All integrations

Taggun

AI · AI

Receipts read from images, known merchants, product codes, and campaign validation on their own key.

Connecting Taggun in practice

Taggun caps the whole HTTP request body at 20 MiB and a PDF at 5 pages, returning 413 over either. The bigger surprise is that the fields an expense agent most wants are plan-gated rather than parameter-gated: duplicate, tampering, handwriting and digital-receipt detection start at the Advanced plan, and several fields have to be switched on in account settings before they are returned at all.

Scopes that draw scrutiny

  • apikey header One key, sent in an `apikey` header. Taggun’s instruction is to "store it in environment variables or a secrets manager — never in client-side code", because the key is the whole account.

Rate limits

  • Over the limit the API returns 429 with the message "API rate limit exceeded" and the documented remedy "retry with exponential backoff". No requests-per-second figure is published.
  • The complete HTTP request body is hard-capped at 20 MiB (20,971,520 bytes); over that the API returns 413.
  • PDFs are limited to 5 pages.
  • The trial is metered two ways at once: "the first 30 days or first 1,000 scans, whichever comes first, are free".

Worth knowing

  • Accepted document types are JPEG, PNG (PNG8 and PNG24), GIF, HEIF, HEIC and PDF — HEIC support matters because that is what iPhones produce by default.
  • 401 and 403 mean different things: 401 is a missing `apikey` header, 403 is a key that is present but invalid.
  • A feature being "included on a plan" does not mean its fields come back — several have to be enabled in account settings first, so an empty field is not necessarily a failed extraction.
  • Plans run Developer, Startup, Business, Advanced and Enterprise, and the fraud-detection suite plus receipt validation for promotions only appear from Advanced upward.

Checked against Getting started (2026-09-29), Document types and file requirements (2026-09-29), Errors (2026-09-29), API plans and features (2026-09-29)

Acts as the person, not as itself

Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.

Credentials never touch the agent

Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.

Every call on the record

Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.

What an agent can do

Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.

taggun_delete_api_validation_v1_campaign_settings_delete_by_campaignidWRITE

Delete campaign validation settings via DELETE /api/validation/v1/campaign/settings/delete/{campaignId}. DESTRUCTIVE AND IRREVERSIBLE: delete one campaign's validation settings entirely. The merchant allow and block lists, product codes, date window, balance range and fraud switches it held are gone, every later validation of that campaign loses the rules it was judged against, and Taggun documents no recycle bin, no restore and no soft-delete state. There is also no sandbox in which to try it first. PLAN-GATED: receipt validation and campaigns require an Advanced plan or above with Campaign Validation enabled in the account's Feature Settings. A refusal here is an entitlement the account has not bought, not a rejected key.

api
taggun_get_api_account_v1_known_merchants_exportREAD

Export known merchants via GET /api/account/v1/known-merchants/export. Export the account's known-merchant list -- the merchant names Taggun matches a receipt against when it normalises the merchant it read. Reads the account's own configuration; no receipt is processed.

api
taggun_get_api_account_v1_known_product_codes_exportREAD

Export known product codes via GET /api/account/v1/known-product-codes/export. Export the account's known-product-code list -- the codes Taggun matches line items against when enriching a receipt. Reads the account's own configuration; no receipt is processed. PLAN-GATED: product and category enrichment requires a Startup plan or above. A refusal here is an entitlement the account has not bought, not a rejected key.

api
taggun_get_api_account_v1_product_categories_exportREAD

Export product categories via GET /api/account/v1/product-categories/export. Export the account's product-category list -- the categories Taggun assigns line items to when enriching a receipt. Reads the account's own configuration; no receipt is processed. PLAN-GATED: product and category enrichment requires a Startup plan or above. A refusal here is an entitlement the account has not bought, not a rejected key.

api
taggun_get_api_validation_v1_campaign_settings_by_campaignidREAD

Get campaign validation settings via GET /api/validation/v1/campaign/settings/{campaignId}. Read one campaign's validation settings by campaign id: its merchant allow and block lists, product codes, product line-item rules, date window, balance-owing range, smart-validate options and fraud-detection switches (digital detection, tamper detection and similarity checking). PLAN-GATED: receipt validation and campaigns require an Advanced plan or above with Campaign Validation enabled in the account's Feature Settings. A refusal here is an entitlement the account has not bought, not a rejected key.

api
taggun_get_api_validation_v1_campaign_settings_listREAD

List campaign validation settings via GET /api/validation/v1/campaign/settings/list. List every campaign the account has validation settings for. A campaign holds the rules a submitted receipt is judged against -- allowed and blocked merchant names, product codes, a date window, a balance-owing range, and which fraud checks run. PLAN-GATED: receipt validation and campaigns require an Advanced plan or above with Campaign Validation enabled in the account's Feature Settings. A refusal here is an entitlement the account has not bought, not a rejected key.

api
taggun_post_api_account_v1_feedbackWRITE

Submit extraction feedback via POST /api/account/v1/feedback. Correct what Taggun read off a receipt it has already processed, naming it by the `referenceId` the original request was tagged with, and supply the right merchant name, date, total, tax, currency or master category. This is training feedback for the account's own model, not a re-read of the receipt.

api
taggun_post_api_account_v1_merchantname_addWRITE

Add a known merchant name via POST /api/account/v1/merchantname/add. Add one merchant name to the account's known-merchant list, so later receipts from that merchant normalise to it. Changes the account's configuration for every future extraction, not just the next one.

