{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "expensify", "name": "Expensify", "vendor": "Expensify, Inc.", "vendorUrl": "https://www.expensify.com", "kind": "http-api", "category": "spend-management", "summary": "Expensify is an expense management service with receipt scanning, expense reports, approvals, reimbursement and company cards. Its Integration Server API exports report and card data and creates expenses, reports and workspace settings. A hosted MCP server gives read-only search.", "url": "https://www.anchorterminal.com/tools/expensify", "markdownUrl": "https://www.anchorterminal.com/tools/expensify.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/expensify.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/expensify.json", "license": "Proprietary service under the Expensify Terms of Service. The Expensify app client and help articles on GitHub (Expensify/App) are MIT", "transports": [ "http" ], "remoteUrl": "https://integrations.expensify.com/Integration-Server/ExpensifyIntegrations", "packages": [], "auth": "mixed", "authNotes": "Access is self-serve for anyone with an Expensify account. Signing in at https://www.expensify.com/tools/integrations/ generates a partnerUserID and partnerUserSecret pair, shown once and replaceable on the same page. The pair travels inside the `requestJobDescription` form field and acts with the account's own rights, so domain and workspace admin jobs need an admin's credentials. Creating reports or expenses in other users' accounts needs Expensify to enable it for the domain by email to Concierge. OAuth2 for the API (authorisation code grant, scope `integrations:api`, two-hour access tokens, rotating refresh tokens) is in private beta by request form. The MCP server uses OAuth 2.1 with PKCE and the `mcp:tools` scope.", "pricing": "freemium", "pricingNotes": "No separate API fee is published. Collect is $5 per unique member a month, pay-per-use. Control is $18 per member a month on an annual subscription or $36 per active member pay-per-use, and as low as $9 with Expensify Card spend. A workspace starts a 30-day free trial, with a payment card asked for when it ends, and a free Submit workspace exists for individuals. An agent can start on the trial without a contract. No sandbox was found, and whether the API works without a paid plan wasn't established (checked 2026-10-08).", "priceSummary": "$5 / seat-mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Integration Server reference, the help articles or the pricing article (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://integrations.expensify.com/Integration-Server/doc/", "capabilities": [ "spend.transactions", "spend.expenses" ], "tags": [ "hosted", "freemium", "api-key", "oauth", "mcp", "soc2", "pci-dss" ], "graded": true, "anchor": { "graded": true, "score": 41.1, "grade": "E", "agentReady": false, "rank": 593, "ranked": true, "rankOf": 629, "categoryRank": 5, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 45, "maintenance": 23, "payments": 30, "reliability": 62, "schema": 28, "security": 34, "transparency": 58 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 62, "points": 12.4, "reason": "Read with the hosted lines and scored on the Integration Server API, the surface an outside agent can write through. A Statuspage site at status.expensify.com lists 20 components, with Integration APIs as its own (20). In the 90 days to 8 October 2026 no incident names Integration APIs. The website and app had four incidents of over an hour, on 9 August (critical, 8 hours 45 minutes, described as degraded performance), 19 August (critical, 2 hours 44 minutes), 31 August (major, 1 hour 42 minutes) and 18 September (major, 1 hour 16 minutes). The updates don't say whether the API was affected, and OAuth sign-in runs on www.expensify.com, so we scored between minor only and one major (15 of 30). Limits are published, 5 requests per 10 seconds and 20 per 60 seconds (15). The docs name status 429 but give no Retry-After header or backoff guidance, and no idempotency key exists for create jobs. A `test` flag on exports and `dry-run` on the Advanced Employee Updater are the only safe-retry aids (4 of 15). No SLA was found in the Terms of Service (0). The API is generally available. OAuth2 partner authentication is in private beta and the older Employee updater is marked no longer maintained (8 of 10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 28, "points": 4.55, "reason": "No OpenAPI or other machine-readable spec was found. The reference is one HTML