When the System Has No API: Getting Finance Data Out of Portals, PDFs, and Emailed Spreadsheets

It's Tuesday, just after lunch. Picture a hypothetical AR analyst with a dozen browser tabs open. Each one is a different customer AP portal. The login for the third one expired over the weekend, and the reset email went to a shared inbox no one monitors. In her inbox sits a spreadsheet called remittance_final_v2_USE_THIS.xlsx, sent by a partner at 6 a.m. The operating account's bank statement exists only as a viewable table inside a web interface built more than a decade ago. None of these systems have a programmatic interface.

When a source system has no API, you have four real options: a human does the work manually, a screen-recording bot replays the clicks, you negotiate a file feed or email delivery with the vendor, or you use AI-vision browser retrieval that reads the screen the way a human does. Each is legitimate. The goal is the same: a deterministic, repeatable retrieval step that doesn't depend on someone's memory of where to click.

What Are the Four Real Options for Systems With No API?

Option A: A human does it. Still the right answer for a source you touch once a month, delivering a single number, that will likely go away soon. Don't automate what you can eliminate. If a task takes only a few minutes and recurs infrequently, upkeep often outweighs the savings.

Option B: A screen-recording bot. A developer records a session; the bot replays the clicks on a schedule. To be fair to modern platforms: today's leading RPA tools ship computer vision, semantic selectors, and document AI. For teams still running recorded-selector bots, a vendor redesign breaks the recording. The real question is who owns the upkeep, not just whether the clicks replay.

Option C: Negotiate a file feed. More often than vendors admit, you can ask. An SFTP drop. A scheduled CSV by email. An export setting buried in "Account Preferences" that nobody mentioned. A file that arrives the same way each time is usually more reliable than a browser-based approach.

Option D: AI-vision browser retrieval. Instead of recording clicks, you describe what you need in natural language. The system reads the rendered page as a human would, identifies the right element by what it looks like and what it says, and acts.

Takeaway: These four options aren't a ranking from bad to good. They're a menu, and Option C is underused because it requires a conversation, not code.

Is a File Feed or Email Workaround Better Than Automating the Browser?

Usually, yes. Structured data delivered to a predictable location is a better foundation. No UI dependency means no UI breakage.

Ask your bank's treasury team (many offer MT940, BAI2, or CSV exports that aren't advertised), AP vendor account teams (some have a data export option under settings that's never been turned on), and large partners who email remittance PDFs (many can switch to CSV on request).

When the file feed option fails, it's usually because the vendor declines, the format is inconsistent, or timing is unpredictable enough to break a downstream close. In those cases, you move to browser retrieval.

Takeaway: Before you build anything, spend one email asking the vendor if they'll deliver a file. The answer is yes more often than you'd think.

How Does AI-Vision Browser Retrieval Work for Finance Data?

When there's no programmatic interface and no file feed, the browser is the interface.

The instruction in AI-vision retrieval isn't "click the element with class inv-download-btn." It's "log in, open the Invoices tab, filter to the previous month, download each PDF." The system reads the rendered screen as a human would and identifies the right element by label and context. It isn't immune to substantial redesigns, but it survives the routine CSS updates that break recorded selectors far more reliably.

Loopfour's stagehand block works this way: AI vision and natural-language instructions drive a real browser. It reaches for the browser only when no API or connector is available. When a Stripe, NetSuite, or HubSpot connector can do the job, the workflow uses that instead. Other APIs may be reached with a code block or another supported route.

A real no-API retrieval sequence looks like this:

1. A schedule trigger fires at 6 a.m. on the second of each month.
2. A stagehand block logs into the AP portal, navigates to invoice history, filters to the prior month, and downloads each invoice PDF.
3. A loop block iterates over the downloaded documents. Inside it, a code step extracts the structured fields (vendor, invoice number, amount, due date, line items), and a scoped agent step handles the genuine judgment call: classifying ambiguous charges and flagging anything it cannot place. The workflow-level confidence gate sends uncertain records to review rather than posting them.
4. Still inside the loop, a NetSuite step fetches the matching purchase order by vendor and PO reference.
5. A condition block checks whether the extracted invoice amount matches the purchase order total.
6. An approval block routes non-matching rows to the controller.
7. A NetSuite step creates the vendor bill for the approved record, one bill per loop iteration.

Each step produces a record: what was downloaded, what was extracted, who reviewed which exception, and when. That audit trail isn't documentation someone has to write separately. It's built from the run itself.

Takeaway: AI-vision retrieval shifts the failure mode from "stale CSS selector breaks on routine updates" to "substantial interface redesign," which happens far less often.

How Do the Four No-API Approaches Compare?

One caveat: if a partner's remittance PDF looks materially different each month, the confidence threshold and human fallback aren't optional extras. They're the design.

Takeaway: For recurring work that costs enough to matter, a repeatable and logged retrieval step beats a manual one. Genuinely low-frequency work is often cheaper left to a person. The comparison above tells you which option fits your situation.

