@lunch-money/developer-docs 2.11.1-preview.8 → 2.11.2-preview.1

package/v2/spec/lunch-money-api-v2.yaml

@@ -4,9 +4,9 @@ info:
   description: |-
     ### Introduction
 
-    Welcome to the Lunch Money v2 API reference. This is the **v2.11.1** spec.
+    Welcome to the Lunch Money v2 API reference. This is the **v2.11.2** spec.
 
-    The API is available at `https://api.lunchmoney.dev/v2`. Get your access token from the [Lunch Money developers page](https://my.lunchmoney.app/developers).
+    The API is available at `https://api.lunchmoney.dev/v2`. Use a personal access token from the [Lunch Money Developers page](https://my.lunchmoney.app/developers) for API exploration or work with your own budgeting account. Applications built for other Lunch Money users should use an [OAuth access token issued after the user authorizes the application](https://lunchmoney.dev/oauth).
 
     
     **Try it from these docs**
@@ -2712,8 +2712,11 @@ components:
           type: array
           nullable: false
           description: A list of objects that describe any attachments to the
-            transaction. This is only present when the `include_files` query
-            parameter is set to true.
+            transaction. For OAuth clients, this property is available only
+            with the `transaction_attachments:read` scope. Without that scope,
+            an absent `files` property does not mean the transaction has no
+            attachments. See the operation description for its attachment
+            behavior.
           items:
             $ref: "#/components/schemas/transactionAttachmentObject"
         source:
@@ -3008,7 +3011,10 @@ components:
           type: array
           nullable: false
           description: A list of objects that describe any attachments to the
-            transaction
+            transaction. OAuth clients also need the
+            `transaction_attachments:read` scope. Without it, this property is
+            omitted rather than returned as an empty array, so an absent
+            `files` property does not mean the transaction has no attachments.
           items:
             $ref: "#/components/schemas/transactionAttachmentObject"
       required:
@@ -5099,9 +5105,58 @@ components:
     bearerSecurity:
       type: http
       description: >-
-        Required for the LIVE server. Optional for MOCK.
+        A Lunch Money personal access token. Required for the LIVE server and
+        optional for MOCK.
       scheme: bearer
       bearerFormat: JWT
+    oauth2Security:
+      type: oauth2
+      description: >-
+        An OAuth 2.0 access token issued to a registered Lunch Money app.
+        Each operation lists the scope required to call it.
+      flows:
+        authorizationCode:
+          authorizationUrl: https://api.lunchmoney.dev/oauth/authorize
+          tokenUrl: https://api.lunchmoney.dev/oauth/token
+          scopes:
+            offline_access: "Allow this app to maintain access without asking you to sign in and authorize it again"
+            me:read: "View your Lunch Money identity and account, user, and budget settings"
+            me:update: "Update your Lunch Money account, user, and budget settings"
+            summary:read: "View your budget summary"
+            categories:read: "View categories and category groups"
+            categories:create: "Create categories and category groups"
+            categories:update: "Update categories and category groups"
+            categories:delete: "Delete categories and category groups"
+            crypto_manual:read: "View supported cryptocurrencies and manually managed cryptocurrency balances"
+            crypto_manual:create: "Add supported cryptocurrencies and create manually managed cryptocurrency balances"
+            crypto_manual:update: "Update manually managed cryptocurrency balances"
+            crypto_manual:delete: "Delete manually managed cryptocurrency balances"
+            crypto_synced:read: "View synced cryptocurrency accounts and balances"
+            crypto_synced:update: "Refresh balances for synced cryptocurrency accounts"
+            balance_history:read: "View balance history for accounts and synced cryptocurrency balances"
+            balance_history:update: "Create or update balance history and details for deleted accounts"
+            balance_history:delete: "Delete balance history for accounts and synced cryptocurrency balances"
+            manual_accounts:read: "View manually managed accounts"
+            manual_accounts:create: "Create manually managed accounts"
+            manual_accounts:update: "Update manually managed accounts"
+            manual_accounts:delete: "Delete manually managed accounts"
+            plaid_accounts:read: "View accounts connected through Plaid"
+            plaid_accounts:update: "Request a Plaid account refresh, which may import new transactions"
+            transactions:read: "View transactions, including split and group information"
+            transactions:create: "Create transactions"
+            transactions:update: "Update, split, unsplit, group, and ungroup transactions"
+            transactions:delete: "Delete transactions"
+            transaction_attachments:read: "View transaction attachment metadata and get download access to attachments"
+            transaction_attachments:create: "Attach files to transactions"
+            transaction_attachments:delete: "Delete transaction attachments"
+            tags:read: "View tags"
+            tags:create: "Create tags"
+            tags:update: "Update tags"
+            tags:delete: "Delete tags"
+            recurring_items:read: "View recurring items"
+            budgets:read: "View budget period settings"
+            budgets:update: "Create or update budget amounts"
+            budgets:delete: "Delete budget amounts"
 