page plus a page for the Advanced Employee Updater (0). www.expensify.com/llms.txt and help.expensify.com/llms.txt both return 404 (0). Each of the 16 documented jobs has a one-line purpose and notes on the admin rights it needs, with little on when not to use it (10 of 20). Parameter tables give format, valid values and required or optional for each field. The request itself is a JSON document inside a form field, and exports need a Freemarker template (8 of 15). Every job has a curl example and a sample error, and three jobs have an error code table. Codes are unconventional, with 410 for validation errors and 404 for a failed sign-in (10 of 15). The API has no version number and no changelog was found (0)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 45, "points": 7.31, "reason": "Exports return only the fields the caller's Freemarker template names, `limit` caps the number of reports, and the policy getter takes a `fields` list. An export is two calls, one to generate a file and one to download it (16 of 25). No pagination is documented. Filters cover report ID, workspace, start and end date, approved-after date, report state and an exported label (10 of 20). Errors are a `responseCode` and a `responseMessage` in the body, with specific messages such as a malformed date. There is no list of messages, and an invalid credential returned HTTP 200 with `responseCode` 404 when we tried it (9 of 20). No idempotency key is documented. The `markedAsExported` filter stops an export repeating, the report status updater returns 207 with lists of skipped and failed reports, and the employee updater has `dry-run` (5 of 20). One endpoint and few required fields per job. No official SDK was found (5 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 34, "points": 5.95, "reason": "A partnerUserID and partnerUserSecret pair is generated per account at www.expensify.com/tools/integrations, shown once and replaceable there. It acts with all of the account's rights. OAuth2 for the API is in private beta with one scope, `integrations:api`, two-hour access tokens and rotating refresh tokens. The MCP server uses OAuth 2.1 with PKCE (18 of 30). A Postman guide on Expensify's help site places `requestJobDescription`, which carries the secret, in the URL parameters, so the checklist's 10 comes off (8). The MCP server is read-only. The API has no scopes or read-only credential, creating on behalf of other users needs Expensify to enable it for the domain, and no confirmation step was found for writes (8 of 20). Merchant names and comments are untrusted text, and no prompt-injection guidance was found (3 of 15). An `onFinish` email can report what a job changed. No log of API calls was found in the docs (3 of 15). Expensify states annual SOC 1 Type 2 and SOC 2 Type 2 audits, PCI DSS compliance and yearly penetration tests, with reports on request at trust.expensify.com. security.txt returns 404 and no disclosure policy or bounty was found (12 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 30, "points": 3.75, "reason": "Read with the hosted rubric. No x402, MPP or L402 was found in the API docs or the pricing article (0). Prices are public per member, Collect at $5 a month and Control at $18 a month on an annual subscription or $36 pay-per-use. The API has no per-call price (10). A workspace starts a 30-day free trial and a payment card is asked for when it ends, and a free Submit workspace exists for individuals (20). A person has to create the account and open the integrations page in a browser to generate credentials (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 23, "points": 2.01, "reason": "No changelog or release record was found for the Integration Server API. The reference page carried a Last-Modified header of 8 October 2026, and its OAuth2 section is undated. The MCP help articles were first committed on 27 May 2026 and last revised on 28 September 2026. With no dated API change, half credit (15 of 30). No dated changelog entries (0). Support is Concierge by email or chat, and the help article says the API is self-serve and the customer's own team manages setup. Response times couldn't be observed (6 of 15). No official SDK was found, and the MCP server isn't in the official MCP registry (0). No package to assess. The API's response headers name GlassFish Server Open Source Edition 4.1.1 and Java 1.8 (2 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 58, "points": 5.08, "note": "editorial 41, provenance 75", "reason": "Closed service under the Terms of