @config.timeout
+      timeout = @config.timeout
+      request.options.timeout = timeout if timeout > 0
       request.body = req_body
       request.url url
       request.params = query_params