AroFlo + AI: 72 tools, and an answer that isn't quietly a month old

There is a specific kind of wrong answer that is worse than an error, and AroFlo’s API can produce it.

Ask for every completed job this financial year, get thirty days of jobs back, no warning, no error code, a perfectly ordinary looking response. Then total them. Then say the number out loud in a meeting.

AroFlo is live on FloConnector, on a connector we build and maintain ourselves, with 72 tools across all 43 of its zones. Most of this post is about the tools. But the reason we think this one was worth building natively is the paragraph above, so we will start there.

What “72 tools” means here

Every one of those 72 has been run against a live AroFlo site. Twice: once against a test site, then again against production. Every tool that writes was checked by reading the record back afterwards. Several sections of this post exist only because of what those two passes turned up.

The filter that agreed with you and did something else

AroFlo’s v1 API is not really REST. It is a query language: 43 named zones and a pipe-delimited WHERE clause, more like SQL over HTTP than a set of endpoints.

That is fine, and in places it is better than REST. But it has one behaviour that makes it dangerous to put in front of a model. A WHERE clause that is missing or malformed does not fail. AroFlo applies the zone’s own default filter instead, which is almost always the last thirty days, reports success, and mentions the substitution only in a status message nothing was reading.

So the AI asks for a year and gets a month, is told everything went fine, and answers your question with real numbers that describe the wrong period.

Two defences, both structural rather than remembered:

• The model never writes a filter clause. It passes typed arguments, and the connector compiles them against a per-zone field map. There is no path from a model’s text into AroFlo’s query syntax.
• When it happens anyway, you are told. Every read carries the substitution flag out to the model with an instruction not to total or average the rows, because they are not the full result.

Then there is the half that neither defence covers, which we found on the live pass and which is quieter still. A clause that parses fine but names a field the zone does not have is not an error either. AroFlo accepts it, matches nothing, and returns zero rows with no marker at all. From its point of view the filter worked and nothing matched.

There is no runtime defence for that one. “No results” and “no such field” are genuinely the same response. The only defence is to never ship a field name nobody confirmed, so every filter in this catalog was checked against a live zone. Three of them turned out not to exist, including one on the clients zone that had been quietly returning a single row out of more than five hundred. Not one of the three announced itself.

And the day that went missing

One more, from the second pass, and it is the reason the connector shipped a version late.

AroFlo v1 has no >= operator. Its comparisons are =, !=, <, >, IN and NOT IN, and its > compares whole dates rather than moments. Which means every filter that promised “on or after 1 July” was excluding 1 July, and everything else recorded on the day you named.

Ask for jobs due from today and you got nothing back. No error, no substitution flag, nothing to notice it by.

All 24 of those filters now shift the boundary back a day so that “on or after” is true. If you had been asking for the day before as a workaround, you will now get one extra day, which is the correct one.

2,000 requests a day, shared with everything else you run

AroFlo allows 2,000 API requests a day per site. Not per integration, per site. Your accounting sync, your reporting tool, whatever someone in the office wrote in a spreadsheet macro, and us, all drawing on the same 2,000. It resets at midnight Melbourne time and there is no header anywhere that tells you where you stand.

That is the harshest budget of any platform we connect to, and it shaped the connector more than anything else did.

And when a bulk read would exhaust the budget, it stops and says so rather than returning what it managed. A truncated list reads to a model as the complete list, which puts us straight back in the first section of this post.

The job is the spine

A task in AroFlo is what everyone else calls a job, and everything hangs off it: quotes become tasks, labour and materials and expenses are recorded against tasks, invoices and purchase orders point back at them.

Which makes the question people actually want to ask a single question.

By hand that is a job screen, a quote screen, three exports and a spreadsheet, which is why it happens after the fact if it happens at all.

The same shape answers the rest of the week:

Once you are across more than a handful of jobs, the numbers stop fitting in a conversation. Ask about a quarter and the connector loads the set, the model queries the aggregate, and thousands of rows never enter the chat. There is more on how that works and why it is not a code sandbox, but you do not have to do anything to get it.

What AroFlo will not let anyone write, including us

A good chunk of this API is read-only, and none of it is our choice. We would rather set it out here than have you find out mid-task.

Quotes are read-only. You can read one in full, down to the line items, filter by status, acceptance, job number or date, and report on the pipeline. Building, sending and approving one stays in AroFlo. There is no write path in the API at all.

Timesheets are read-only. Hours can be read, filtered, sorted and totalled, by person, by job, by week. They cannot be pushed in. “Log two hours against this job” cannot be satisfied through this API by anyone.

You cannot raise a financial document. Invoices can be updated, and only their description and status. Purchase orders can be updated, and AroFlo’s own note is that they “can only have their status updated via the API at this time”. Bills are the one genuinely writable pair, insert and update, line items included. So this connector reports on money and moves it through approval. It does not create it.

Payments, contacts, site locations, projects and documents are read-only, for the same reason.