Service, last updated 10 September 2026. The Expensify app client is MIT on GitHub, and the API server is not public (15 of 30). The privacy policy (1 April 2026) says personal data is deleted as soon as practicable after an account ends, keeps data while an account is active, and lists California retention periods of up to 10 years by category. It states participation in the EU-U.S. Data Privacy Framework. No public data processing addendum was found on the pages read (17 of 30). The reference marks the Employee updater as no longer maintained with no end date, and the terms allow changes or discontinuation without prior notice (3 of 20). The terms and privacy policy name OpenAI, Spotnana and Aircall as providers. No full sub-processor list or data location statement was read, and the trust centre renders with JavaScript (6 of 20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Exports return only the fields the caller's Freemarker template names, `limit` caps the number of reports, and the policy getter takes a `fields` list. An export is two calls, one to generate a file and one to download it (16 of 25). No pagination is documented. Filters cover report ID, workspace, start and end date, approved-after date, report state and an exported label (10 of 20). Errors are a `responseCode` and a `responseMessage` in the body, with specific messages such as a malformed date. There is no list of messages, and an invalid credential returned HTTP 200 with `responseCode` 404 when we tried it (9 of 20). No idempotency key is documented. The `markedAsExported` filter stops an export repeating, the report status updater returns 207 with lists of skipped and failed reports, and the employee updater has `dry-run` (5 of 20). One endpoint and few required fields per job. No official SDK was found (5 of 15).", "maintenance": "No changelog or release record was found for the Integration Server API. The reference page carried a Last-Modified header of 8 October 2026, and its OAuth2 section is undated. The MCP help articles were first committed on 27 May 2026 and last revised on 28 September 2026. With no dated API change, half credit (15 of 30). No dated changelog entries (0). Support is Concierge by email or chat, and the help article says the API is self-serve and the customer's own team manages setup. Response times couldn't be observed (6 of 15). No official SDK was found, and the MCP server isn't in the official MCP registry (0). No package to assess. The API's response headers name GlassFish Server Open Source Edition 4.1.1 and Java 1.8 (2 of 10).", "payments": "Read with the hosted rubric. No x402, MPP or L402 was found in the API docs or the pricing article (0). Prices are public per member, Collect at $5 a month and Control at $18 a month on an annual subscription or $36 pay-per-use. The API has no per-call price (10). A workspace starts a 30-day free trial and a payment card is asked for when it ends, and a free Submit workspace exists for individuals (20). A person has to create the account and open the integrations page in a browser to generate credentials (0).", "reliability": "Read with the hosted lines and scored on the Integration Server API, the surface an outside agent can write through. A Statuspage site at status.expensify.com lists 20 components, with Integration APIs as its own (20). In the 90 days to 8 October 2026 no incident names Integration APIs. The website and app had four incidents of over an hour, on 9 August (critical, 8 hours 45 minutes, described as degraded performance), 19 August (critical, 2 hours 44 minutes), 31 August (major, 1 hour 42 minutes) and 18 September (major, 1 hour 16 minutes). The updates don't say whether the API was affected, and OAuth sign-in runs on www.expensify.com, so we scored between minor only and one major (15 of 30). Limits are published, 5 requests per 10 seconds and 20 per 60 seconds (15). The docs name status 429 but give no Retry-After header or backoff guidance, and no idempotency key exists for create jobs. A `test` flag on exports and `dry-run` on the Advanced Employee Updater are the only safe-retry aids (4 of 15). No SLA was found in the Terms of Service (0). The API is generally available. OAuth2 partner authentication is in private beta and the older Employee updater is marked no longer maintained (8 of 10).", "schema": "No OpenAPI or other machine-readable spec was found. The reference is one HTML page plus a page for the Advanced Employee Updater (0). www.expensify.com/llms.txt and help.expensify.com/llms.txt both return 