API Report Card · Corporate Accounting · Methodology v1.1
QuickBooks Online
Where the points came from.
Five categories, each worth a fixed share of the 100 points. A category earns the fraction of its checks it passes, times its maximum.
Functional Coverage
Design & Reliability
Access Control
Docs & AI-Ready
Access & Cost
Letter grades are absolute, never curved.
The same numeric bands apply to every platform. Nothing here is scored relative to the rest of the board.
What this means for you.
One paragraph per category, in plain language.
1 · Functional Coverage
Everything the ledger runs on is fully readable and writable, and the write path was exercised live in a sandbox company. The problem is fit. Property-management concepts exist only as accounting workarounds: units are sub-classes or sub-customers, a lease is a recurring-transaction proxy, and work orders have no equivalent at all. Reconciliation status is invisible to the API, so you cannot tell from code whether an account has been reconciled.
2 · Design & Reliability
The highest Design and Reliability score on this board, and by a clear margin. Automations get signed webhooks with a documented retry ladder, duplicate suppression that was proven live, optimistic locking that actually rejected a stale write, trace ids on every response, and a real status page with a status API. The rough edges are legacy conventions, with create, update, delete and void all going through POST, and a thin version-compatibility contract.
3 · Access Control
The weak point for anyone automating. The Accounting API has exactly one scope, and it grants read and write together, so you cannot hand an integration or an AI agent a key that reads your books without also being able to post journal entries to them. You do get multiple apps with separate credentials, self-serve revocation, and genuinely isolated sandbox companies.
4 · Docs & AI-Ready
A developer or an AI coding tool can build against this from public documentation alone: a complete per-entity reference with worked request and response samples, maintained SDKs for Java, .NET and PHP, and four dated release-note streams. The gap is AI retrieval. There is no llms.txt and no downloadable corpus, so an AI tool has to scrape page by page rather than ingest the whole thing.
5 · Access & Cost
You can build against a sandbox today for free, and the core Accounting API is included with any QuickBooks Online subscription. Two things hold it back. Development keys are instant, but production credentials go through an Intuit questionnaire and its approval. And Intuit's premium-APIs page lists Projects, the 12-field Custom Fields API, Sales Tax, Dimensions and Payroll Compensation as requiring Silver, Gold or Platinum partner tiers.
Every check, and why it scored that way.
The same 27 checks are applied to every platform. What changes is which are N-A and what the core objects mean for that kind of software. Each mark below is quoted from the run's own report.
Category 1 · Functional Coverage
7.5 / 15Object coverage
weighted coverage = 78%; no critical object fully absent [all-entities reference navigation; live reads]
Core operational actions
weighted coverage = 78%; posting charges and payments fully supported and the write path live-observed in sandbox; lease create/update only a 0.5 proxy [invoice entity reference; sandbox write battery]
Delete or lifecycle actions
weighted coverage = 75%; void/delete/send and credit/refund present, Active-flag archival live-observed; lease termination a proxy; work-order and reconciliation lifecycle actions absent [invoice entity reference; sandbox write battery]
Change notification
efficient incremental polling live-verified (updated-since filter honored; CDC endpoint, 30-day window); webhooks exist but the supported-entities list was not evidenced in the packet, so 85%+ push coverage could not be established [cdc page; live step 3; configure-webhooks page]
Category 2 · Design & Reliability
9.2 / 10Modern conventions
resource-oriented JSON REST, but create, update, delete, and void all use POST (delete via ?operation=delete) and query/CDC use text bodies [api-features, data-queries pages]
Consistent typing
published attribute types consistent with rendered samples; live reads matched [invoice entity reference; live steps 2-3]
Structured errors
live 400 with Fault type ValidationFault, stable code 4001, message and detail; documented code tables [error-codes page; live step 4]
Duplicate prevention
live-observed: two identical creates with the same requestid returned the same record (same Id, SyncToken, CreateTime); exactly one record verified by query [sandbox write battery log]
Graceful handling under load
documented limits with 429 and explicit wait-60-seconds recovery guidance [limits-and-throttles page]
Pagination
STARTPOSITION/MAXRESULTS with ORDERBY and totalCount, documented 1000-row cap; disjoint pages live-verified [data-queries page; live step 2]
Bulk or incremental export
CDC endpoint (30-day lookback) plus updated-since queries with pagination, live-verified; batch endpoint supplements [cdc, batch pages; live step 3]
Webhook security and delivery reliability
(documentation-graded) - HMAC-SHA256 intuit-signature with verifier token, documented retry ladder (10s to 6h), and consumer ordering/dedup guidance [configure-webhooks, best-practices pages]
Concurrency and conflict control
SyncToken optimistic locking live-observed: stale-token write returned 400 with stable code 5010 Stale Object Error; concurrency limits documented [sandbox write battery log; limits page]