Nothing can be deleted. At all. v1 has no delete verb, no archive endpoint, and no zone that removes a record. Writes are inserts and updates only. For once the destructive-operations question answers itself: there is no tool in this catalog that can destroy anything, because there is no way to build one.

We also chose to leave one thing out. Nothing here touches a user’s permission group, because AroFlo says those settings “are deep and complex and so are not able to be recreated via AroFlo API”. A privilege change a model makes and nobody can read back is not a feature.

Three things AroFlo does that we tell you about

Setting an invoice to Processed archives the linked job. AroFlo documents this in one line under a heading, and it is easy to miss. From a model’s point of view a routine looking status update silently closes the job and removes it from every default list the customer looks at. So the tool says so in the description the model reads, not just in the docs a human reads.

Updating a work order requires a status, even when the status is not what you are changing. Leave it out and three of the four other fields fail. Send the status it already has and the rest of your change applies. The tool asks for it and explains why.

A work order’s required-by date reads back a day early. AroFlo records it against your site’s local midnight and returns it in UTC. The date you set is the date that is stored; the way it reads is wrong. We do not quietly correct it, because the correction depends on where your site is and a silent adjustment is much harder to spot than a visible one. Purchase order delivery dates are unaffected.

There is one more worth knowing, on jobs specifically: AroFlo fixes most of a job’s fields at creation. Client, business unit, task type, due date and description cannot be changed afterwards, and AroFlo ignores unrecognised fields rather than rejecting them, so a partial update that assumes REST would fail silently. The tool names exactly what is updatable.

We built on the older API on purpose

AroFlo runs two live APIs. v2 is nicer in every respect, JSON, bearer tokens, real HTTP status codes, and it is in closed beta gated site by site. v1 is the generally available one, and it is the one your AroFlo site can reach today.

So this connector is built on v1, deliberately, with the adapter already split so v2 can land beside it rather than replace it. A connector most AroFlo customers cannot switch on is not a connector.

Connecting is four pasted values

AroFlo does not offer integrations like ours a sign-in-and-approve flow, so you copy four values out of Site Administration, Settings, General, AroFlo API and paste them into FloConnector. That is the whole setup, and we verify them against your site before storing anything, because three of the four are opaque encoded blobs and transposing two of them looks exactly like a wrong password.

The consequence is the useful part. v1 has no scope model whatsoever. The signature proves the site, and access is simply whatever the AroFlo user those credentials belong to can do in AroFlo. So if a tool comes back refused, it is not a permission we failed to request. It is that person’s access, and the fix is in AroFlo.

That makes the credential a real control. Mint it from an account with the access you are comfortable an AI having, and that is the access it has. One caveat we surface rather than bury: the credentials are derived from an AroFlo username, so if someone renames that user they stop working and have to be copied again. You are told that specifically rather than shown a generic failure.

On top of that, a profile decides which of the 72 tools a given endpoint publishes and who can use it. Describe what the profile is for in your own words and we turn on the ones it needs, including the supporting reads a write depends on. Or tick the whole thing read only and hand out something that can answer questions and change nothing, which for a lot of businesses is the right first month.

Your AroFlo credentials never go near the model either way. We hold them encrypted, the AI only ever gets to ask. That is how credentials work on every connector we run.

How to connect AroFlo to Claude

Common questions

Do I need AroFlo’s permission, or a partner agreement? No. The credentials are ones you generate in your own site administration. FloConnector is an independent connector built on AroFlo’s public API, not an official AroFlo integration. AroFlo is a trademark of its owner.

Does it work with ChatGPT as well as Claude? Your AroFlo MCP endpoint is a standard connector, so it works with any client that supports them. If the term is new, we wrote a plain-English explainer.

Can it delete a job by accident? No. AroFlo’s API cannot delete anything, so neither can this. The writes that are destructive in effect, the status changes that move a job or an invoice through its lifecycle, are flagged sensitive and logged, and every write goes through the same confirmation your AI client gives you for any tool call. If you would rather it never got the chance, leave those tools off the profile.

Will it burn through our API allowance? That is the constraint the connector was designed around, not an afterthought. The change feed costs nothing against the daily limit, related records come back in one request instead of four, reference data is cached, and every response reports what is left of the day. It refuses rather than quietly spending the last of it.

Can I use it alongside our accounting? Yes, and it is where this gets interesting. A workspace holds more than one platform, so with Xero beside it, “what did we quote, what have we billed, and what is still unpaid” is one question. The rest of the catalogue is at connectors.

What does it cost? AroFlo is included on every plan, see pricing. New accounts get free credits to try it. It is in beta, which means connectable today and still being exercised in the wild, and we would rather badge that than not.

72 tools. And when it tells you what the year looks like, it is the year.

Written by

David List

Founder, FloConnector

Building the hosted MCP layer that lets a business's AI actually run its software. Previously deep in field-service and accounting integrations.

floconnector.com