Evenbead docs
Contents

Ai consent

13 operations. All areas

GET/v1/ai-providers

The AI provider registry: Anthropic, OpenAI, Google, xAI, Other (external: a §7216 consent names them); Evenbead (software vendor, US: never blocked); self-hosted; not AI. With location and data-handling notes (check the provider's current terms).

  • Operation listAiProviders
  • Scope: read
  • Read
Responses
  • 200 Providers (object)
  • Errors 400, 401, 403, 429, 500 (Error: error.type, message)

GET/v1/company/ai-7216

§7216 AI consent in this company: whether a consent is required (the company's own setting and each accounting firm's), every AI agent and app that reaches these books with its provider and whether it may read them ("Needs client consent for Anthropic. Request it."), the consents, and the registry.

  • Operation getCompanyAi7216
  • Scope: read
  • Read
Responses
  • 200 State (Ai7216Company)
  • Errors 400, 401, 403, 429, 500 (Error: error.type, message)

POST/v1/company/ai-7216

Set the requirement for this client. required: the company's own setting (owner or CPA): every external AI then needs a consent naming its provider. firm_required (a firm member with client.ai_data): the firm's setting for this client, true/false, or null to follow the firm-wide setting. Turning a requirement off from a browser session needs a recent step-up. People only (agents and connected AI apps are refused; the database refuses them too).

  • Operation setCompanyAi7216
  • Scope: admin
  • Write: sets a value, no Idempotency-Key needed
Request body
  • required boolean
  • firm_required boolean | null
  • reason string
Responses
  • 200 Set (Ai7216Company)
  • Errors 400, 401, 403, 409, 422, 429, 500 (Error: error.type, message)

GET/v1/company/ai-consents

The company's §7216 consents, newest first, every version: pending, signed (valid_now), superseded, expired, revoked, cancelled. A firm sees the ones it obtained.

  • Operation listAi7216Consents
  • Scope: read
  • Read
Responses
  • 200 Consents (object)
  • Errors 400, 401, 403, 429, 500 (Error: error.type, message)

POST/v1/company/ai-consents

Request a §7216 consent from this client: the document is generated from the template and frozen. A firm member (client.ai_data) requests it for their firm; it goes to the client through the firm's requests (Requests in the app, and an email to the owner and CPA) unless send_request is false. The company's owner or CPA may record one for the company itself (firm_id omitted: e.g. for Evenbead support). supersedes: a new version of an earlier consent (a provider change). People only (agents and connected AI apps are refused; the database refuses them too).

  • Operation createAi7216Consent
  • Scope: admin
  • Write: needs Idempotency-Key (or dry_run)
Request body
  • providers array of "anthropic" | "openai" | "google" | "xai" | "other", required The AI companies named. A provider change needs a new consent.
  • provider_other_name string
  • provider_other_country string Where an "other" provider is located (US, CA, ...)
  • data_categories array of "books" | "bank_lines" | "documents" | "receipts" | "contacts" | "tax_mappings" | "tax_forms", required
  • purposes array of "bookkeeping" | "reconciliation" | "tax_preparation_support" | "review" | "support" | "other", required
  • purpose_detail string
  • valid_until string The last day it is valid (at most three years). Omit: one year from the date signed (Rev. Proc. 2013-14).
  • firm_id string
  • supersedes string
  • send_request boolean Firm requests: send it through the client's Requests and email (default true)
  • due_date string
Responses
  • 201 Requested (object)
  • Errors 400, 401, 403, 409, 422, 429, 500 (Error: error.type, message)

GET/v1/company/ai-consents/template

The consent document a request would produce for this client (template; have your attorney review): the taxpayer and preparer, Rev. Proc. 2013-14's required statements, the data, purposes, each provider to tick, the duration, the right to revoke and the TIGTA statement. Lists are comma-separated. Nothing is saved.

  • Operation previewAi7216Consent
  • Scope: read
  • Read
Parameters
  • providers query, string, required
  • data_categories query, string, required
  • purposes query, string, required
  • purpose_detail query, string
  • valid_until query, string
  • provider_other_name query, string
  • provider_other_country query, string
  • firm_id query, string
Responses
  • 200 The document (object)
  • Errors 400, 401, 403, 429, 500 (Error: error.type, message)

GET/v1/company/ai-consents/{id}

One consent with its frozen document text and its log entries (format=json, the record to keep), or the record as a PDF (format=pdf; format=base64 for JSON with the PDF base64-encoded).