Versioning and backward compatibility
explicit version identifiers (v3 path plus minorversion parameter) and release notes, but the compatibility policy is thin: minor versions 1-74 were discontinued en masse in August 2025 and sub-75 pins are now silently ignored [minor-versions page]
Request traceability
intuit_tid and x-request-id observed on every live response; tracking identifier documented for support correlation [live step 5; SDK request-tracking page]
Service availability and status transparency
public status page with per-service 90-day uptime percentages, incident history, and a status API [status.developer.intuit.com]
Category 3 · Access Control
3.5 / 5Read-only credentials
the Accounting API has exactly one scope, com.intuit.quickbooks.accounting, granting read and write; no read-only option [scopes page]
Scoped credentials
bucket-level scoping only (accounting vs payments vs openid); nothing finer within accounting [scopes page]
Multiple keys
multiple apps per developer account, each with its own credential pair, plus separate Development and Production sets [credentials page; oauth guide]
Rotation and revocation
self-serve revoke endpoint documented; secrets regenerable in the dashboard [oauth guide]
Test and production isolation
separate Development and Production credentials, separate sandbox host, isolated sandbox companies (exercised by this run's sandbox battery) [credentials, sandboxes pages; live]
Category 4 · Docs & AI-Ready
4.4 / 5Complete self-serve reference
public per-entity reference with attributes, business rules, and worked request/response samples for every operation [invoice entity reference]
Reliable machine-consumable integration path
maintained official SDKs for Java/.NET/PHP covering core operations (Node/Ruby/Python are OAuth-focused); XSDs downloadable; no official OpenAPI specification evidenced [sdks page; release notes]
AI-readable documentation
per-page "Copy all for AI" affordance and an AI prompt library exist, but no llms.txt (404 verified) or downloadable documentation corpus [verified negative findings]
Kept current
four maintained release-note streams (general, Accounting API, minor versions, SDK) with dated entries [release-notes, minor-versions pages]
Category 5 · Access & Cost
7.5 / 15Self-serve API key
Development keys are instant, but Production credentials are gated behind a Production Key questionnaire and its approval [get-client-id-and-client-secret page]
Not commercially gated
the core Accounting API is included with any QBO subscription, but Premium APIs (Projects, 12-field Custom Fields, Sales Tax, Dimensions, Payroll Compensation) require Silver/Gold/Platinum partner tiers, and the Builder tier caps at 500K CorePlus calls per month [premium-apis, limits-and-throttles pages]
What works
- The highest Design and Reliability score on the board, 9.2 out of 10
- Optimistic locking that works: a stale-token write was rejected live
- Duplicate suppression proven live, two identical creates returned one record
- Signed webhooks with a documented retry ladder from 10 seconds to 6 hours
- Public status page with per-service 90-day uptime and a status API
What to watch
- One scope for the whole Accounting API: any key you issue can post entries
- No property, unit, lease, work-order or reconciliation objects
- Production credentials need Intuit to approve a questionnaire
- Minor versions 1 to 74 were retired at once, and old pins are now ignored
- No llms.txt or downloadable corpus, so AI tools scrape page by page
The bottom line for a property manager
You can build real automations on this API today: read and post anything on the ledger, get signed webhooks when data changes, sync full datasets incrementally, and retry writes safely thanks to duplicate suppression that was proven live. The engineering fundamentals are genuinely strong, and the Design and Reliability score is the best on this board. What drags the grade down is fit and access. There are no property, unit, lease, work-order or reconciliation objects, so QuickBooks Online can only ever be the general-ledger layer behind a PMS, and the all-or-nothing read and write scope means any integration or AI agent you connect can write to your books. It is not a substitute for a PMS or a trust-accounting system, and nothing in the API evidences trust or fiduciary workflows.
Check it yourself.
Both files behind this page, in full.
QuickBooks Online’s full report
The complete markdown report this page is built from, including the evidence packet, the run metadata and every check in full.
Download the QuickBooks Online reportThe grading file
The exact rubric behind every score on this page. Same file, every platform. Run it yourself and compare.
Download the methodologyFound a factual error in your grade?
Tell us and we will fix it. Every mark on this page traces to a specific piece of first-party evidence or a live API call, and the full report is published so you can see exactly what was checked and what it was checked against.
Confirmed factual errors are corrected immediately.
Everything else waits. We do not rescore piecemeal on request, because a board where some vendors have been re-run and others have not is not a fair comparison. Shipped improvements, changed documentation and disagreements about judgement all go into the next full rerun.
Contact us with a factual errorMethodology inspired by SaaStr’s AI Agent API Report Card. Sponsored by Column.