 paths:
   /me:
@@ -5120,6 +5175,10 @@ paths:
         Properties such as `primary_currency` and `budget_name` remain on this
         response for backwards compatibility.
       operationId: getMe
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - me:read
       parameters: []
       responses:
         "200":
@@ -5151,6 +5210,10 @@ paths:
         Returns settings for the current budgeting account. These settings apply
         regardless of which user is accessing the account.
       operationId: getAccountSettings
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - me:read
       responses:
         "200":
           description: Account settings for the current budgeting account
@@ -5186,6 +5249,10 @@ paths:
         provide only the properties to update. The request body must include at
         least one property.
       operationId: updateAccountSettings
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - me:update
       requestBody:
         required: true
         content:
@@ -5229,6 +5296,10 @@ paths:
         These settings apply across every budgeting account the user owns or
         collaborates on.
       operationId: getUserSettings
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - me:read
       responses:
         "200":
           description: User settings for the authorized user
@@ -5266,6 +5337,10 @@ paths:
         Amount fields in API responses always use positive values for debits and
         negative values for credits.
       operationId: updateUserSettings
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - me:update
       requestBody:
         required: true
         content:
@@ -5311,6 +5386,10 @@ paths:
         budgeting account. These settings do not affect other users or the
         authorized user's settings in other budgeting accounts.
       operationId: getUserAccountSettings
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - me:read
       responses:
         "200":
           description: Settings for the authorized user in the current budgeting
@@ -5340,6 +5419,10 @@ paths:
         provide only the properties to update. The request body must include at
         least one property.
       operationId: updateUserAccountSettings
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - me:update
       requestBody:
         required: true
         content:
@@ -5394,6 +5477,10 @@ paths:
         budget objects.
       
       operationId: getBudgetSummary
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - summary:read
       parameters:
         - in: query
           name: start_date
@@ -5909,6 +5996,10 @@ paths:
       description: Retrieve a list of all categories associated with the user's
         account.
       operationId: getAllCategories
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - categories:read
       parameters:
         - name: format
           in: query
@@ -6156,6 +6247,10 @@ paths:
         this case, the `children` attribute may be set to an array of category
         IDs to add to the newly created category group.
       operationId: createCategory
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - categories:create
       requestBody:
         required: true
         content:
@@ -6261,6 +6356,10 @@ paths:
       description: Retrieve details of a specific category or category group by
         its ID.
       operationId: getCategoryById
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - categories:read
       parameters:
         - name: id
           in: path
@@ -6399,6 +6498,10 @@ paths:
 
