Airwallex Spend and Issuing

# Fix list: Airwallex Spend and Issuing

From Anchor Terminal's listing at https://www.anchorterminal.com/tools/airwallex, the October 2026 research run, assessed 8 October 2026. Grade B, 68.3 out of 100.

This is everything the published grade says the listing lacks, the biggest possible gain to the total first. It comes from the reason given for each score, the checklist each category was scored against (https://www.anchorterminal.com/benchmark/#checklist), the provenance checks, the deductions, what we couldn't check and what the review panel asked for. A fix counts at the next check, once it's public.

For a coding agent working on Airwallex Spend and Issuing: work through the items below in the product, its docs and its public pages. Each category gives the reason for its score, with the points each checklist item earned, and the checklist itself, so the gap is the items that earned less than their points. Change the product, not the wording, and keep a note of what you changed and where it's published.

## 1. Payments & pricing, 25 out of 100, up to 9.4 more on the total

Why it scored 25: Read with the hosted rubric. No x402, MPP or L402 was found in the docs or on the pricing page (0). US plan prices are public, Explore at $0 with up to 10 free Spend users and Grow at $12 per active Spend user a month. The pricing page lists direct Spend API integration with an ERP under Accelerate, which is priced on request, and sends platform API use to sales, so half the plan-pricing credit (5 of 20). A sandbox account opens at once from a form asking for email, name, country and password, with no payment card and no contract, and the Explore plan is free (20). A person has to sign up in a browser and create a key in the web app or complete an OAuth sign-in. The Docs MCP server needs no account but answers docs questions only (0).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-payments):

The published rubric, also on the [x402 page](https://www.anchorterminal.com/x402/).

- 40, a machine payment protocol (x402, MPP or L402) on the tool's own endpoints. 10 to 30 when it covers only some endpoints or only goes through a third party, and the note says which.
- 20, per-call or per-unit pricing published without a login. 10 for public plan-only pricing, 0 for "contact sales" or prices behind a login.
- 20, a free tier or trial that doesn't need a card.
- 20, autonomous onboarding, meaning an agent can get access without a person signing up in a browser (keyless use, x402, a programmatic key API).

Payment platforms and agent wallets rarely charge for their own API over a machine protocol, so the first line has steps for them, and the highest one that applies counts. 40 when x402, MPP or L402 runs on all their own endpoints, 30 when it runs on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, and 0 when the only protocol is their own. Merchant acceptance sits above a facilitator because the platform's own customers can charge agents through it, while a facilitator settles for sellers who wire up the protocol themselves. The counter-argument (a facilitator does more for the protocol as a whole) has a point. Each note says which step applied.

Open-source software you run yourself is scored on its hosted or paid option if it has one. A free, self-hosted package with nothing to buy gets 20, 20 and 20 for the last three lines, and 0 to 40 for the first only if it ships a payment protocol.

## 2. Schema & documentation, 69 out of 100, up to 5 more on the total

Why it scored 69: No public OpenAPI spec was found. The paths we tried under /docs/api return the docs shell, and the CLI prints one endpoint's schema with `--api-schema-only`. Each endpoint has a structured Markdown reference page, which earns part credit (6 of 25). llms.txt at /docs/llms.txt and a Markdown twin of every guide and reference page (10). Endpoint and field descriptions state purpose, and deprecated endpoints name their replacement. Few say when not to call (14 of 20). Fields carry types, formats, required flags and possible values. Amounts are strings, and status filters warn that new values may appear (12 of 15). Every reference page has a cURL request and a response example, and Spend and Issuing each have an error code page. The create bill page lists 400, 404 and 500 but not 401 or 429 (12 of 15). Dated API versions (latest `2026-08-21`), an `x-api-version` override and a changelog of backwards-incompatible changes by version (15).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-schema):

APIs and MCP servers.

- 25, a machine-readable contract (a public OpenAPI file or similar; for MCP, typed JSON Schema inputs on every tool).
- 10, llms.txt or Markdown docs served for agents.
- 0 to 20, descriptions that say what a tool is for, when to use it and when not to, read from the tool definitions in the source or the API reference.
- 0 to 15, typed inputs with enums, constraints and required fields, and no free-form JSON blobs.
- 0 to 15, examples and documented error responses.
- 15, versioning and a public changelog.