404 (0). Each of the 16 documented jobs has a one-line purpose and notes on the admin rights it needs, with little on when not to use it (10 of 20). Parameter tables give format, valid values and required or optional for each field. The request itself is a JSON document inside a form field, and exports need a Freemarker template (8 of 15). Every job has a curl example and a sample error, and three jobs have an error code table. Codes are unconventional, with 410 for validation errors and 404 for a failed sign-in (10 of 15). The API has no version number and no changelog was found (0).", "security": "A partnerUserID and partnerUserSecret pair is generated per account at www.expensify.com/tools/integrations, shown once and replaceable there. It acts with all of the account's rights. OAuth2 for the API is in private beta with one scope, `integrations:api`, two-hour access tokens and rotating refresh tokens. The MCP server uses OAuth 2.1 with PKCE (18 of 30). A Postman guide on Expensify's help site places `requestJobDescription`, which carries the secret, in the URL parameters, so the checklist's 10 comes off (8). The MCP server is read-only. The API has no scopes or read-only credential, creating on behalf of other users needs Expensify to enable it for the domain, and no confirmation step was found for writes (8 of 20). Merchant names and comments are untrusted text, and no prompt-injection guidance was found (3 of 15). An `onFinish` email can report what a job changed. No log of API calls was found in the docs (3 of 15). Expensify states annual SOC 1 Type 2 and SOC 2 Type 2 audits, PCI DSS compliance and yearly penetration tests, with reports on request at trust.expensify.com. security.txt returns 404 and no disclosure policy or bounty was found (12 of 20).", "transparency": "Closed service under the Terms of Service, last updated 10 September 2026. The Expensify app client is MIT on GitHub, and the API server is not public (15 of 30). The privacy policy (1 April 2026) says personal data is deleted as soon as practicable after an account ends, keeps data while an account is active, and lists California retention periods of up to 10 years by category. It states participation in the EU-U.S. Data Privacy Framework. No public data processing addendum was found on the pages read (17 of 30). The reference marks the Employee updater as no longer maintained with no end date, and the terms allow changes or discontinuation without prior notice (3 of 20). The terms and privacy policy name OpenAI, Spotnana and Aircall as providers. No full sub-processor list or data location statement was read, and the trust centre renders with JavaScript (6 of 20)." }, "sources": [ { "what": "Integration Server API reference", "url": "https://integrations.expensify.com/Integration-Server/doc/", "seen": "2026-10-08" }, { "what": "Advanced Employee Updater reference", "url": "https://integrations.expensify.com/Integration-Server/doc/employeeUpdater/", "seen": "2026-10-08" }, { "what": "API help article with limits and Postman guides", "url": "https://help.expensify.com/articles/new-expensify/connections/Expensify-API", "seen": "2026-10-08" }, { "what": "MCP server help article", "url": "https://help.expensify.com/articles/new-expensify/connections/connect-ai-assistants/Use-the-Expensify-MCP-Server-With-AI-Assistants", "seen": "2026-10-08" }, { "what": "Claude connection guide for the MCP server", "url": "https://help.expensify.com/articles/new-expensify/connections/connect-ai-assistants/Connect-Claude-to-Expensify-Using-MCP", "seen": "2026-10-08" }, { "what": "OAuth authorisation server metadata", "url": "https://www.expensify.com/.well-known/oauth-authorization-server", "seen": "2026-10-08" }, { "what": "pricing help article", "url": "https://help.expensify.com/articles/new-expensify/billing-and-subscriptions/explore-plans-subscriptions-and-pricing/Understand-Expensify-Pricing", "seen": "2026-10-08" }, { "what": "pricing page, rendered with JavaScript", "url": "https://www.expensify.com/pricing", "seen": "2026-10-08" }, { "what": "status page incidents", "url": "https://status.expensify.com/api/v2/incidents.json", "seen": "2026-10-08" }, { "what": "status page components", "url": "https://status.expensify.com/api/v2/summary.json", "seen": "2026-10-08" }, { "what": "Terms of Service", "url": "https://www.expensify.com/terms", "seen": "2026-10-08" }, { "what": "privacy policy", "url": "https://www.expensify.com/privacy", "seen": "2026-10-08" }, { "what": "encryption and data security help