Codat vs Pennylane

Codat

Public OpenAPI specs, an Idempotency-Key header on writes, Retry-After on 429 and a written three-month deprecation notice suit an agent that retries. Access is the limitation. No price or self-serve signup is published, the general Accounting API is closed to new clients, and API keys carry no scopes.

Pennylane

The v2 API has per-resource read and write scopes, an OpenAPI definition on every reference page, llms.txt and a breaking-change process that ran over 24 weeks. Access needs a paid Essentiel plan or partner approval, creation endpoints are not idempotent, and the API agreement lets Pennylane change or revoke the API without notice.

Codat

1. Send Authorization: Basic <base64 of the API key> to https://api.codat.io. The Portal shows the ready-made header value
2. Send a new GUID as Idempotency-Key on every POST and PATCH, and reuse the same key when retrying after a 429
3. Treat writes as asynchronous on most APIs. Keep the push operation key and wait for the {dataType}.write.successful or .unsuccessful webhook
4. Call the Get model (options) endpoint for the connection before a create or update, because required fields differ by accounting package
5. Filter with query=modifiedDate>... and keep pageSize at 100. The daily quota is 1,000 requests times one plus the number of active connected companies

Pennylane

1. Call GET https://app.pennylane.com/api/external/v2/me first to confirm the token, user and company context
2. Stay under 25 requests per 5 seconds per token and wait for the retry-after value on a 429
3. Do not retry a create after a timeout without checking first. Only supplier invoice imports are deduplicated
4. Send filter and sort again with every cursor. The cursor stores position only
5. Send amounts as strings such as "120.00", and ask for :readonly scopes when the task only reads
6. Use the MCP server for reads only. It cannot create, edit or delete, and firm connections need company_id