         It is possible to modify the children of an existing category group with this API by setting the `children` attribute. If this is set, it will replace the existing children with the newly specified children. If the intention is to add or remove a single category, it is more straightforward to update the child category by specifying the new `group_id` attribute. If the goal is to add multiple new children or remove multiple existing children, it is recommended to first call the `GET /categories/{id}` endpoint to get the existing children and then modify the list as desired.<br><br>
       operationId: updateCategory
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - categories:update
       parameters:
         - name: id
           in: path
@@ -6551,6 +6654,10 @@ paths:
         recurring items, etc. If there are dependents, this endpoint will return
         an object that describes the number and type of existing dependencies.
       operationId: deleteCategory
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - categories:delete
       parameters:
         - in: path
           name: id
@@ -6634,6 +6741,10 @@ paths:
         Retrieve the list of cryptocurrencies currently supported for manual tracking.<p>
         When creating a new manual crypto balance via `POST /crypto/manual`, the `symbol` you specify must match the `symbol` of one of the entries returned by this endpoint.
       operationId: getAllCryptocurrencies
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - crypto_manual:read
       responses:
         "200":
           description: A list of supported cryptocurrencies
@@ -6670,6 +6781,10 @@ paths:
         - crypto-manual
       summary: Add a new supported cryptocurrency
       operationId: createCryptocurrency
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - crypto_manual:create
       description: |-
         Adds a new cryptocurrency to the supported manual-crypto list.<br><br>
         Lunch Money uses [CoinGecko](https://www.coingecko.com/us/coins/ethereum) to convert crypto balances to the user's primary currency. Users add a new supported cryptocurrency by submitting a CoinGecko coin-page URL. The server validates the URL, extracts the id from `/coins/{id}`, checks for an existing supported `coingecko_id`, validates the id against CoinGecko, then confirms the resolved symbol is not already supported before creating the new entry.
@@ -6754,6 +6869,10 @@ paths:
       description: |-
         Retrieve all manually managed crypto balances associated with the user's account.
       operationId: getAllCryptoManual
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - crypto_manual:read
       responses:
         "200":
           description: A list of manual crypto balances
@@ -6790,6 +6909,10 @@ paths:
         Create a manually managed crypto asset.<br><br>
         If `display_name` is `null`, clients may derive one from `institution_name` + `name`.
       operationId: createCryptoManual
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - crypto_manual:create
       requestBody:
         required: true
         content:
@@ -6876,6 +6999,10 @@ paths:
       description: |-
         Retrieve a single manually managed crypto balance by ID.
       operationId: getCryptoManualById
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - crypto_manual:read
       parameters:
         - name: id
           in: path
@@ -6946,6 +7073,10 @@ paths:
         Modify a manually managed crypto balance.<br><br>
         You may submit the response from `GET /crypto/manual/{id}` as the request body. System-defined properties are accepted according to the `x-updatable` metadata in the update schema.
       operationId: updateCryptoManual
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - crypto_manual:update
       parameters:
         - name: id
           in: path
@@ -7044,6 +7175,10 @@ paths:
       description: |-
         Delete a single manually managed crypto asset by ID.<p> If this crypto asset has a balance history, and you do not explicitly set the query parameter`keep_history`, a 422 response will be returned requesting you to explicitly set `keep_history` to `true` or `false`.
       operationId: deleteCryptoManual
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - crypto_manual:delete
       parameters:
         - name: id
           in: path
@@ -7110,6 +7245,10 @@ paths:
       description: |-
         Retrieves all synced crypto accounts associated with the user's account.
       operationId: getAllCryptoSynced
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - crypto_synced:read
       responses:
         "200":
           description: A list of synced crypto accounts
@@ -7173,6 +7312,10 @@ paths:
       description: |-
         Retrieves the synced crypto account and all nested balances for the specified synced crypto account ID.
       operationId: getCryptoSyncedById
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - crypto_synced:read
       parameters:
         - name: id
           in: path
@@ -7254,6 +7397,10 @@ paths:
       description: |-
         Retrieves a single balance from the specified synced crypto account using the crypto symbol.
       operationId: getCryptoSyncedBalanceBySymbol
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - crypto_synced:read
       parameters:
         - name: id
           in: path
@@ -7334,6 +7481,10 @@ paths:
       description: |-
         Trigger a balance refresh for the specified synced crypto account. Returns the refreshed synced crypto account.
       operationId: refreshCryptoSynced
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - crypto_synced:update
       parameters:
         - name: id
           in: path
@@ -7414,6 +7565,10 @@ paths:
         &nbsp;&nbsp;&nbsp;&nbsp;- `crypto_manual`: `source.crypto_manual_id` with [GET /crypto/manual/{id}](#tag/crypto-manual/GET/crypto/manual/{id})<br>
         &nbsp;&nbsp;&nbsp;&nbsp;- `crypto_synced`: `source.crypto_synced_id` and `source.symbol` with [GET /crypto/synced/{id}/{symbol}](#tag/crypto-synced/GET/crypto/synced/{id}/{symbol})
       operationId: getBalanceHistory
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - balance_history:read
       parameters:
         - name: start_month
           in: query
@@ -7669,6 +7824,10 @@ paths:
         The `account_type` path parameter identifies the account family (`manual`, `plaid`, `crypto_manual`, or `deleted`) and `account_id` identifies the account within that family.<br><br>
         `start_month`, `end_month`, and current-month entries behave as described in [GET /balance_history](#tag/balance-history/GET/balance_history).
       operationId: getBalanceHistoryForAccount
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - balance_history:read
       parameters:
         - name: account_type
           in: path
@@ -7805,6 +7964,10 @@ paths:
         `crypto_balance` may be provided for `crypto_manual` and `deleted` accounts. It is invalid for `manual` or `plaid` accounts.<br><br>
         The response contains only the `type: historical` balance entries that were submitted in this request.
       operationId: upsertBalanceHistoryForAccount
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - balance_history:update
       parameters:
         - name: account_type
           in: path
@@ -8001,6 +8164,10 @@ paths:
       description: |-
         Delete all historical balance entries for a single manual, Plaid, manual crypto, or deleted account. For synced crypto symbol streams, use [DELETE /balance_history/crypto_synced/{account_id}/{symbol}](#tag/balance-history/DELETE/balance_history/crypto_synced/{account_id}/{symbol}).
       operationId: deleteBalanceHistoryForAccount
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - balance_history:delete
       parameters:
         - name: account_type
           in: path
@@ -8047,6 +8214,10 @@ paths:
         The path selects one balance stream with a synced crypto account id and `symbol`.<br><br>
         `start_month`, `end_month`, and current-month entries behave as described in [GET /balance_history](#tag/balance-history/GET/balance_history).
       operationId: getBalanceHistoryForCryptoSynced
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - balance_history:read
       parameters:
         - name: account_id
           in: path
@@ -8155,6 +8326,10 @@ paths:
         `crypto_balance` may be provided for synced crypto balances.<br><br>
         The response contains only the `type: historical` balance entries that were submitted in this request.
       operationId: upsertBalanceHistoryForCryptoSynced
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - balance_history:update
       parameters:
         - name: account_id
           in: path
@@ -8299,6 +8474,10 @@ paths:
         Delete all historical balance entries for a single synced crypto symbol stream.<br><br>
         The path identifies both the synced crypto account and the symbol whose history should be deleted.
       operationId: deleteBalanceHistoryForCryptoSynced
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - balance_history:delete
       parameters:
         - name: account_id
           in: path
@@ -8342,6 +8521,10 @@ paths:
       description: |-
         Delete a single stored (`type: historical`) monthly balance history entry by its id. Ephemeral `current` entries cannot be deleted this way.
       operationId: deleteBalanceHistoryEntry
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - balance_history:delete
       parameters:
         - name: id
           in: path
@@ -8388,6 +8571,10 @@ paths:
         Update archived metadata for a deleted balance history source.<br><br>
         Pass the `deleted_account_id` from a `source.type: deleted` entry. The update applies to all historical entries associated with that deleted source.
       operationId: updateBalanceHistoryDetails
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - balance_history:update
       parameters:
         - name: account_id
           in: path
@@ -8459,6 +8646,10 @@ paths:
       description: Retrieve a list of all manually-managed accounts associated
         with the user's account.
       operationId: getAllManualAccounts
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - manual_accounts:read
       responses:
         "200":
           description: A list of manual accounts
@@ -8534,6 +8725,10 @@ paths:
       summary: Create a manual account
       description: Create a new manually-managed account.
       operationId: createManualAccount
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - manual_accounts:create
       requestBody:
         required: true
         content:
@@ -8668,6 +8863,10 @@ paths:
       description: Retrieve the details of the manual account with the specified
         ID.
       operationId: getManualAccountById
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - manual_accounts:read
       parameters:
         - name: id
           in: path
@@ -8752,6 +8951,10 @@ paths:
         properties that is not listed above. For example a request body that contains only a `name` property is valid.<br><br>
 
