Puzzle API and MCP vs Zoho Books

Puzzle API and MCP 15

Hosted reading. status.puzzle.io exists but answered 403 to our reader, so no status page or history could be read (0, then 5 for no readable history). No rate limits found in the API docs (0). The errors page documents 409 RESOURCE_PROCESSING with retry later and 500 with retry, but no 429 or idempotency guidance (5). No SLA (0). MCP read access is live, write access is a beta, and the API docs say the API is under development (5). 0 + 5 + 0 + 5 + 0 + 5 = 15.

Zoho Books 56

Graded on the REST API v3, read as a hosted service. status.zoho.com redirects to us.zohostatus.com, which lists a Zoho Books component (20, kept as on the other Zoho listings while the host is blocked). On 3 November 2026 that host answered robots.txt with a 404 carrying StatusIQ's access-denied error page, read as a refusal, so nothing else was requested there and the 8 October incident reading is struck. No incident history for the last 90 days could be read (5). Limits are published with numbers, 100 requests a minute per organisation, 1,000 to 10,000 a day by plan and 5 or 10 concurrent calls (15). 429 is documented with codes 44, 45 and 1070, but no Retry-After header or backoff guidance was found. X-Unique-Identifier-Key with X-Upsert makes 15 update operations safe to repeat, and creates have no idempotency key (6 of 15). No SLA found (0). v3 is the current documented version (10). 20 + 5 + 15 + 6 + 0 + 10 = 56.

Puzzle API and MCP 49

Closed service with published terms naming Puzzle Financial Inc. (15). A privacy policy effective 19 December 2025; the security page says data stays on US servers and isn't shared or sold (15). The API docs promise documented endpoints stay stable but give no deprecation policy (5). Sub-processors not found, though the server location is stated (8). 15 + 15 + 5 + 8 = 43.

Zoho Books 75

Closed service under the Zoho Terms of Service, last updated 2 March 2022 (15 of 30). The privacy policy of 22 December 2025 says Zoho does not sell personal information, and that data is deleted from the active database within six months of account termination and from backups three months later. The DPA is sent on request by email (24 of 30). No API deprecation policy or dated retirement notice was found. The help centre notes a new API domain from 1 June 2024 without an end date for the old one (0). A sub-processor page exists, but its directory loads by script and we could not read the list. The data centre page names locations and their certifications (15 of 20).

Puzzle API and MCP 15

No x402, MPP or L402 (0). Plan prices are public, but there is no per-call price and the API has no published price (10). "Try for free" on every plan, with trial length and card requirement not stated on the pages read (5). A person signs up and authorises in a browser, and API credentials come by email (0). 0 + 10 + 5 + 0 = 15.

Zoho Books 30

No x402, MPP or L402 (0). Plan prices are public, $15 to $240 an organisation a month billed yearly in the US edition. Calls have no unit price, and the API add-on that raises the daily limit has no public price (10). The Free plan includes 1,000 API requests a day per the plan comparison, and the signup steps on the pricing page ask for a company name, email address, phone number and password, with no card mentioned (20). A person signs up in a browser, registers an OAuth client in the developer console and approves scopes (0).

Puzzle API and MCP 65

The API reference on ReadMe is generated from an OpenAPI file, though we didn't download the file itself; the MCP tool schemas aren't published (18). llms.txt and Markdown pages on puzzle-api.readme.io (10). Endpoint descriptions name the required scope and explain defaults such as cash basis (14). Typed parameters with documented limits, such as companies capped at 100 a page (11). An error table with HTTP codes and errorContext shapes, and example requests (12). No changelog or version scheme found (0). 18 + 10 + 14 + 11 + 12 + 0 = 65.

Zoho Books 71

The docs link a downloadable archive, openapi-all.zip, holding OpenAPI 3.0.0 files for 45 resources and 885 operations (25). No llms.txt at zoho.com or under the API docs. Every operation in the API docs has a Markdown twin, and the help centre has an llms.txt, with 324 pages on 3 November 2026 (8 of 10). Operation descriptions are short (median 47 characters), while parameter descriptions name the call that supplies each ID. Little on when not to use an operation (14 of 20). Required fields are marked, but only 26 enums appear across the 45 files, allowed values sit in prose and filter_by is a string grammar (8 of 15). Each operation has request and response examples. The files declare only 200 and 201 responses, and the errors page lists eight HTTP statuses and three sample codes with no error catalogue (8 of 15). The version is in the path. No dated API changelog was found, and the product What's New page is dated and carries some API items (8 of 15).

Puzzle API and MCP 56

MCP tool count and sizes unpublished, so context cost can't be read (10 of 25). API list endpoints page with count and after or limit, and filter by date and status (16). Error codes and errorContext name the field or resource at fault (17). No idempotency keys found; the MCP server asks for confirmation before writes (8). No official SDKs; few required parameters on reads (5). 10 + 16 + 17 + 8 + 5 = 56.

Zoho Books 51

Graded on the REST API. Lists default to 200 records a page and per_page lowers that. No field selection parameter was found (10 of 25). page, per_page and has_more_page in page_context, with filter_by, search_text, sort_column and, on 17 operations, last_modified_time (18 of 20). Errors return a JSON code and message, documented thinly (10 of 20). Upsert by a unique custom field on 15 update operations, with no idempotency key on creates (8 of 20). No official SDK for the Books API was found, every call needs organization_id, access tokens last one hour and hosts differ by data centre (5 of 15).

Puzzle API and MCP 73

OAuth for MCP with a per-company choice and read-only default, and OAuth 2.0 with granular scopes on the API, defaulting to read-only scopes (28). Read-only by default, writes an opt-in beta with confirmation for each change (18). Bank descriptions and vendor names are third-party text, and no prompt-injection guidance was found (3). Every API request is logged per the docs, and a firm activity endpoint returns an audit log (12). A SOC 2 claim in the API docs and a bug bounty policy page; no security.txt (12). 28 + 18 + 3 + 12 + 12 = 73.

Zoho Books 68

OAuth 2.0 with scopes per module and operation (81 scope strings in the OpenAPI files, such as ZohoBooks.invoices.READ), one-hour access tokens and refresh tokens the user can revoke (30). Less 10 because the documented token and refresh calls carry the client secret and refresh token in the URL query string, and the page tells readers to use the query string (20 of 30). READ scopes per module allow a read-only agent. No approval step for deletes through the API was found (13 of 20). Records hold text from customers and vendors and no prompt-injection guidance was found. The MCP help page asks users to get an admin's approval first and to add tools only when required (3 of 15). The API Usage dashboard lists recent calls by user, module, IP address and application, and plans include an activity log (12 of 15). security.txt valid to 30 June 2028, a bug bounty, SOC 2 Type 2 and ISO/IEC 27001 (20).