article", "url": "https://help.expensify.com/articles/new-expensify/settings/Encryption-and-Data-Security", "seen": "2026-10-08" }, { "what": "compliance documentation help article", "url": "https://help.expensify.com/articles/Unlisted/Compliance-Documentation", "seen": "2026-10-08" }, { "what": "security.txt, returns 404", "url": "https://www.expensify.com/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "help articles source and commit history", "url": "https://github.com/Expensify/App/tree/main/docs/articles", "seen": "2026-10-08" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=expensify", "seen": "2026-10-08" }, { "what": "RDAP for expensify.com", "url": "https://rdap.verisign.com/com/v1/domain/expensify.com", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: the pricing page at www.expensify.com/pricing renders with JavaScript. Prices come from Expensify's pricing help article", "unchecked: trust.expensify.com renders with JavaScript, so the sub-processor list, the security reports and any disclosure policy there weren't read", "unchecked: whether API credentials work on the free Submit workspace or during the trial without a paid plan. The reference only says to create an account", "unchecked: whether 429 responses carry a Retry-After header", "unchecked: the MCP server's tool list, input schemas and annotations, which need a signed-in account. The help article describes one Search tool", "unchecked: whether an SLA or a data processing addendum is available under a Statement of Work. Neither was found in the Terms of Service or the privacy policy", "unchecked: when the Integration Server API last changed. No changelog exists, and the Last-Modified header of 8 October 2026 may reflect a redeploy", "The lead named only the Integration Server API. Expensify also runs a read-only MCP server at https://www.expensify.com/mcp, and OAuth2 for the API is in private beta by request form", "The 10-point query string deduction rests on a customer-written Postman guide published on Expensify's help site. The reference's own examples send the secret in the POST body", "The four website incidents of over an hour in the last 90 days don't name the Integration APIs component, and their updates give no detail. The incident score of 15 is a judgement between 20 and 10" ] }, "negative": 0, "verdict": "One endpoint exports reports through caller-written templates and creates expenses, reports, rules and workspace settings, with limits of 5 requests per 10 seconds published and a status page that tracks the API separately. There is no OpenAPI spec, changelog, SDK, pagination or idempotency key, and one credential pair carries the whole account's rights.", "bestFor": "A finance team already on Expensify that wants an agent to export approved reports to an accounting system, create expenses and reports, keep categories, tags and employees in step with an HR system, or mark reports reimbursed.", "strengths": [ "Export templates written in Freemarker let the caller choose every output field, in CSV, XLS, XLSX, TXT, PDF, JSON or XML, filtered by date, state, workspace and report ID", "Rate limits are published as 5 requests per 10 seconds and 20 per 60 seconds, with status 429 when exceeded", "The status page lists Integration APIs as its own component, and no incident in the 90 days to 8 October 2026 names it", "The hosted MCP server at https://www.expensify.com/mcp is read-only and uses OAuth 2.1 with PKCE, the `mcp:tools` scope and a revocation endpoint", "Every job in the reference has a curl example, a parameter table with valid values and a sample error response" ], "weaknesses": [ "No OpenAPI spec, llms.txt, version number or changelog was found for the Integration Server API", "The partnerUserID and partnerUserSecret pair acts with all of the account's rights. No scopes or read-only credential were found for the API", "No idempotency key or pagination is documented, and no official SDK was found", "Errors arrive as `responseCode` in the body. An invalid credential returned HTTP 200 with `responseCode` 404 when we tried it on 8 October 2026", "The Terms of Service allow Expensify to modify or discontinue the service at any time without prior notice, and no SLA was found" ], "agentNotes": [ "POST `requestJobDescription` as a form field to the single endpoint. Keep it out of the URL query string, because it carries the secret", "Read `responseCode` in the body on every reply. HTTP status can be 200 on failure, and validation errors use 410", "Stay under 5 requests per 10 seconds and 20 