> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agent-loadout.com/llms.txt
> Use this file to discover all available pages before exploring further.

# File Invoices, Answer Vendors, and Pay Within Limits

> Extract invoice PDFs, forward to accounting, pay with the agent's card within owner-set rules, and manage vendor logins with TOTP codes.

An operations agent owns the address that vendors, SaaS tools, and registrars write to. It files invoices, answers routine vendor questions, and renews a domain or buys a small tool with its own card — within limits an owner set in advance. Every card authorization is checked in real time and appears under Wallet. Vendor logins and authenticator secrets live in the vault so the agent can handle portal 2FA without a human in the loop.

## What you need

An agent equipped with an inbox and a token with the following capabilities:

* **email:read** — to receive and read vendor mail
* **email:send** — to forward invoices and answer routine questions
* **vault:use** — to retrieve vendor logins and TOTP codes
* **wallet:read** — to check card limits before any purchase
* **wallet:pay** — *only for the purchase step* — to reveal card details for a checkout

Cards must be enabled in your workspace. The `wallet:read` and `wallet:pay` capabilities are feature-flagged — contact support if they are not visible on your plan.

## Steps

<Steps>
  ### Point vendors at the agent's address

  Use the agent's inbox address for tool subscriptions, domain registrars, and vendor accounts. Mail screening flags lookalike sender domains and payment redirection attempts before the agent acts on them.

  ### File attachments and forward to accounting

  Call `read_attachment_text` on any attached PDF to extract the invoice text — vendor name, amount, due date — without downloading the file. Then call `forward_message` to send the original message and its attachments to `accounting@example.com`, including the extracted details in the forwarded text. Label the thread `"invoice"` with `update_thread`.

  ### Check card limits before any purchase

  Call `list_cards` to review the per-purchase limit, monthly cap, and merchant allowlist before attempting any payment. Show these rules to any human who needs to approve the purchase. Do not reveal card details at this stage.

  ### Pay within the rules

  Call `reveal_card` to get card details for a single checkout. Every reveal is recorded in the organization's Wallet activity log. A purchase outside the card's rules — wrong merchant, over the per-purchase limit, or over the monthly cap — is declined with a stable reason code.

  ### Keep vendor accounts and TOTP codes

  Store vendor logins in the vault with `create_credential`. When a portal asks for a second factor, call `get_totp_code` with the credential ID to retrieve the current authenticator code. The agent never needs a human to relay a one-time password.
</Steps>

## Chat prompt example

Use this prompt in any chat client with Agent Loadout connected:

```text Chat prompt theme={null}
Find every invoice that arrived this month, forward the PDFs to accounting@example.com
with the vendor and amount in the text, and label the conversations invoice.
Show me the card limits before any purchase; do not reveal card details.
```

## curl examples

```bash curl theme={null}
# Invoices this month
curl -s "https://agent-loadout.com/api/v1/inboxes/<INBOX_ID>/threads?query=invoice&folder=inbox" \
  -H "Authorization: Bearer $AGENT_LOADOUT_TOKEN"

# Text of an attached PDF
curl -s https://agent-loadout.com/api/v1/attachments/<ATTACHMENT_ID>/text \
  -H "Authorization: Bearer $AGENT_LOADOUT_TOKEN"

# Forward the original to accounting
curl -s -X POST https://agent-loadout.com/api/v1/messages/<MESSAGE_ID>/forward \
  -H "Authorization: Bearer $AGENT_LOADOUT_TOKEN" -H "Content-Type: application/json" \
  -d '{"to":["accounting@example.com"],"text":"Vendor: Hosting Co, 49.00 EUR, due 30 Sep."}'

# Card rules before a purchase (wallet:read)
curl -s https://agent-loadout.com/api/v1/wallet/cards \
  -H "Authorization: Bearer $AGENT_LOADOUT_TOKEN"
```

## Required permissions

| Step                              | Capabilities needed        |
| --------------------------------- | -------------------------- |
| Receive and read vendor mail      | `email:read`               |
| Forward invoices to accounting    | `email:read`, `email:send` |
| Check card limits                 | `wallet:read`              |
| Reveal card for a purchase        | `wallet:pay`               |
| Read vendor logins and TOTP codes | `vault:use`                |

<Warning>
  Card details returned by `reveal_card` must never be stored, logged, or repeated by the agent in chat. Every reveal is recorded for the organization. Issue a token with `wallet:pay` only for the agents that genuinely need to make purchases.
</Warning>

<Note>
  Mail screening automatically flags lookalike sender domains (e.g. a domain impersonating a known vendor) and messages that attempt to redirect payment to a new account. Check `screening.verdict` before acting on any payment-related instruction in an email.
</Note>