@lunch-money/v2-api-spec 2.11.1-preview.13 → 2.11.1-preview.14

package/lunch-money-api-v2.yaml

@@ -2712,8 +2712,11 @@ components:
           type: array
           nullable: false
           description: A list of objects that describe any attachments to the
-            transaction. This is only present when the `include_files` query
-            parameter is set to true.
+            transaction. For OAuth clients, this property is available only
+            with the `transaction_attachments:read` scope. Without that scope,
+            an absent `files` property does not mean the transaction has no
+            attachments. See the operation description for its attachment
+            behavior.
           items:
             $ref: "#/components/schemas/transactionAttachmentObject"
         source:
@@ -3008,7 +3011,10 @@ components:
           type: array
           nullable: false
           description: A list of objects that describe any attachments to the
-            transaction
+            transaction. OAuth clients also need the
+            `transaction_attachments:read` scope. Without it, this property is
+            omitted rather than returned as an empty array, so an absent
+            `files` property does not mean the transaction has no attachments.
           items:
             $ref: "#/components/schemas/transactionAttachmentObject"
       required:
@@ -5136,11 +5142,11 @@ components:
             manual_accounts:delete: "Delete manually managed accounts"
             plaid_accounts:read: "View accounts connected through Plaid"
             plaid_accounts:update: "Request a Plaid account refresh, which may import new transactions"
-            transactions:read: "View transactions, including split and group information and attachment metadata"
+            transactions:read: "View transactions, including split and group information"
             transactions:create: "Create transactions"
             transactions:update: "Update, split, unsplit, group, and ungroup transactions"
             transactions:delete: "Delete transactions"
-            transaction_attachments:read: "Get download access to transaction attachments"
+            transaction_attachments:read: "View transaction attachment metadata and get download access to attachments"
             transaction_attachments:create: "Attach files to transactions"
             transaction_attachments:delete: "Delete transaction attachments"
             tags:read: "View tags"
@@ -9667,6 +9673,9 @@ paths:
           description: By default, the `files` property is not included in the
             response. Set to true if you'd like the responses to include a list
             of objects that describe any files attached to the transactions.
+            OAuth clients must have both `transactions:read` and
+            `transaction_attachments:read`; otherwise the request returns a
+            `403` `insufficient_scope` error.
         - name: limit
           in: query
           schema:
@@ -9950,7 +9959,10 @@ paths:
         successfully inserted.<br>
         - `skipped_duplicates`: A list of
         transactions that were duplicates of existing transactions and were not
-        inserted.
+        inserted.<p>
+
+        For OAuth clients, returned transactions include the `files` property
+        only when the client has the `transaction_attachments:read` scope.
       operationId: createNewTransactions
       security:
         - bearerSecurity: []
@@ -10394,7 +10406,10 @@ paths:
 
         Each transaction in the array **must** include an `id` property to identify which transaction to update, along with at least one other property to be updated. For example, a transaction object that contains only an `id` and `category_id` property is valid.<br><br>
         
-        The request can include between 1 and 500 transactions to update in a single call.
+        The request can include between 1 and 500 transactions to update in a single call.<br><br>
+
+        For OAuth clients, returned transactions include the `files` property
+        only when the client has the `transaction_attachments:read` scope.
       operationId: updateTransactions
       security:
         - bearerSecurity: []
@@ -10877,7 +10892,8 @@ paths:
         added to transactions that were inserted or updated via the API.
 
         - `files` will be a list of objects that describe any attachments to the
-        transaction.
+        transaction. For OAuth clients, this property is included only when the
+        client has the `transaction_attachments:read` scope.
 
 
         If `is_group_parent` is true in the returned transaction, the object will also
@@ -11132,7 +11148,11 @@ paths:
         It is also possible to provide only the properties to be updated in the
         request body, as long as the request includes at least one of the
         properties that is not listed above. For example a request body that contains only
-        an `category_id` attribute is valid.
+        an `category_id` attribute is valid.<br><br>
+
+        For OAuth clients, the returned transaction includes the `files`
+        property only when the client has the
+        `transaction_attachments:read` scope.
         
       operationId: updateTransaction
       security:
@@ -11348,7 +11368,11 @@ paths:
         transaction. The grouped transactions will
 
         be included in the `children` property of the transaction returned in
-        the response
+        the response.<br><br>
+
+        For OAuth clients, the returned group and its children include the
+        `files` property only when the client has the
+        `transaction_attachments:read` scope.
       operationId: groupTransactions
       security:
         - bearerSecurity: []
@@ -11701,7 +11725,11 @@ paths:
 
         To see the details of the original parent transaction after it has been
         split, use the `GET /transactions/{id}` endpoint and pass the value of
-        the `split_parent_id` of one of the children.
+        the `split_parent_id` of one of the children.<br><br>
+
+        For OAuth clients, the returned parent and its children include the
+        `files` property only when the client has the
+        `transaction_attachments:read` scope.
       operationId: splitTransaction
       security:
         - bearerSecurity: []

package/oauth-scopes/catalog.js

@@ -172,7 +172,7 @@ const scopeDefinitions = [
     },
     {
         name: 'transactions:read',
-        description: 'View transactions, including split and group information and attachment metadata',
+        description: 'View transactions, including split and group information',
         category: 'api',
         operationIds: ['getAllTransactions', 'getTransactionById'],
         status: 'active',
@@ -200,7 +200,7 @@ const scopeDefinitions = [
     },
     {
         name: 'transaction_attachments:read',
-        description: 'Get download access to transaction attachments',
+        description: 'View transaction attachment metadata and get download access to attachments',
         category: 'api',
         operationIds: ['getTransactionAttachmentUrl'],
         status: 'active',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunch-money/v2-api-spec",
-  "version": "2.11.1-preview.13",
+  "version": "2.11.1-preview.14",
   "description": "OpenAPI specification and version history for the Lunch Money v2 API",
   "main": "lunch-money-api-v2.yaml",
   "exports": {