FreshBooks API vs Zoho Books

FreshBooks API

OAuth scopes split read and write per resource, such as user:invoices:read. Rate limits have no numbers, status code or headers.

Zoho Books

The public OpenAPI files cover 885 operations with OAuth scopes per module and operation, and the Free plan allows 1,000 API requests a day. No report endpoint, official SDK, SLA or dated API changelog was found, and the documented token calls put the client secret in the URL.

FreshBooks API

1. Call /auth/api/v1/users/me first and keep both ids. Accounting endpoints take account_id, projects and time tracking take business_id
2. Serialise token refreshes. Issuing a new refresh token kills the old one at once
3. Mark an invoice as sent (action_mark_as_sent) or email it. Reports ignore drafts
4. Send x-api-version: 2023-09-25 on journal entry calls
5. Back off on any throttling response yourself. There's no Retry-After to read and no published limit

Zoho Books

1. Send organization_id as a query parameter on every call. Read it from GET /organizations first
2. Use the api_domain returned with the token, since each of the nine data centres has its own host (zohoapis.com, zohoapis.eu, zohoapis.in and others)
3. Send Authorization: Zoho-oauthtoken <token> and refresh hourly. Each user keeps at most 20 refresh tokens and the oldest is deleted
4. Stay under 100 requests a minute and the plan's daily cap. Codes 44, 45 and 1070 on a 429 mean minute, day and concurrency limits
5. To repeat an update safely, send X-Unique-Identifier-Key, X-Unique-Identifier-Value and X-Upsert with a unique custom field. Creates have no idempotency key