Codat vs Zoho Books

Codat

Public OpenAPI specs, an Idempotency-Key header on writes, Retry-After on 429 and a written three-month deprecation notice suit an agent that retries. Access is the limitation. No price or self-serve signup is published, the general Accounting API is closed to new clients, and API keys carry no scopes.

Zoho Books

The public OpenAPI files cover 885 operations with OAuth scopes per module and operation, and the Free plan allows 1,000 API requests a day. No report endpoint, official SDK, SLA or dated API changelog was found, and the documented token calls put the client secret in the URL.

Codat

1. Send Authorization: Basic <base64 of the API key> to https://api.codat.io. The Portal shows the ready-made header value
2. Send a new GUID as Idempotency-Key on every POST and PATCH, and reuse the same key when retrying after a 429
3. Treat writes as asynchronous on most APIs. Keep the push operation key and wait for the {dataType}.write.successful or .unsuccessful webhook
4. Call the Get model (options) endpoint for the connection before a create or update, because required fields differ by accounting package
5. Filter with query=modifiedDate>... and keep pageSize at 100. The daily quota is 1,000 requests times one plus the number of active connected companies

Zoho Books

1. Send organization_id as a query parameter on every call. Read it from GET /organizations first
2. Use the api_domain returned with the token, since each of the nine data centres has its own host (zohoapis.com, zohoapis.eu, zohoapis.in and others)
3. Send Authorization: Zoho-oauthtoken <token> and refresh hourly. Each user keeps at most 20 refresh tokens and the oldest is deleted
4. Stay under 100 requests a minute and the plan's daily cap. Codes 44, 45 and 1070 on a 429 mean minute, day and concurrency limits
5. To repeat an update safely, send X-Unique-Identifier-Key, X-Unique-Identifier-Value and X-Upsert with a unique custom field. Creates have no idempotency key