Xama

Connect AI agents to Xama, an AML and KYC client onboarding platform for accountants and professional services firms. Agents create accounts and contacts, initiate company, onboarding, and AML reports, manage subscriptions, and read the risk assessments and documents each onboarding produces.

29 actions Custom auth available

Platform Documentation ↗

A new client is signed in the practice management system, because Xama has no FlowRunner trigger and pushes nothing into a flow

Search Accounts and Contacts checks whether this client already exists before anything is created

Create Account and Create Contact open the onboarding record with the primary contact attached

Initiate Company Report starts the registration lookup, then List Company Report Revisions polls until a revision is ready

Get Company Report Revision confirms the registered details match what the engagement letter says

The engagement partner receives the company lookup and the proposed set of identity checks

Partner approves which checks to demand from this client, and only then does the agent call Initiate Onboarding Report

What This Integration Enables

Xama is an AML and KYC onboarding platform for accountants and professional services firms, which means the records this connector touches are real people's passports, addresses, and sanctions screening results, and the actions that write them create legal obligations for the firm. That framing should shape every flow built on it. Create and update actions write live client records, and report initiation triggers real screening and real invitations to real clients, so build against test credentials and non-production clients.

Two things about the surface need saying before anyone designs around them. First, this connector has no triggers. Xama's push notifications are exposed as subscription CRUD actions (Create Subscription, Create or Update Subscription, Update Subscription, Delete Subscription, List Subscriptions, Get Subscription) because the delivered webhook payload shape is not documented in the vendor API specification. Those actions register a callback URL of your choosing, either a FlowRunner catch webhook or your own endpoint, and they create no FlowRunner trigger. Nothing in this connector wakes a flow up. Second, reports run asynchronously. Initiate Company Report, Initiate Onboarding Report, and Initiate AML Report all start a background process and return before it finishes. The flow polls Get AML Report, Get Onboarding Report, or List Company Report Revisions afterwards and reads a status that progresses through values including INITIAL, INITIATED, READY, ERROR, CREDIT_BALANCE_EXCEEDED, and CANCELLED. That last status is worth handling explicitly rather than treating every non-READY result as "not yet."

Note also what the connector reads rather than writes. Risk assessments are read only here: List Risk Assessments and Get Risk Assessment return the assessed risk level, assessment items, notes, financial information, preparer and reviewer details, and any violations, and there is no action that authors one. That is not a shortcoming to work around, it is Xama's design showing through. A risk assessment carries a named preparer and a named reviewer because a person is supposed to make it. Documents are read only too: Get Document retrieves a record by ID, with the IDs coming from report documents such as those on a company report revision. An agent feeds the assessment and reads its outcome. It does not sign it.

Without FlowRunner

Onboarding starts twice A client already in the system gets a second account because nobody searched first

Evidence requests sent by habit The same check set goes to every client regardless of risk, because varying it takes thought

Reports chased manually Someone reopens the platform through the day to see whether a screening came back

With FlowRunner

Duplicates caught before creation Accounts and contacts are searched by name, registration number, and email before a record is opened

Check sets chosen deliberately The evidence demanded from a client is approved by the partner who owns the relationship

Results collected on their own Async reports are polled to completion and delivered with the account context attached

Use Case Scenarios

A client record that opens itself, up to the point a person is needed

A new engagement is signed and the practice management system records it. The flow starts there, since Xama will not start it. The agent calls Search Accounts and Contacts on the company name and registration number to establish whether this client is already in the book. Only when nothing matches does it call Create Account with the entity type and Create Contact for the primary contact, attaching an external reference so the two systems stay reconcilable. It calls Initiate Company Report, then polls List Company Report Revisions until a revision appears and reads it with Get Company Report Revision. The engagement partner receives the registered company details in Microsoft Teams alongside what the engagement letter claimed. Where they differ, that difference is the first useful thing anyone learns about the client.