Models are read from the API reference, the OpenAPI file, llms.txt, the structured-output and tool-use docs and the model cards. Frameworks from docs a model can follow, typed interfaces, examples and the API reference.

## 3. Agent ergonomics, 69 out of 100, up to 5 more on the total

Why it scored 69: `page_size` runs from 1 to 100 and defaults to 100 on Spend lists. No field selection or expand parameter was found, and the CLI has a `--compact` flag (15 of 25). Spend lists and card transaction events page with a `page` bookmark and `page_after` and `page_before`, while cards and legacy transactions use `page_num` and `has_more`. Filters cover status, sync status, legal entity and created-at range, with a 30-day default window (16 of 20). Errors return `code`, `message`, `source` and `details`, and 429 responses carry a `trace_id`. The Spend error page lists three codes (15 of 20). `request_id` is required on create calls for cards, bills and purchase orders. Airwallex says the production MCP server annotates write tools, which we couldn't read without an account. The two tools on the keyless Docs MCP server carry readOnlyHint (16 of 20). Creating a bill needs eleven required fields. The only server SDK is `@airwallex/node-sdk` in beta, and the CLI has a dry-run flag (7 of 15).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-ergonomics):

- 0 to 25, context cost. For MCP, the number and size of the tool definitions (25 for ten or fewer compact tools, 15 for 11 to 30, 5 for more than 30, plus up to 10 back for toolsets, dynamic loading or read-only subsets). For APIs, whether responses can be sized (field selection, limits, summaries).
- 20, pagination, filtering and output-size controls.
- 20, actionable, documented error responses, codes and messages an agent can recover from.
- 20, idempotency or safe retries, and for MCP the `readOnlyHint` and `destructiveHint` annotations.
- 15, sensible defaults, few required parameters, and official SDKs in at least two languages.

Models are read for tool use, structured output, prompt caching, context length, batch and SDKs. Frameworks for how much code and how many defaults a tool-calling agent with MCP needs.

## 4. Reliability, 77 out of 100, up to 4.6 more on the total

Why it scored 77: Read with the hosted lines and scored on the REST API for Issuing and Spend. status.airwallex.com is a Statuspage site with 21 components in three groups, among them Spend, Issuing, API Gateway and Sandbox (20). Eleven incidents are listed since 27 April 2026 and none names Spend, Issuing or the API Gateway. Three marked major fall in the last 90 days on neighbouring products (Mastercard 3DS on 15 July, Mastercard payments on 15 August, USD deposits from 29 September to 5 October), each attributed to a third party, so 25 of 30. Limits are published, 100 requests a second per account, 20 per endpoint and 50 concurrent in production, and 20, 10 and 10 in the sandbox (15). The docs ask for exponential backoff with jitter on 429 and creates take a required `request_id`. No Retry-After header is documented (12 of 15). No SLA was found, and the service agreement supplies the services as is and as available (0). Issuing is generally available, but the four Spend endpoints we read are marked beta, as are the Node SDK and the AgentOS skills (5 of 10).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-reliability):

Hosted APIs, MCP servers, models and platforms.

- 20, a public status page with component history (Statuspage, Instatus, BetterStack or the vendor's own).
- 0 to 30, the incident record for the last 90 days on that page. 30 for a clean record or trivial incidents only, 20 for minor incidents only, 10 for one major outage (an hour or more of a core API down, or errors across the board), 0 for several. 5 when there's no history we could read, and the note says so.
- 15, rate limits documented with numbers.
- 15, documented 429 or overload handling (Retry-After, backoff guidance), and idempotency keys or safe-retry guidance where writes are involved.
- 10, an SLA published for any paid tier.
- 10, the surface agents use is generally available, not beta or preview.

Local packages, SDKs, frameworks and stdio MCP servers.

- 20, installs from an official package with supported runtimes stated.
- 25, a public CI and test suite, passing on the default branch.
- 0 to 25, open crash or regression issues relative to activity (25 for few and handled, 0 for many, old and unanswered).
- 15, semver discipline and breaking changes called out in a changelog.
- 15, version 1.0 or later, or declared stable.

Protocols are read from their reference implementations, the public facilitators or servers, spec stability and test vectors.