       operationId: updateManualAccount
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - manual_accounts:update
       parameters:
         - name: id
           in: path
@@ -8895,6 +9098,10 @@ paths:
         property set to this account's ID they will appear with a warning when
         displayed in the web view.
       operationId: deleteManualAccount
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - manual_accounts:delete
       parameters:
         - in: path
           name: id
@@ -8954,6 +9161,10 @@ paths:
       description: Retrieve a list of all synced accounts associated with the
         user's account.
       operationId: getAllPlaidAccounts
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - plaid_accounts:read
       responses:
         "200":
           description: A list of accounts synced via Plaid
@@ -9060,6 +9271,10 @@ paths:
       description: Retrieve the details of the plaid account with the specified
         ID.
       operationId: getPlaidAccountById
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - plaid_accounts:read
       parameters:
         - name: id
           in: path
@@ -9157,6 +9372,10 @@ paths:
         contacts the associated financial institution. The `last_import` field
         is updated only when new transactions have been imported.
       operationId: triggerPlaidAccountFetch
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - plaid_accounts:update
       parameters:
         - name: start_date
           in: query
@@ -9242,6 +9461,10 @@ paths:
         account. <br>If called with no parameters, this endpoint will return the
         most recent transactions, up to the specified `limit`.
       operationId: getAllTransactions
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - transactions:read
       parameters:
         - name: start_date
           in: query
@@ -9450,6 +9673,9 @@ paths:
           description: By default, the `files` property is not included in the
             response. Set to true if you'd like the responses to include a list
             of objects that describe any files attached to the transactions.
+            OAuth clients must have both `transactions:read` and
+            `transaction_attachments:read`; otherwise the request returns a
+            `403` `insufficient_scope` error.
         - name: limit
           in: query
           schema:
@@ -9733,8 +9959,15 @@ paths:
         successfully inserted.<br>
         - `skipped_duplicates`: A list of
         transactions that were duplicates of existing transactions and were not
-        inserted.
+        inserted.<p>
+
+        For OAuth clients, returned transactions include the `files` property
+        only when the client has the `transaction_attachments:read` scope.
       operationId: createNewTransactions
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - transactions:create
       requestBody:
         required: true
         content:
@@ -10173,8 +10406,15 @@ paths:
 
