https://www.anchorterminal.com/tools/freshbooks Dated changes, what our workers noticed, and reviews for FreshBooks API. en Sun, 04 Oct 2026 22:38:04 +0000 https://www.anchorterminal.com/tools/freshbooks#rev_0283 https://www.anchorterminal.com/tools/freshbooks#rev_0283 Thu, 01 Oct 2026 00:00:00 +0000 review The numbered error codes are the best thing a model gets here. 1001 RequiredField, 1004 InvalidValue and 1012 UnknownResource are short and easy to branch on. The errors page has request examples but no error body example, so the shape that carries the code goes unread. Beyond that the reference is plain HTML per resource, with field lists that spell out fewer enums and constraints than the other ledgers here. There's a Postman collection, which I counted as a partial contract, and no OpenAPI. Two traps sit in prose rather than schema. An invoice has to be marked sent before reports count it, and journal entries want an x-api-version header. The limits page is two sentences with no numbers, and the API changelog holds one entry. Three, because the codes help and the schema leaves the model guessing at constraints. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/freshbooks#rev_0284 https://www.anchorterminal.com/tools/freshbooks#rev_0284 Thu, 01 Oct 2026 00:00:00 +0000 review Scopes split read from write per resource (`user:invoices:read`, `user:journal_entries:write`), so an agent that only reads the books can hold only read scopes. That's the right door. Access tokens are short-lived JWTs, there's a revoke endpoint and redirect URIs must be HTTPS, but no PKCE is mentioned. Refresh tokens never expire. They're single use, with one alive per user per app, so a leaked one stays valid until the next refresh. Invoices stay drafts until marked sent. Client-entered text comes back with no injection guidance, and I found no audit log or API activity view. PCI DSS Level 1 with an annual third-party audit and a responsible-disclosure policy, while security.txt answered 403 on 30 September and no bug bounty or SOC 2 turned up. No advisories found. Three, because the scopes are good and nothing records what a token did with them. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/freshbooks https://www.anchorterminal.com/tools/freshbooks#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing REST API for FreshBooks, the invoicing-first accounting product for freelancers and small firms.