## 5. Maintenance & community, 66 out of 100, up to 3 more on the total

Why it scored 66: The airwallex-marketplace repository, which carries the AgentOS and developer plugins, tagged v0.2.11 on 30 September 2026. The newest API version is `2026-08-21` (30). Eight marketplace tags between 6 August and 30 September, and API versions on 17 July and 21 August (20). Closed service. The changelog lists backwards-incompatible changes only, support is a help centre ticket or developer.support@airwallex.com, and the marketplace repository shows one open issue. Response times couldn't be observed (9 of 15). `@airwallex/node-sdk` was last published on 31 December 2025 as 2.1.0-beta.5 and is the only server SDK. The official MCP registry has no Airwallex entry of the vendor's own, only a third party's (io.github.codespar/mcp-airwallex) (4 of 15). The marketplace repository has no CI workflow, and the CLI is a binary installed by script whose version we couldn't read (3 of 10).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-maintenance):

- 0 to 30, time since the last release, or the last published model or API change for a closed service. 30 within 30 days, 20 within 90, 10 within 180, 0 older.
- 20, at least three releases or dated changelog entries in the last 90 days.
- 0 to 25, responsiveness. Issues and pull requests answered on GitHub (the open issues and how recent the replies are). For closed services, a public changelog and a support or community channel that answers, 0 to 15.
- 15, presence in the official MCP registry under a verified namespace (MCP servers), or current official SDKs (APIs and models).
- 10, package health, current dependencies and CI.

Models are read for deprecation notice periods and model churn rather than release counts.

## 6. Security & auth, 84 out of 100, up to 2.8 more on the total

Why it scored 84: Scoped API keys grant Read or Write per resource at organisation or account level, can be edited, regenerated, duplicated and deleted, and can be tied to IP ranges. Keys travel only in headers and exchange for a bearer token that lasts 30 minutes. Partner apps, the CLI and the MCP server use OAuth with 64 scopes (30). Read is separate from Write, the AgentOS tools don't start transfers, conversions or payouts by default, CLI writes ask for confirmation, and cards take limits, merchant category rules and remote authorisation. Unrestricted admin keys still exist, and API writes have no confirmation step (17 of 20). The AgentOS page warns about indirect prompt injection from documents and web pages, tool poisoning by other MCP servers and auto-approve modes. Expense descriptions, comments and merchant names are untrusted text (11 of 15). `GET /api/v1/audit_log/security_audit_logs` records logins, user management and key changes for selected accounts only, key changes trigger an email, and no per-call log was found (8 of 15). security.txt with contacts, a bug bounty that has been invite-only since 13 July 2021, SOC 1 and SOC 2 Type 2, ISO 27001 and PCI DSS Level 1 on the trust centre (18 of 20).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-security):

- 0 to 30, the credential model. 30 for OAuth 2.1 with scopes, or scoped and revocable keys with rotation. 20 for plain revocable API keys. 10 for one all-powerful key. 10 off when a secret can travel in a URL query string as a documented option.
- 0 to 20, read-only or least-privilege modes, and confirmation or approval for destructive actions.
- 0 to 15, prompt-injection posture where the tool returns untrusted content (documented mitigations or guidance). A tool that returns no untrusted content gets 10.
- 0 to 15, audit logs or per-call visibility for the operator.
- 0 to 20, a security programme. security.txt or a disclosure policy, a bug bounty, SOC 2 or ISO 27001, advisories handled in public.

Models are read for retention, whether API data trains models (and whether that's off by default), zero-retention options and certifications. Frameworks for telemetry defaults, approval hooks, guardrails and sandboxing.

## 7. Transparency & trust, 78 out of 100, up to 1.9 more on the total

Made of editorial 64, provenance 92.

Why it scored 78: Closed service with terms at stable URLs. The API terms are dated 20 June 2025, the service agreement took effect on 1 January 2026 and the Spend Management Terms are dated 6 December 2023. The plugin repository is Apache-2.0 and the Node SDK is MIT (16 of 30). The privacy policy describes retention by purpose and legal duty without fixed periods, names the countries where data is hosted, and says personal data may be processed to develop or improve Airwallex's AI and machine learning. A DPA is published as part of the customer agreement (18 of 30). Breaking changes ship as dated versions and an account stays on its version until it migrates. The API terms require a developer to implement an update within six months at most, give 30 days' notice of adverse changes to the terms, and let Airwallex discontinue services at its discretion. No retirement dates for old versions were found (12 of 20). A public list of processors and sub-processors, updated 7 October 2026, gives each one's category, role and region (18 of 20).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-transparency):

- 0 to 30, source availability and licence clarity. 30 for open source under an OSI licence, 15 for closed with clear terms, 0 for unclear terms.
- 0 to 30, data handling and retention statements that agree with each other (privacy policy, DPA, retention periods, subprocessors).
- 0 to 20, a deprecation policy or notices with dates.
- 0 to 20, telemetry disclosed with an opt-out (local software), or subprocessors and data locations disclosed (hosted).

