Airwallex Spend and Issuing vs Expensify

Airwallex Spend and Issuing

Scoped API keys split read from write per resource, tokens last 30 minutes, and the sandbox opens at once with no contract. No OpenAPI spec was found, every Spend endpoint read is marked beta, the pricing page lists direct Spend API integration under the custom-priced Accelerate plan, and no SLA was found.

Expensify

One endpoint exports reports through caller-written templates and creates expenses, reports, rules and workspace settings, with limits of 5 requests per 10 seconds published and a status page that tracks the API separately. There is no OpenAPI spec, changelog, SDK, pagination or idempotency key, and one credential pair carries the whole account's rights.

Airwallex Spend and Issuing

1. Exchange x-client-id and x-api-key at POST /api/v1/authentication/login once, then reuse the bearer token for 30 minutes. The login endpoint allows 100 requests a minute per key
2. Create Spend keys with organisation-level permissions. With a key linked to several accounts, send x-login-as at login or the token carries no account permissions
3. Send a fresh UUID as request_id on every create call and reuse the same value when retrying after a timeout
4. Expect two pagination styles. Spend and card transaction events use the page bookmark with page_after and page_before. Cards and legacy transactions use page_num and has_more
5. Card and expense lists default to the last 30 days. Pass both created-at bounds to read further back, and fetch a card singly to see its authorization_controls

Expensify

1. POST requestJobDescription as a form field to the single endpoint. Keep it out of the URL query string, because it carries the secret
2. Read responseCode in the body on every reply. HTTP status can be 200 on failure, and validation errors use 410
3. Stay under 5 requests per 10 seconds and 20 per 60 seconds. No Retry-After header is documented, so space retries yourself
4. Export in two calls. A file job returns a filename, then a download job fetches it. Amounts are in cents
5. Don't retry a create job blindly. No idempotency key exists, so export and check before resending. Set dry-run to true when testing the Advanced Employee Updater