/lexware-office

name: lexware-office
description: "Work with Lexware Office contacts, products, invoices, quotations, bookkeeping vouchers, receipts, payment status, and guarded invoice, quotation, or expense writes through the Public API."
user-invocable: true
requires:
  bins:
    - node
credentials:
  - id: lexware-office-api-key
    kind: bearer
    required: true
    secret_ref:
      source: store
      id: LEXWARE_OFFICE_API_KEY
    scope: "https://api.lexware.io/"
    how_to_obtain: "Create a Lexware Office Public API key at https://app.lexware.de/addons/public-api. Set `LEXWARE_OFFICE_API_KEY` through browser admin at the active `/admin/secrets` route; if browser admin is unavailable, use `/secret set LEXWARE_OFFICE_API_KEY \"<api-key>\"` in browser `/chat` or TUI; local console fallback: `hybridclaw secret set LEXWARE_OFFICE_API_KEY \"<api-key>\"`."
metadata:
  hybridclaw:
    category: accounting
    short_description: "Lexware Office invoices, quotations, contacts, vouchers, receipts, and payment status."
    tags:
      - accounting
      - invoices
      - quotations
      - lexware
      - lexoffice
      - receipts
      - dach
    related_skills:
      - fastbill
      - download-platform-invoices
      - pdf
    stakes_tiers:
      green:
        - contact-read
        - product-read
        - invoice-read
        - quotation-read
        - voucher-read
        - payment-read
        - reporting-plan
      amber:
        - contact-create
        - invoice-create
        - quotation-create
        - expense-log
        - voucher-update
        - receipt-upload
        - transaction-match-plan
    escalation:
      writes: confirm-each
      route: f14
    cost_measurement:
      system: UsageTotals
      sub_limit_contract: R5.4
      sub_limit_key: lexware-office

Lexware Office

Use this skill when the user wants to inspect or manage Lexware Office data for German SME accounting workflows: customers, products/articles, invoices, quotations, bookkeeping vouchers, receipt files, posting categories, payment status, and high-level revenue or income-statement summaries.

Lexware Office was formerly branded lexoffice. This skill uses the current Public API gateway at `https://api.lexware.io`.

Scope

• read contacts/customers
• read articles/products/services used in invoice line items
• list invoices through `voucherlist` and retrieve invoice details
• download invoice files from the invoice file subresource
• list quotations through `voucherlist`, retrieve quotation details, and

download quotation PDF files from the quotation file subresource

• list and retrieve bookkeeping vouchers, including purchase invoices and

receipt records

• read payment status and payment items for vouchers through `/v1/payments`
• read bank-linked payment items by scanning voucher payments for

`partPaymentFinancialTransaction`

• read posting categories for revenue and expense classification
• prepare local revenue and income-statement aggregation plans from voucherlist

and posting-category reads

• aggregate fetched voucher pages into revenue summaries and income statements
• create contacts only after explicit operator grant
• create draft or finalized invoices only after explicit operator grant
• create draft or finalized quotations only after explicit operator grant
• log expense vouchers and upload receipt files only after explicit operator

grant

• match incoming bank transactions against open invoices locally, then prepare

a granted voucher reconciliation-note update through the documented voucher `PUT` endpoint

• update vouchers only after reading the current `version` and receiving

explicit operator grant

Credential Rules

Lexware Office authenticates with a bearer API key. Store the API key in HybridClaw encrypted runtime secrets; never paste it into the prompt.

Recommended setup order:

1. Browser admin: open the active HybridClaw admin URL ending in `/admin/secrets` and set `LEXWARE_OFFICE_API_KEY`. 2. Browser `/chat` or TUI fallback: `/secret set LEXWARE_OFFICE_API_KEY "<api-key>"`. 3. Local console fallback:

hybridclaw secret set LEXWARE_OFFICE_API_KEY "<api-key>"

For live API calls inside HybridClaw, run the helper to build an `http_request` payload wrapper, then pass only the emitted `httpRequest` object to the built-in `http_request` tool. The helper sets `bearerSecretName: "LEXWARE_OFFICE_API_KEY"` so the gateway injects the bearer token server-side.

Do not verify the key with bash/curl. The model cannot inspect the gateway secret store, and shell commands intentionally should not receive runtime API keys. Only say the secret is missing if the `http_request` tool returns a gateway error that explicitly says `LEXWARE_OFFICE_API_KEY` cannot be resolved.

Error Interpretation

• Gateway errors saying `LEXWARE_OFFICE_API_KEY` is missing or unresolved: ask

the operator to store the key in the active HybridClaw runtime and restart any already-running gateway if needed.

• Gateway errors saying the secret is blocked by policy: report a

policy/runtime configuration problem, not a missing API key.

• Lexware `401` or `403`: the gateway injected a token, but Lexware rejected it

or the account lacks Public API access. Ask the operator to regenerate the key and verify the Lexware Office plan/API add-on.

• Lexware `429`: back off; Lexware documents a 2-request-per-second resource

endpoint limit.

• Lexware optimistic-locking errors on voucher updates: read the voucher again

and retry only after the user confirms the current version should be changed.

Default Workflow

1. Start with read-only commands: `profile`, `list-contacts`, `list-invoices`, `list-expenses`, `get-payment`, `list-bank-transactions`, or `posting-categories`. 2. Use `plan` for natural-language requests when the action tier is unclear. 3. For writes, stop unless the operator has granted that exact mutation in the current task. 4. Pass `--operator-grant` only afte