Pennylane vs Zoho Books

Pennylane

The v2 API has per-resource read and write scopes, an OpenAPI definition on every reference page, llms.txt and a breaking-change process that ran over 24 weeks. Access needs a paid Essentiel plan or partner approval, creation endpoints are not idempotent, and the API agreement lets Pennylane change or revoke the API without notice.

Zoho Books

The public OpenAPI files cover 885 operations with OAuth scopes per module and operation, and the Free plan allows 1,000 API requests a day. No report endpoint, official SDK, SLA or dated API changelog was found, and the documented token calls put the client secret in the URL.

Pennylane

1. Call GET https://app.pennylane.com/api/external/v2/me first to confirm the token, user and company context
2. Stay under 25 requests per 5 seconds per token and wait for the retry-after value on a 429
3. Do not retry a create after a timeout without checking first. Only supplier invoice imports are deduplicated
4. Send filter and sort again with every cursor. The cursor stores position only
5. Send amounts as strings such as "120.00", and ask for :readonly scopes when the task only reads
6. Use the MCP server for reads only. It cannot create, edit or delete, and firm connections need company_id

Zoho Books

1. Send organization_id as a query parameter on every call. Read it from GET /organizations first
2. Use the api_domain returned with the token, since each of the nine data centres has its own host (zohoapis.com, zohoapis.eu, zohoapis.in and others)
3. Send Authorization: Zoho-oauthtoken <token> and refresh hourly. Each user keeps at most 20 refresh tokens and the oldest is deleted
4. Stay under 100 requests a minute and the plan's daily cap. Codes 44, 45 and 1070 on a 429 mean minute, day and concurrency limits
5. To repeat an update safely, send X-Unique-Identifier-Key, X-Unique-Identifier-Value and X-Upsert with a unique custom field. Creates have no idempotency key