  • Operation getAi7216Consent
  • Scope: read
  • Read
Parameters
  • id path, string, required
  • format query, "json" | "pdf" | "base64"
Responses
  • 200 The record (object)
  • Errors 400, 401, 403, 404, 429, 500 (Error: error.type, message)

GET/v1/company/ai-consents/{id}/signed-pdf

The signed PDF uploaded for this consent (format=base64 for JSON).

  • Operation getAi7216SignedPdf
  • Scope: read
  • Read
Parameters
  • id path, string, required
  • format query, "pdf" | "base64"
Responses
  • 200 The PDF
  • Errors 400, 401, 403, 404, 429, 500 (Error: error.type, message)

POST/v1/company/ai-consents/{id}/sign

The client's owner signs a pending consent in the app: type your full name (it is never filled in for you) and tick each provider you agree to (accepted_providers; at least one). Only from the owner's own browser session with a recent step-up (never an API key). Effective from now until valid_until, or one year. People only (agents and connected AI apps are refused; the database refuses them too).

  • Operation signAi7216Consent
  • Scope: admin
  • Write: needs Idempotency-Key (or dry_run)
Parameters
  • id path, string, required
Request body
  • typed_name string, required
  • accepted_providers array of "anthropic" | "openai" | "google" | "xai" | "other", required
Responses
  • 200 Signed (object)
  • Errors 400, 401, 403, 404, 409, 422, 429, 500 (Error: error.type, message)

POST/v1/company/ai-consents/{id}/upload

Record a consent the client signed on paper (or elsewhere): the signed PDF (base64, at most 2 MB), the date signed, who signed, and your attestation that it is the client's signature on this document. The firm that requested it (client.ai_data) or the company's owner or CPA; a recent step-up from a browser session. Valid until valid_until, or one year from the date signed. People only (agents and connected AI apps are refused; the database refuses them too).

  • Operation uploadAi7216Consent
  • Scope: admin
  • Write: needs Idempotency-Key (or dry_run)
Parameters
  • id path, string, required
Request body
  • pdf_base64 string, required
  • signed_on string, required
  • signed_by string, required
  • attest true, required I attest that this PDF is the consent the taxpayer signed, unaltered, on the date given
  • accepted_providers array of "anthropic" | "openai" | "google" | "xai" | "other", required The providers ticked on the signed form (each one ticked by the client)
Responses
  • 200 Recorded (object)
  • Errors 400, 401, 403, 404, 409, 422, 429, 500 (Error: error.type, message)

POST/v1/company/ai-consents/{id}/revoke

Revoke a signed consent (or cancel a pending request). The client's owner or CPA, or the firm that obtained it (client.ai_data). Takes effect at once; never needs a step-up. People only (agents and connected AI apps are refused; the database refuses them too).

  • Operation revokeAi7216Consent
  • Scope: admin
  • Write: needs Idempotency-Key (or dry_run)
Parameters
  • id path, string, required
Request body
  • reason string
Responses
  • 200 Revoked (object)
  • Errors 400, 401, 403, 404, 409, 422, 429, 500 (Error: error.type, message)

GET/v1/company/ai-7216-log

The §7216 log: every requirement change and consent event (requested, signed, superseded, revoked, cancelled), oldest first, written by the database.

  • Operation getAi7216Log
  • Scope: read
  • Read
Responses
  • 200 Log (object)
  • Errors 400, 401, 403, 429, 500 (Error: error.type, message)

POST/v1/agents/{id}/ai-provider

Declare (or correct) the AI company behind one of this company's agents (and its AI-app connection). Evenbead support and Evenbead's own agents are fixed; a firm's agents are declared by the firm. Audited. People only (agents and connected AI apps are refused; the database refuses them too).

  • Operation declareAgentAiProvider
  • Scope: admin
  • Write: sets a value, no Idempotency-Key needed
Parameters
  • id path, string, required
Request body
  • ai_provider "anthropic" | "openai" | "google" | "xai" | "other" | "self_hosted" | "none", required The AI company that runs this agent: anthropic, openai, google, xai, other (name it in ai_provider_name), self_hosted (a model you run on your own machines) or none (not AI: a script or integration). Required for a new AI-app connection; optional for an agent key. With a §7216 consent requirement on, an undeclared agent is kept out.
  • ai_provider_name string The provider's name when ai_provider is "other"
  • ai_model_family string The model family (claude, gpt, gemini, grok, ...); informational
Responses
  • 200 Declared (object)
  • Errors 400, 401, 403, 404, 409, 422, 429, 500 (Error: error.type, message)