> ## Documentation Index
> Fetch the complete documentation index at: https://control-dev.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Procountor

> Create a dedicated Procountor machine user and API key for Control.

export const ControlAppLink = ({path, breadcrumb, children}) => {
  const link = <a href={`https://app.control.dev${path}`} target="_blank" rel="noopener noreferrer" aria-label={breadcrumb ? `Open ${breadcrumb} in Control` : undefined}>
      {children}
    </a>;
  return breadcrumb ? <Tooltip tip={breadcrumb}>{link}</Tooltip> : link;
};

Control uses Procountor's machine-to-machine (M2M) authentication. A Procountor administrator should create a dedicated
technical user for the integration instead of attaching Control's API key to an employee's everyday account. This keeps
the connection independent of personnel changes and makes its access easier to audit and revoke.

## Create the machine user

1. In Procountor, go to **Management → Users and user rights**.
2. Add a user dedicated to the Control integration. Use contact details monitored by your organization, not an individual employee's personal details.
3. Set the rights in the table below to **Viewing rights**. Add the conditional rights only for features enabled on this data source.
4. Do not grant payment execution, approval, or unrelated write permissions to the machine user.
5. If Procountor shows the **Allow only M2M login to API** limitation, enable it for this user.

<Note>
  A standard accounting or payroll role can be a starting point, but review its rights before using it. Payroll access
  is only needed when salary data import is enabled in Control.
</Note>

### Rights required

| Procountor area | Rights                                                                   | When required                                                                                      |
| --------------- | ------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------- |
| Management      | Basic accounting info; Chart of accounts and default reports             | Always                                                                                             |
| Accounting      | Rights for journal receipts; Search journal receipts; Accounting reports | Always                                                                                             |
| Sales           | Rights for sales invoices/group invoices; Search sales invoices          | When invoice import is enabled                                                                     |
| Purchases       | Rights for purchase invoices; Search purchase invoices                   | When invoice import is enabled                                                                     |
| Payments        | Payment                                                                  | When invoice and payment import is enabled; use **Viewing rights**, never payment execution rights |
| Salaries        | Payroll; Person register                                                 | When salary-data import is enabled                                                                 |

Do not enable limitations such as **Access only ... created by user** or **Access only personal salaries**. Those
limitations would hide company-wide records from the integration.

## Create the API key

1. Sign in to the intended [Procountor](https://procountor.com) environment as an administrator.
2. Open **Basics** from the person icon in the upper-right corner, then choose **API client keys**.
3. Choose **New API key**.
4. Select the dedicated Control machine user.
5. Enter `FinataClient`, Control's Procountor client ID.
6. Choose **Create**.
7. Copy the API key immediately.

## Connect in Control

1. Open the Procountor data source in <ControlAppLink path="/entities-data-sources/overview"><strong>Entities & sources</strong></ControlAppLink>.
2. Paste the generated value into **Procountor API Key**.
3. Save and verify the credentials.

<Warning>
  Procountor displays a newly generated API key only once. If it is lost or exposed, create a replacement and update
  Control.
</Warning>

## Data imported

* General-ledger receipts and their transaction rows
* Chart of accounts and dimensions
* Sales and purchase invoices, invoice rows, payment events, and payments when invoice import is enabled
* Employees, persons, and salary types when salary-data import is enabled and the machine user has payroll access

## Common problems

### Paid APIs are not enabled

If verification says the company does not allow paid APIs, go to **Management → Company info → Usage settings →
Integration settings**, allow invoiceable API clients, and try again.

This setting is independent of the machine user's rights. Both must be configured; disabling invoiceable API clients
stops an otherwise valid connection.

### Some data is missing

Review the machine user's rights in **Management → Users and user rights**. Make sure it has read access to every data
category enabled for the Control integration, then verify the credentials and run the sync again.

### Wrong company data appears

Confirm that the machine user and API key were created in the intended Procountor environment.

## Optional: enable native write-back

Control can post AI-proposed journals back to Procountor after an Owner or Admin approves them. The write path uses a
separate machine user and API key from the read/sync credential above, so it can be revoked independently.

Grant the write machine user the rights to create ledger receipts in **Management → Users and user rights → Accounting**.
Do not grant sending, invalidation, or payment execution rights. Control creates journals with status `UNFINISHED`
only; a person still opens each journal in Procountor to finish it.

Configure the write credential in <ControlAppLink path="/settings#agent-integrations" breadcrumb="Settings → AI and automation → Native accounting write-back"><strong>Native accounting write-back</strong></ControlAppLink>.
See [Write-back approvals](/product-docs/integrations/write-back-approvals) for the proposal, review, and
reconciliation flow.

## Provider documentation

* [Procountor M2M authentication](https://dev.procountor.com/m2m-authentication/)
* [Procountor API certification and technical-user guidance](https://dev.procountor.com/api-certification/)
* [Procountor API settings and API keys](https://help.procountor.fi/en/articles/531630-procountor-api)
* [Procountor users and user rights](https://help.procountor.fi/en/articles/532516-users-and-user-rights)
* [Adding and removing a Procountor user](https://help.procountor.fi/en/articles/531656-adding-and-removing-a-user)