         Each transaction in the array **must** include an `id` property to identify which transaction to update, along with at least one other property to be updated. For example, a transaction object that contains only an `id` and `category_id` property is valid.<br><br>
         
-        The request can include between 1 and 500 transactions to update in a single call.
+        The request can include between 1 and 500 transactions to update in a single call.<br><br>
+
+        For OAuth clients, returned transactions include the `files` property
+        only when the client has the `transaction_attachments:read` scope.
       operationId: updateTransactions
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - transactions:update
       requestBody:
         required: true
         content:
@@ -10543,6 +10783,10 @@ paths:
         
         <span class="red-text"><strong>Use with caution. This action is not reversible!</strong></span>
       operationId: deleteTransactions
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - transactions:delete
       requestBody:
         required: true
         content:
@@ -10648,7 +10892,8 @@ paths:
         added to transactions that were inserted or updated via the API.
 
         - `files` will be a list of objects that describe any attachments to the
-        transaction.
+        transaction. For OAuth clients, this property is included only when the
+        client has the `transaction_attachments:read` scope.
 
 
         If `is_group_parent` is true in the returned transaction, the object will also
@@ -10659,6 +10904,10 @@ paths:
         include the `children` property which will contain a list
         of the split transactions.
       operationId: getTransactionById
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - transactions:read
       parameters:
         - name: id
           in: path
@@ -10899,9 +11148,17 @@ paths:
         It is also possible to provide only the properties to be updated in the
         request body, as long as the request includes at least one of the
         properties that is not listed above. For example a request body that contains only
-        an `category_id` attribute is valid.
+        an `category_id` attribute is valid.<br><br>
+
+        For OAuth clients, the returned transaction includes the `files`
+        property only when the client has the
+        `transaction_attachments:read` scope.
         
       operationId: updateTransaction
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - transactions:update
       parameters:
         - name: id
           in: path
@@ -11036,6 +11293,10 @@ paths:
 
         <span class="red-text"><strong>Use with caution. This action is not reversible!</strong></span>
       operationId: deleteTransactionById
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - transactions:delete
       parameters:
         - in: path
           name: id
@@ -11107,8 +11368,16 @@ paths:
         transaction. The grouped transactions will
 
         be included in the `children` property of the transaction returned in
-        the response
+        the response.<br><br>
+
+        For OAuth clients, the returned group and its children include the
+        `files` property only when the client has the
+        `transaction_attachments:read` scope.
       operationId: groupTransactions
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - transactions:update
       requestBody:
         required: true
         content:
@@ -11401,6 +11670,10 @@ paths:
         The transactions within the group are not removed and will subsequently
         be treated as "normal" ungrouped transactions.
       operationId: ungroupTransactions
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - transactions:update
       parameters:
         - in: path
           name: id
@@ -11452,8 +11725,16 @@ paths:
 