per 60 seconds. No Retry-After header is documented, so space retries yourself", "Export in two calls. A `file` job returns a filename, then a `download` job fetches it. Amounts are in cents", "Don't retry a create job blindly. No idempotency key exists, so export and check before resending. Set `dry-run` to true when testing the Advanced Employee Updater" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 41.1 } ], "editorialScores": { "ergonomics": 45, "maintenance": 23, "payments": 30, "reliability": 62, "schema": 28, "security": 34, "transparency": 41 }, "provenanceScore": 75 }, "connect": { "http": "curl -X POST 'https://integrations.expensify.com/Integration-Server/ExpensifyIntegrations' \\\n -d 'requestJobDescription={\"type\":\"get\",\"credentials\":{\"partnerUserID\":\"_REPLACE_\",\"partnerUserSecret\":\"_REPLACE_\"},\"inputSettings\":{\"type\":\"policyList\"}}'" }, "letme": { "capability": "https://letme.dev/spend.transactions", "tool": "https://letme.dev/expensify" }, "notable": [ "Every call is a POST to one endpoint with a JSON `requestJobDescription` form field naming the job type, the credentials and the input settings (https://integrations.expensify.com/Integration-Server/doc/)", "16 documented jobs. Export covers reports, card reconciliation and file download. Create covers reports, expenses, workspaces and expense rules. Get covers workspace details, the workspace list and domain cards. Update covers workspace categories and tags, employees, expense rules, report status and tag approvers (https://integrations.expensify.com/Integration-Server/doc/)", "Report exports take a caller-written Freemarker template and return CSV, XLS, XLSX, TXT, PDF, JSON or XML, with optional email, SFTP upload and mark-as-exported actions on finish (https://integrations.expensify.com/Integration-Server/doc/)", "Rate limits are 5 requests per 10 seconds and 20 per 60 seconds, with status 429 beyond them (https://integrations.expensify.com/Integration-Server/doc/#rate-limits)", "The report status updater supports one action, marking Approved reports as Reimbursed, and returns 207 with lists of skipped and failed reports (https://integrations.expensify.com/Integration-Server/doc/)", "A hosted MCP server at https://www.expensify.com/mcp exposes Expensify Search read-only over OAuth 2.1 with PKCE. It can't create, edit, approve or reimburse (https://help.expensify.com/articles/new-expensify/connections/connect-ai-assistants/Use-the-Expensify-MCP-Server-With-AI-Assistants)", "OAuth2 partner authentication for the API is in private beta by request form, with the single scope `integrations:api` (https://integrations.expensify.com/Integration-Server/doc/#authentication)", "The Terms of Service, last updated 10 September 2026, reserve the right to modify or discontinue the service at any time without prior notice (https://www.expensify.com/terms)" ], "area": "domain-data", "details": [ { "label": "API", "value": "Integration Server API, one endpoint at https://integrations.expensify.com/Integration-Server/ExpensifyIntegrations, 16 documented jobs, no version number and no OpenAPI spec" }, { "label": "MCP server", "value": "https://www.expensify.com/mcp, read-only Expensify Search, OAuth 2.1 with PKCE (S256), scope `mcp:tools`, registration and revocation endpoints. Guides for Claude, ChatGPT and Cursor" }, { "label": "Credentials", "value": "partnerUserID and partnerUserSecret per account, shown once, replaceable at www.expensify.com/tools/integrations. OAuth2 for the API in private beta, with two-hour access tokens and rotating refresh tokens" }, { "label": "Rate limits", "value": "5 requests per 10 seconds and 20 per 60 seconds. Status 429 beyond them. No Retry-After documented" }, { "label": "Exports", "value": "Freemarker template chosen by the caller. Filters by report ID, workspace, date range, approved-after date, state and exported label, with `limit` on the number of reports. Two calls, generate then download" }, { "label": "Writes", "value": "Create reports, expenses, workspaces and expense rules. Update categories, tags, report fields, employees, tag approvers and report status (Approved to Reimbursed only)" }, { "label": "Errors", "value": "`responseCode` and `responseMessage` in the body. 404 sign-in failure or workspace not found, 403 not an admin, 410 validation, 500 generic, 207 partial success" }, { "label": "Testing", "value": "No sandbox found. `test` on exports skips the on-finish actions, and `dry-run` on the Advanced Employee Updater makes no changes" }, { "label": "Pagination