AML screening whose result reaches the right person the same day

The agent calls Initiate AML Report for a contact, which screens them against sanctions lists, watchlists, and politically exposed person lists, optionally with a time to live so the screening refreshes on its own. Because the call returns before the screening finishes, the flow polls Get AML Report on a schedule until the status reaches READY, handling ERROR and CREDIT_BALANCE_EXCEEDED as their own branches rather than as delays. A clear result is logged against the account and the onboarding continues. A hit does not get an automated verdict of any kind. It goes to the money laundering reporting officer with the screening data, the account's existing risk assessments from List Risk Assessments, and the contact record, in a message that asks a question rather than announcing a decision.

The periodic review that stops being a scramble

Firms carry an obligation to keep client due diligence current, and the work of finding out which clients are overdue is usually a spreadsheet exercise. A monthly flow calls List Accounts filtered on monitoring state and risk level, then List Contacts per account with the monitoring filter, and Get Contact on each to read the flags for whether AML, onboarding, and document verification reports exist. It builds the overdue list into Google Sheets grouped by responsible partner, with the highest risk accounts first. For accounts where the only thing missing is a refreshed company lookup, the agent calls Initiate Company Report itself, because that check touches a public registry and not the client. Anything that would put a request in front of a client waits for the partner.

Human-in-Loop Highlight

Initiate Onboarding Report is the action that reaches out and touches the client. It sends them an invitation asking them to submit evidence, and the toggles on that call decide what evidence: ID scan, personal details, proof of address, proof of identity, selfie, face match. Those toggles are a judgment about how much to demand from a specific person at a specific moment in a relationship, and getting it wrong in either direction has a cost. Ask a long standing client for a selfie and a face match on a routine refresh and you have made the firm look like it does not know who they are. Ask too little of a new high risk entity and the file will not hold up. The combinations themselves carry rules that a person needs to be aware of: ID scan, face match, and mobile face match should not be combined, and personal details should not be combined with home address history. Cancel Onboarding Report exists and it stops the evidence collection flow, but it cannot un-send an email that is already in someone's inbox, and the client who received it will remember being asked. So the agent prepares everything and stops. It posts the resolved client record, the company lookup result, the existing risk assessment level from List Risk Assessments, and the proposed check set: "Ready to invite Aldercroft Holdings' primary contact to onboarding. Proposed checks: proof of identity, proof of address, ID scan. Current assessed risk on the account is Medium. Approve this set, change it, or hold?" The partner answers, and the agent calls Initiate Onboarding Report with exactly what was approved. The Suppress Notifications flag is available on mutating report actions if a flow needs to skip subscriber notifications while it runs, but suppressing a notification is not the same as suppressing an invitation, and a flow should never use one to imitate the other.

Agent processes routinely

Detects exception requiring judgment

Clear match Continues automatically

Ambiguous Routes to human via email

Human decides

Agent resumes with decision

Agent Capabilities

29 actions

Accounts

List Accounts Lists the client onboarding accounts for the configured client with filtering by account type, status, risk level, risk assessment status, and monitoring, plus sorting and pagination. The natural query for a periodic review.
Search Accounts and Contacts Searches accounts and contacts by free text against names, registration numbers, and email addresses, with optional filters for staff role or member, entity type, account and contact status, and contact replica mode. Call it before creating anything, because duplicate client records in an AML system are worse than an extra API call.
Create Account Creates a client onboarding account. A primary contact is required unless the type is Unknown. Custom fields and an external reference can be attached so the record stays reconcilable against your own systems.
Get Account Retrieves a single account by ID including type, status, registration number, primary contact, monitoring state, custom fields, and whether a company report exists.
Update Account Fully updates an account, replacing name, type, registration number, primary contact, external reference, and custom fields with the values supplied. Use Update Account Status instead when the change is narrower.
Update Account Status Updates an account's type, status, and archived date without replacing the rest of the record, and can update custom field values too. Setting the status to Archived archives the account, defaulting the archived date to today.

Contacts

List Contacts Lists the contacts of an account sorted by first name, with filtering by status, replica mode, and monitoring, plus pagination. Enable the master view to have replica records reflect their master's data.
Create Contact Creates a contact within an account. First and last name are required, with identity details such as date of birth, passport, and driving licence, an address, custom fields, and an external reference available to support screening.
Get Contact Retrieves a single contact by ID including identity details, address, monitoring state, custom fields, and flags for whether AML, onboarding, and document verification reports exist. Those flags are what a review flow reads to find gaps.
Update Contact Fully updates a contact, replacing name, identity details, address, custom fields, and external reference with the values supplied.
Update Contact Status Partially updates a contact, changing only what is provided. Use it to archive or reactivate a contact, promote one to Primary, or update custom fields without resending the whole record.