         To see the details of the original parent transaction after it has been
         split, use the `GET /transactions/{id}` endpoint and pass the value of
-        the `split_parent_id` of one of the children.
+        the `split_parent_id` of one of the children.<br><br>
+
+        For OAuth clients, the returned parent and its children include the
+        `files` property only when the client has the
+        `transaction_attachments:read` scope.
       operationId: splitTransaction
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - transactions:update
       parameters:
         - name: id
           in: path
@@ -11655,6 +11936,10 @@ paths:
         Use the value of the `split_parent_id`property of a split transaction to
         specify the parent ID.
       operationId: unsplitTransaction
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - transactions:update
       parameters:
         - in: path
           name: id
@@ -11696,6 +11981,10 @@ paths:
         - transactions (files)
       summary: Attach a file to a transaction
       operationId: attachFileToTransaction
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - transaction_attachments:create
       description: |-
         Attaches a file to a transaction. The file must be less than 10MB in size.<br><br> The file will be attached to the transaction and can be downloaded from the link returned by a `GET /transactions/attachments/{file_id}` request.
       parameters:
@@ -11783,6 +12072,10 @@ paths:
       description: |-
         Returns a signed url that can be used to download the file attachment.
       operationId: getTransactionAttachmentUrl
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - transaction_attachments:read
       tags:
         - transactions (files)
       parameters:
@@ -11836,6 +12129,10 @@ paths:
     delete:
       summary: Delete a file attachment
       operationId: deleteTransactionAttachment
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - transaction_attachments:delete
       description: >-
         Deletes a file attachment from a transaction.
       tags:
@@ -11881,6 +12178,10 @@ paths:
       description: Retrieve a list of all tags associated with the user's
         account.
       operationId: getAllTags
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - tags:read
       responses:
         "200":
           description: A list of tags
@@ -11951,6 +12252,10 @@ paths:
       summary: Create a new tag
       description: Creates a new tag with the given name
       operationId: createTag
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - tags:create
       requestBody:
         required: true
         content:
@@ -12018,6 +12323,10 @@ paths:
       summary: Get a single tag
       description: Retrieve the details of a specific tag with the specified ID.
       operationId: getTagById
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - tags:read
       parameters:
         - name: id
           in: path
@@ -12097,6 +12406,10 @@ paths:
         properties that is not listed above. For example, a request body that contains only a
         `name` attribute is valid.
       operationId: updateTag
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - tags:update
       parameters:
         - name: id
           in: path
@@ -12200,6 +12513,10 @@ paths:
         returned and the tag is not deleted. This behavior can be overridden by
         setting the `force` parameter to `true`.
       operationId: deleteTag
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - tags:delete
       parameters:
         - in: path
           name: id
@@ -12263,6 +12580,10 @@ paths:
       summary: Get all recurring items
       description: Retrieve recurring items for a specified time frame.
       operationId: getAllRecurring
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - recurring_items:read
       parameters:
         - name: start_date
           in: query
@@ -12406,6 +12727,10 @@ paths:
       description: Retrieve the details of a specific recurring item with the
         specified ID.
       operationId: getRecurringById
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - recurring_items:read
       parameters:
         - name: id
           in: path
@@ -12522,6 +12847,10 @@ paths:
         budget preferences such as currency and locale, see
         [/me/account/settings](#tag/me/GET/me/account/settings).
       operationId: getBudgetSettings
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - budgets:read
       responses:
         "200":
           description: Budget period settings for the current budget
@@ -12550,6 +12879,10 @@ paths:
         Use the [/budgets/settings](#tag/budgets/GET/budgets/settings) endpoint to view the budget period settings for the account.<br>
         To view details for existing budgets, use the [summary](#tag/summary) endpoint.
       operationId: upsertBudget
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - budgets:update
       requestBody:
         required: true
         content:
@@ -12622,6 +12955,10 @@ paths:
         the account's budget settings.<br> To view details for existing budgets,
         use the [summary](#tag/summary) endpoint.
       operationId: deleteBudget
+      security:
+        - bearerSecurity: []
+        - oauth2Security:
+            - budgets:delete
       parameters:
         - in: query
           name: category_id