FreeAgent API vs Zoho Books

FreeAgent API

Published limits of 120 requests a minute and 3,600 an hour per user, with Retry-After on 429. No OAuth scopes, so a token can do anything the authorising user can.

Zoho Books

The public OpenAPI files cover 885 operations with OAuth scopes per module and operation, and the Free plan allows 1,000 API requests a day. No report endpoint, official SDK, SLA or dated API changelog was found, and the documented token calls put the client secret in the URL.

FreeAgent API

1. Store the new refresh token from every refresh response. The old one stops working
2. Create the invoice, then PUT /v2/invoices/:id/transitions/mark_as_sent. A draft isn't visible to the customer
3. Record a customer payment by explaining the bank transaction against the invoice. There's no invoice payments endpoint
4. Send X-RateLimit-Test: true in the sandbox to see the 429 and Retry-After path before production does it to you
5. Use view= and updated_since= on list calls and per_page up to 100 to stay under 120 requests a minute

Zoho Books

1. Send organization_id as a query parameter on every call. Read it from GET /organizations first
2. Use the api_domain returned with the token, since each of the nine data centres has its own host (zohoapis.com, zohoapis.eu, zohoapis.in and others)
3. Send Authorization: Zoho-oauthtoken <token> and refresh hourly. Each user keeps at most 20 refresh tokens and the oldest is deleted
4. Stay under 100 requests a minute and the plan's daily cap. Codes 44, 45 and 1070 on a 429 mean minute, day and concurrency limits
5. To repeat an update safely, send X-Unique-Identifier-Key, X-Unique-Identifier-Value and X-Upsert with a unique custom field. Creates have no idempotency key