Company Reports

Initiate Company Report Initiates a company report for an account, looking up the company's registration details, with an optional time to live for automatic refreshes and control over whether the underlying data lookup is triggered. Runs asynchronously; poll the revisions afterwards.
List Company Report Revisions Lists the revisions of an account's company report, each a point in time snapshot, with pagination and sorting. Use it to find the revision identifier a later call needs.
Get Company Report Revision Retrieves a single revision by its identifier, including the company lookup data, its status, and any review details.
List Company Report Revision Documents Lists the documents attached to a specific company report revision, sorted by creation, with pagination. Each entry carries a document ID for use with Get Document.

Onboarding and AML Screening

Initiate Onboarding Report Initiates an onboarding report for a contact and sends them an invitation to submit evidence, with individual checks toggled per request: ID scan, personal details, proof of address, proof of identity, selfie, and face match. Some combinations are mutually exclusive. Optionally set a redirect URL, suppress the invitation email, and schedule automatic refresh. This action reaches a real client.
Get Onboarding Report Retrieves the onboarding report for a contact including status, revision, requested checks, and any review details. Poll it to track progress from initiated to ready.
Cancel Onboarding Report Cancels an in progress onboarding report, stopping the evidence collection flow. It withdraws the request; it does not retract the invitation the client already received.
Initiate AML Report Initiates an anti money laundering report for a contact, screening them against sanctions, watchlists, and politically exposed person lists, with an optional time to live for automatic refreshes. Runs asynchronously.
Get AML Report Retrieves the AML report for a contact including status, revision, screening data, and any review details. Poll it to track progress to ready, and branch on ERROR and CREDIT_BALANCE_EXCEEDED rather than treating them as delay.

Risk Assessments and Documents

List Risk Assessments Retrieves the risk assessments associated with an account, each recording the assessed risk level, notes, the preparer and reviewer, and completion state. Read only, by design.
Get Risk Assessment Retrieves a single risk assessment by ID together with related contact records where available, including assessment items, notes, financial information, preparer and reviewer details, and any violations.
Get Document Retrieves a document record by ID including its metadata and custom metadata such as the originating client, account, contact, source, and file name. Document IDs come from report documents.

Notification Subscriptions

List Subscriptions Retrieves all notification subscriptions registered for the client, each defining a webhook callback URL or a set of mail recipients together with the entities and events it listens to. Paginated. These describe where Xama sends events, not where FlowRunner receives them.
Create Subscription Creates a notification subscription. Use type Webhook with a callback URL to receive events by HTTP POST, or type Mail with recipients to receive them by email. Point the callback at a FlowRunner catch webhook or your own endpoint; this action does not create a FlowRunner trigger.
Get Subscription Retrieves a single subscription by ID including delivery type, callback URL or recipients, and the entities and events it listens to.
Create or Update Subscription Creates a subscription at a specific ID or fully replaces the existing one at that ID. Fields not included are cleared, so supply the complete definition. Use it when you manage subscription IDs yourself.
Update Subscription Partially updates an existing subscription, changing only the fields provided. The safe way to adjust a callback URL, recipients, secret, or listened events without resending the whole definition.
Delete Subscription Permanently removes a subscription by ID. After deletion Xama stops delivering events to that callback URL or those recipients, which will look exactly like a working integration that has gone quiet.

Frequently Asked Questions

What can FlowRunner do with Xama?

FlowRunner agents can run Search Accounts and Contacts, List Subscriptions, and Create Subscription in Xama, plus 26 more actions.

Does connecting Xama to FlowRunner require OAuth?

Xama uses a custom authentication method to connect to FlowRunner.

Can Xama trigger a FlowRunner workflow automatically?

Xama doesn't currently expose triggers in FlowRunner. It connects as an action step inside workflows started by another trigger.

Start building with Xama

$100 in credits. No card required. Connect in minutes.

Start Building Free Talk to us