api
taggun_post_api_receipt_v1_simple_encodedWRITE

Read a receipt from a base64 image (simple) via POST /api/receipt/v1/simple/encoded. Run OCR over a receipt or invoice supplied as a BASE64-ENCODED image in the request body (`image` with its `filename` and `contentType`) and return the simple result: the merchant, date, total, tax and currency Taggun read, without the per-field confidence and region detail the verbose form carries. This is the bounded way to send a file to Taggun through this integration -- the multipart `/simple/file` endpoint is not shipped. SPENDS A SCAN against the Taggun plan's allowance, against PRODUCTION -- Taggun publishes no sandbox environment, so the same key that reads also processes real receipts and is metered for them.

api
taggun_post_api_receipt_v1_simple_urlWRITE

Read a receipt from a URL (simple) via POST /api/receipt/v1/simple/url. Run OCR over a receipt or invoice TAGGUN FETCHES ITSELF from an https URL you supply, and return the simple result. Taggun dereferences the URL, not Agentic Fabriq, and only https is accepted; the file must be reachable by Taggun's own servers. SPENDS A SCAN against the Taggun plan's allowance, against PRODUCTION -- Taggun publishes no sandbox environment, so the same key that reads also processes real receipts and is metered for them.

api
taggun_post_api_receipt_v1_verbose_encodedWRITE

Read a receipt from a base64 image (verbose) via POST /api/receipt/v1/verbose/encoded. Run OCR over a receipt or invoice supplied as a BASE64-ENCODED image in the request body and return the verbose result: every extracted field with its confidence, the text region it came from, the full transcribed text, and -- with `extractLineItems` -- the product line items. This is the bounded way to send a file to Taggun through this integration; the multipart `/verbose/file` endpoint is not shipped. SPENDS A SCAN against the Taggun plan's allowance, against PRODUCTION -- Taggun publishes no sandbox environment, so the same key that reads also processes real receipts and is metered for them.

api
taggun_post_api_receipt_v1_verbose_urlWRITE

Read a receipt from a URL (verbose) via POST /api/receipt/v1/verbose/url. Run OCR over a receipt or invoice TAGGUN FETCHES ITSELF from an https URL you supply, and return the verbose result with per-field confidence, text regions and optional line items. Taggun dereferences the URL, not Agentic Fabriq, and only https is accepted. SPENDS A SCAN against the Taggun plan's allowance, against PRODUCTION -- Taggun publishes no sandbox environment, so the same key that reads also processes real receipts and is metered for them.

api
taggun_post_api_validation_v1_campaign_receipt_validation_urlWRITE

Validate a campaign receipt from a URL via POST /api/validation/v1/campaign/receipt-validation/url. Fetch a receipt from an https URL and judge it against a STORED campaign's settings, named by `campaignId`, rather than against rules passed in the call. The campaign's own allow and block lists, date window, balance range and fraud switches decide the verdict, so changing the campaign changes what this tool accepts. SPENDS A SCAN against the Taggun plan's allowance, against PRODUCTION -- Taggun publishes no sandbox environment, so the same key that reads also processes real receipts and is metered for them. PLAN-GATED: receipt validation and campaigns require an Advanced plan or above with Campaign Validation enabled in the account's Feature Settings. A refusal here is an entitlement the account has not bought, not a rejected key.

api
taggun_post_api_validation_v1_campaign_settings_create_by_campaignidWRITE

Create campaign validation settings via POST /api/validation/v1/campaign/settings/create/{campaignId}. Create the validation settings for one campaign id: merchant allow and block lists, product codes, product line-item rules, a date window, a balance-owing range, smart-validate prompts and the fraud-detection switches. These rules govern every later validation of that campaign, so this changes how receipts submitted afterwards are judged. PLAN-GATED: receipt validation and campaigns require an Advanced plan or above with Campaign Validation enabled in the account's Feature Settings. A refusal here is an entitlement the account has not bought, not a rejected key.

api
taggun_post_api_validation_v1_receipt_validation_urlWRITE

Validate a receipt from a URL via POST /api/validation/v1/receipt-validation/url. Fetch a receipt from an https URL and judge it against validation rules supplied IN THE REQUEST (`validation`) rather than against a stored campaign: merchant allow and block lists, product codes and line items, a date window, a balance-owing range, and the fraud checks -- digital detection, tamper detection and similarity checking. Returns the extraction and the per-rule verdicts. SPENDS A SCAN against the Taggun plan's allowance, against PRODUCTION -- Taggun publishes no sandbox environment, so the same key that reads also processes real receipts and is metered for them. PLAN-GATED: receipt validation and campaigns require an Advanced plan or above with Campaign Validation enabled in the account's Feature Settings. A refusal here is an entitlement the account has not bought, not a rejected key.

api
taggun_put_api_validation_v1_campaign_settings_update_by_campaignidWRITE

Replace campaign validation settings via PUT /api/validation/v1/campaign/settings/update/{campaignId}. REPLACE one campaign's validation settings. This is a PUT and it takes the whole settings object, so a field left out of the body is a field removed from the campaign, not a field left alone -- read the campaign first and send it back changed rather than sending a partial update. PLAN-GATED: receipt validation and campaigns require an Advanced plan or above with Campaign Validation enabled in the account's Feature Settings. A refusal here is an entitlement the account has not bought, not a rejected key.

api

Put Taggun behind one governed endpoint.

Same permissions, same audit trail, whatever else you connect next.