What About PDFs and Emailed Spreadsheets Specifically?

It's the fifth of the month. An email just landed from your largest partner: a workbook with thousands of rows, headers that match nothing in your ERP. The PDF in the next email covers a batch of invoices, each line formatted slightly differently than last month. Your analyst opens Excel.

Field extraction itself is mechanical work, so a code step handles it. Scoped AI belongs one layer up, on the judgment: classifying a charge that could sit in two accounts, or deciding a line does not match anything expected. That step runs behind a confidence gate. Records the workflow can place confidently continue; ambiguous ones route to an approval block for human review. Engineers refine the extraction logic based on reviewed exceptions, reducing the rate over time.

Emailed spreadsheets work similarly. A schedule trigger fires on the expected delivery day. An Email step searches the shared inbox for a matching sender and subject line. A second Email step retrieves the attachment. A transform block normalizes the columns. A condition block routes out-of-range rows to an approval block and lets the rest continue. A named Xero step then posts the cleaned rows.

Takeaway: Field extraction runs on deterministic code, so it behaves the same way on every consistent layout. Scoped AI sits above it, on the ambiguous classification calls only, behind a confidence gate with human fallback. That division is what makes the output defensible.

What Does This Return to the Team?

The sources that connect to nothing tend to be the ones nobody has costed, because the effort hides inside a role rather than showing up as a line item.

The figures below are model inputs, not measured benchmarks. Substitute your own.

Consider a team processing 700 vendor invoices a month. Assume 30% arrive as PDF email attachments and 20% require a portal login to retrieve, giving 350 invoices with manual handling. At ten minutes each: 350 x 10 minutes = 3,500 minutes, or about 58 hours a month.

A workflow covering 70% of those 350 invoices handles roughly 245 automatically: 245 x 10 minutes = 2,450 minutes, or about 41 hours returned to the team. At $45 an hour fully loaded, that's roughly $1,850 a month. The remaining 30% either fall below the confidence threshold and route to review, or come from sources not in scope. Exception volume can still grow with throughput; the net return depends on the exception rate you observe.

Error cost compounds separately. A misread remittance posts a deduction incorrectly. An invoice not retrieved sits unpaid until the vendor calls. Running the same extraction through a deterministic, traceable process means the next question is "show me the run log," not "can you reconstruct what happened?" The audit trail becomes part of the output.

The number that matters most to the analyst isn't the audit trail. It's the Tuesday afternoon she doesn't spend logging into eleven portals.

Takeaway: In the model above, routing 70% of 350 monthly documents through a repeatable workflow returns about 41 hours a month. Your result depends on volume, exception rate, and scope.

FAQ

What does "no API" mean for a finance system in practice?

A system with no API doesn't expose a programmatic endpoint another system can call to pull data. You can log in, view, and download manually, but nothing can request it directly. This is common in older banking interfaces, government tax portals, customer AP web systems, and niche ERP modules built before programmatic access was standard.

When is it worth addressing a no-API source versus doing it manually?

As an illustrative screening threshold, substitute your own labor and error costs: if the task takes more than about 30 minutes a month, recurs on a fixed schedule, and feeds a downstream process like reconciliation or close, it's worth evaluating. One-time exports or sources being replaced soon are usually faster to handle manually. Your tipping point depends on error cost and downstream impact.

How does AI-vision browser retrieval handle two-factor authentication?

It depends on the portal and its security policy. TOTP-based codes can often be handled programmatically from a rotating secret. SMS-based 2FA is harder: IP allowlisting does not generally satisfy an SMS challenge, and some portals have no automated path. MFA compatibility is assessed during implementation scoping; flows that can't be handled programmatically may require the vendor to provide a service account or may remain manual.

What happens when a PDF's layout changes and confidence drops?

When a document layout differs enough from prior examples, confidence scores on individual fields drop. Rows below the configured threshold route to an approval block for human review. The run log records the original extraction and any correction. That's the designed behavior, not a failure mode.

What happens when a portal requires multi-factor authentication?

MFA compatibility depends on the portal and the vendor's security policy. Time-based authenticator codes can often be handled inside the workflow; SMS challenges and hardware keys frequently cannot. Where the flow can't be automated, the practical routes are a vendor-provided service account, a negotiated file feed, or leaving that one source manual and automating everything downstream of it.

When the Data Finally Has Somewhere to Go

The hardest part of connecting a no-API source isn't the technical work. It's deciding to stop treating manual retrieval as an unavoidable cost.

Once the data flows, the close calendar gets back days that used to disappear into document collection. The reconciliation that waited for the analyst to finish her morning system loop runs on a schedule instead.

Loopfour builds and maintains these workflows for finance teams. The engineers handle stagehand configuration, confidence thresholds, and ongoing maintenance. Moderate workflows are typically live in about two weeks; source count and complexity can extend that.

If your analyst is still working through eleven tabs each Tuesday morning, visit loopfour.ai.