The other half of Transparency and trust is the provenance score, computed from checked facts (below). The category score is the mean of the two.

Provenance checks not met in full (half of this category, computed from checked facts):

- Terms of service: read, states 6 of the 7 things a reader expects, and has 2 clauses that cost points (5.1 of 10)
- Privacy policy: read, states 7 of the 8 things a reader expects, and has 1 clause that costs points (7.3 of 10)

## What we couldn't check

What we couldn't read counted as absent. Publishing it on a page a plain HTTP fetch can read (not only in a browser) lets the next check count it.

- unchecked: the production MCP server's tool list, input schemas and annotations at https://mcp.airwallex.com/mcp, which need an OAuth sign-in to an Airwallex account. `toolCount` is left empty
- unchecked: the CLI's version and release history. static.airwallex.com didn't answer our requests for the install script
- unchecked: whether a sandbox or Explore account can call the Spend endpoints. The pricing page lists direct Spend API integration under Accelerate, and the docs state no plan requirement
- unchecked: whether Issuing API access needs approval on every account. The CLI guide says card and Issuing commands may return 403 until support enables access, and the service agreement says API access must first be approved
- unchecked: whether 429 responses carry a Retry-After header. None is documented
- unchecked: whether an OpenAPI spec is published somewhere we didn't look. None is linked from llms.txt or the API introduction
- unchecked: the date of the US privacy policy, which shows no last-updated line in the text we read. The global policy is dated 26 February 2026
- unchecked: whether an SLA exists in Accelerate or platform contracts. None was found in the service agreement or the API terms
- The lead described a plain REST API with a sandbox. It left out that the Spend endpoints are beta and that the vendor also runs a CLI and three MCP servers
- The docs carry two pages titled Instructions for AI agents and an install prompt that asks an assistant to fetch and follow the AgentOS guide. We recorded them as facts and didn't act on them
- The pricing page is the US one in USD. Plans and fees differ by region, and the terms and privacy policy cited are those of Airwallex US, LLC
- security.txt gives its expiry as `2030-06-30 T00:00:00.000Z` with a space inside the timestamp, which isn't the RFC 9116 format. We recorded it as valid because the contacts and a future expiry are present

## Weaknesses

- No OpenAPI spec was found. The reference is a Markdown page per endpoint, and the CLI prints one endpoint's schema at a time
- Each Spend endpoint we read (expenses, vendors, bills, purchase orders) is marked beta, and the pricing page lists direct Spend API integration under the custom-priced Accelerate plan
- The Spend API reads expenses and sets sync status. No endpoint was found to attach a receipt, code a card expense or approve one
- The only server SDK is `@airwallex/node-sdk`, still in beta and last published on 31 December 2025
- No SLA was found, and the Security Audit Logs API is open to selected accounts only and covers logins, user changes and key changes, not API calls

## What costs an agent a turn today

The notes we give agents before they call it. Each one is a workaround an agent shouldn't need.

- Exchange `x-client-id` and `x-api-key` at `POST /api/v1/authentication/login` once, then reuse the bearer token for 30 minutes. The login endpoint allows 100 requests a minute per key
- Create Spend keys with organisation-level permissions. With a key linked to several accounts, send `x-login-as` at login or the token carries no account permissions
- Send a fresh UUID as `request_id` on every create call and reuse the same value when retrying after a timeout
- Expect two pagination styles. Spend and card transaction events use the `page` bookmark with `page_after` and `page_before`. Cards and legacy transactions use `page_num` and `has_more`
- Card and expense lists default to the last 30 days. Pass both created-at bounds to read further back, and fetch a card singly to see its `authorization_controls`

## When it's done

Send what changed and where it's published as a dispute (https://www.anchorterminal.com/builders/#disputes, or `POST https://www.anchorterminal.com/api/v1/contact` with `"kind": "dispute"`). Disputes are answered in public, and the listing is checked again by the same checklist. Paying for an audit or a listing claim changes nothing here.