and idempotency", "value": "Neither is documented" }, { "label": "Certifications", "value": "Annual SOC 1 Type 2 and SOC 2 Type 2 audits and PCI DSS compliance per Expensify's help site, with reports on request at trust.expensify.com" }, { "label": "Status", "value": "status.expensify.com, 20 components including Integration APIs" } ], "unitPrices": [ { "item": "Collect plan, pay-per-use", "unit": "seat-month", "usd": 5, "note": "Per unique member. No separate API fee is published" }, { "item": "Control plan, annual subscription", "unit": "seat-month", "usd": 18, "note": "As low as $9 with Expensify Card spend. Active members above the subscription size are $36" }, { "item": "Control plan, pay-per-use", "unit": "seat-month", "usd": 36, "note": "Per active member" } ], "provenance": { "legalEntity": "Expensify, Inc.", "domain": "expensify.com", "domainRegistered": "2007-10-26", "endpointOnVendorDomain": true, "terms": "https://www.expensify.com/terms", "privacy": "https://www.expensify.com/privacy", "statusPage": "https://status.expensify.com", "changelog": "", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The Terms of Service (last updated 10 September 2026) name Expensify, Inc., 401 SW 5th Ave, Portland, OR 97204, and govern the Expensify Service including related software and tools. No separate API agreement was found.", "The privacy policy (last updated 1 April 2026) is issued for the Expensify group and names Expensify, Inc. as controller.", "The API answers at integrations.expensify.com and the MCP server at www.expensify.com/mcp.", "https://www.expensify.com/.well-known/security.txt returned 404 on 8 October 2026.", "No changelog was found for the Integration Server API.", "RDAP for expensify.com gives a registration date of 2007-10-26." ], "score": 75, "checks": [ { "check": "Legal entity named", "value": "Expensify, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "expensify.com, registered 2007-10-26 (18 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "integrations.expensify.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 6 of the 7 things a reader expects, and has 2 clauses that cost points", "points": 5.1, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects", "points": 10, "max": 10, "state": "ok" }, { "check": "Status page", "value": "status.expensify.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://www.expensify.com/terms", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-09-10", "words": 14967, "points": 5.1, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated: September 10, 2026", "says": "Last updated 2026-09-10" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "9.6 Arbitrator's Decision and Governing Law These Terms of Service and the rights of the parties hereunder shall be governed by and construed in accordance with the laws of the State of California, exclusive of conflict or choice of law rules.", "says": "The law of the State of California" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "EXCEPT FOR THE INDEMNITY OBLIGATIONS SET FORTH HEREIN, IN NO EVENT WILL EXPENSIFY'S AGGREGATE LIABILITY ARISING OUT OF OR IN CONNECTION WITH THESE TERMS OF SERVICE OR FROM THE USE OF OR INABILITY TO USE THE EXPENSIFY SERVICE OR SITE CONTENT EXCEED THE AMOUNTS YOU HAVE PAID TO EXPENSIFY FOR USE OF THE EXPENSIFY SERVICE…" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "…we have grounds to suspect that such information is untrue, inaccurate, not current, or incomplete, we may suspend or terminate your Account and refuse any and all current or future use of the Expensify Service (or any portion thereof)." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "Expensify reserves the right, at its sole discretion, to modify, discontinue or terminate the Expensify Service or to modify these Terms of Service, at any time and without prior notice.", "says": "Says it gives notice of a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "If you do not meet all of these requirements, you must not access or use the Expensify Service." