Skip to main content

Integrations Practical guide 3 min read

Before Connecting Two Business Tools, Check Their APIs Can Do the Job

Check API access, required fields, account permissions, limits and test options before commissioning a business software integration.

Written by RightCyber · Published by RightCyber

Published · Updated

Sources checked 25 October 2026 · Review due 25 January 2027

AI-assisted research, drafting and editorial checks by RightCyber. Sources checked on 25 October 2026.

At a glance

Ask for evidence that both systems can read or change the exact records your workflow needs, using the account and subscription you will actually use.

On this pageArticle contents

Share this article

LinkedInEmail

“Both tools have an API” is a starting point, not proof that they can do the job you need. An API is a supported way for software to read information or request actions from another system. The important question is whether it supports your exact workflow.

You can check much of the brief before committing to a full build. Ask for evidence, not a list of software logos.

Name the action, not just the connection

“Connect our booking tool to accounts” leaves too much open. “For an approved completed booking, create a draft invoice with these line items and return its reference” is something a developer can investigate.

List the trigger, source record, required fields, destination action and expected result. State what must remain untouched. For example, creating a draft invoice is different from approving it, sending it or collecting money.

Check these six things on both sides

  • Supported operation: can the API perform the intended action, not merely export a report?
  • Information: does it expose the necessary fields and attachments, including custom fields you use?
  • Access: can the authorised business account grant the required permissions?
  • Commercial terms: what subscriptions, connector charges, usage costs or approval conditions apply?
  • Volume: can it handle an ordinary day, a busy period and an initial import within its current limits?
  • Maintenance: which API version is supported and who watches for changes?

Xero's developer support guidance says undocumented functionality should be treated as unsupported. Do not budget around a screen action that nobody has confirmed is available through the API.

Google's Sheets usage limits show why request volume also matters. A small demonstration can work even though a busy production process needs batching, queues or a different refresh interval. Check current limits rather than copying an old number into the brief.

Prove the awkward field early

Imagine a fictional training company that needs several attendees and a purchase-order reference on each invoice. A contact-only demonstration proves little about those requirements.

Choose one representative record with the awkward details included. Ask the developer to show the original record, the information returned by the source API, the requested destination change and the saved result. Use fictional information in a confirmed test environment. A provider's preview screen is not necessarily separate from live customer data.

Also try a missing required field and a value the destination rejects. Agree whether staff should correct it at the source or in a review queue.

Leave with a decision you can act on

The result should be a short feasibility note: supported, supported with a limit, or unsupported, with evidence for the difficult parts. Include assumptions about subscriptions, permissions, record volume and maintenance.

HubSpot's API reference now describes date-based versions. Version changes are one reason to retain the documentation and tested assumptions rather than treating the first connection as a permanent solution.

If one required action is unavailable, change the workflow before paying to build around it. A controlled manual approval or a narrower first connection can be a useful outcome from the investigation.

Provenance

Sources reviewed

Reviewed 25 October 2026

Sources reviewed by RightCyber on 25 October 2026. A source’s classification describes where it came from; it is not a blanket claim about every source.

How we prepare guidance and handle corrections

Disclaimer

Examples and suggested acceptance checks are illustrative, not customer case studies or measured results. Features, permissions and limits vary by provider and account. Confirm the intended behaviour in an authorised test setup.

Clarifications

Frequently asked questions

Does having an API mean two tools can be connected?
It means there is a potential route, not that the required workflow is supported. Check the exact record, fields, actions, permissions, subscription, limits and failure handling on both sides.
What should a small integration proof demonstrate?
Use fictional data in an authorised test setup to read the right source record, make the intended destination change and confirm it in the destination system. Include one invalid record and one interrupted operation before expanding the scope.

Work with RightCyber

Get help with your project

Show us the systems, a representative record and the result your team needs. We can assess a practical connection and its recovery process.

Keep exploring

Browse the RightCyber Blog
  • AI & automation

    What Should a Small Business Automate First?

    Compare real tasks before choosing a tool. A fictional shortlist, time calculation and reusable project brief help you select and test a worthwhile first automation.