Expensify vs Ramp

Expensify

One endpoint exports reports through caller-written templates and creates expenses, reports, rules and workspace settings, with limits of 5 requests per 10 seconds published and a status page that tracks the API separately. There is no OpenAPI spec, changelog, SDK, pagination or idempotency key, and one credential pair carries the whole account's rights.

Ramp

OAuth 2.0 scopes split read from write across about 40 resources, a 260-operation OpenAPI spec is public, and an audit log endpoint records actions by user and agent. No public status page was found, 89 operations are marked beta, the API Agreement allows changes without notice, and idempotency keys cover only eight write operations.

Expensify

1. POST requestJobDescription as a form field to the single endpoint. Keep it out of the URL query string, because it carries the secret
2. Read responseCode in the body on every reply. HTTP status can be 200 on failure, and validation errors use 410
3. Stay under 5 requests per 10 seconds and 20 per 60 seconds. No Retry-After header is documented, so space retries yourself
4. Export in two calls. A file job returns a filename, then a download job fetches it. Amounts are in cents
5. Don't retry a create job blindly. No idempotency key exists, so export and check before resending. Set dry-run to true when testing the Advanced Employee Updater

Ramp

1. Send scope on the client credentials token request. Without it Ramp issues a token with no scopes and every resource call fails with 403
2. Follow the full URL in next to page. page_size defaults to 20 and stops at 100, and the cursor is opaque
3. Stay under 200 requests in any 10 seconds per source IP and back off 1, 2 then 4 seconds on 429. No Retry-After header is documented
4. Don't use synced_after or from_created_at to find changed records. Bills and transactions have no updated-at filter, so subscribe to webhooks
5. Send X-Idempotency-Key when creating funds or procurement requests. Elsewhere a retried POST can create a duplicate, so read back before retrying