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "agent, device or mechanism (including spiders, robots, crawlers, data mining tools", "costsPoints": true }, { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "Expensify reserves the right, at its sole discretion, to modify, discontinue or terminate the Expensify Service or to modify these Terms of Service, at any time and without prior notice.", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "Expensify reserves the right, at its sole discretion, to modify, discontinue or terminate the Expensify Service or to modify these Terms of Service, at any time and without prior notice." }, { "key": "terms.arbitration", "label": "Requires arbitration or waives class actions", "found": true, "quote": "disputes by individual arbitration and to waive the right to participate in any kind" } ], "notes": [ { "date": "2026-10-08", "text": "The terms say a member may not authorise any third party to access or use the service on the member's behalf.", "quote": "You may not authorize any third party to access or use the Expensify Service or any payment" }, { "date": "2026-10-08", "text": "Members grant Expensify, its affiliates and service providers a transferable, sub-licensable licence to use, distribute, modify and copy member-generated content.", "quote": "sub-licensable, royalty-free, and worldwide, license to use, distribute, modify, run, copy," }, { "date": "2026-10-08", "text": "The terms say Expensify may share member-generated content with third party services, naming OpenAI.", "quote": "Member-Generated Content with third party services, including but not limited to OpenAI," } ] }, { "kind": "privacy", "url": "https://www.expensify.com/privacy", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-04-01", "words": 13947, "points": 10, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated: April 1, 2026", "says": "Last updated 2026-04-01" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "This privacy policy (\"Privacy Policy\" or \"Policy\") describes how we collect, use, disclose, share and secure the personal and company information you provide when you use our expense management, invoicing or bill processing software, through our mobile application (the \"Application\") or visit the Expensify websites ww…" }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "If you request deletion, subject to our rights to retain the Personal Data as set out in this Privacy Policy and the rights of any Corporate Member to retain the Personal Data as set forth below, we will respond to your request within 1 month.", "says": "Names a period of 1 month" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "We may share your geo-location data with third parties for the sole purpose of providing these services." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "Except as otherwise stated in this policy and our Terms of Service, we do not sell, trade, share, or rent the Personal Data collected from the Expensify Service to third parties.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "9.1 Access to Data Controlled by our Corporate Members You have the right to access your Personal Data subject to any exceptions which may apply in the jurisdiction in which you reside." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "To contact us with questions about our compliance with state general privacy laws, please reach out to privacy@expensify.com.", "says": "privacy@expensify.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "Data Privacy Framework, and more information about these programs is also provided below.", "says": "Relies on the Data Privacy Framework" } ], "toKnow": [ { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "We may share personal information about you for cross-context behavioral advertising — seeking to place ads to you on others' digital properties based, at least in part, on personal information obtained from your activity on others' digital properties." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/expensify.json", "live": { "slug": "expensify", "probe": { "target": "https://integrations.expensify.com/Integration-Server/ExpensifyIntegrations", "method": "get", "lastAt": "2026-10-08T19:08:46.235159528Z", "lastOk": true, "lastStatus": 200, "lastMs": 550, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 447, "p95ms24h": 550, "samples24h": 19, "samples30d": 19, "days": [ { "date": "2026-10-08", "probes": 19, "ok": 19 } ] }, "vendorStatus": { "page": "https://status.expensify.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-08T19:06:38.6773069Z" }, "pages": [ { "url": "https://www.expensify.com/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:27:38.986175098Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "a6875581ee6f" }, { "url": "https://www.expensify.com/terms", "kind": "terms", "status": 200, "checkedAt": "2026-10-08T18:27:41.220273608Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "2df10b1a9dea" } ], "updatedAt": "2026-10-08T19:08:46.235159528Z" } } }