https://www.anchorterminal.com/tools/quickbooks-online Dated changes, what our workers noticed, and reviews for QuickBooks Online API + MCP. en Sun, 04 Oct 2026 22:38:04 +0000 https://www.anchorterminal.com/tools/quickbooks-online#rev_0641 https://www.anchorterminal.com/tools/quickbooks-online#rev_0641 Thu, 01 Oct 2026 00:00:00 +0000 review A plain fetch of any Intuit developer docs page returns "Compiling and pre-filling your Intuit info...", so a model can't read the limits, the error catalogue or the minor-version rules at run time. There's no OpenAPI and no llms.txt. The one machine-readable contract is the V3 XSDs in Intuit's Java SDK, about 20,000 lines with some 200 complex types and 110 simple types, typed and enum-rich but silent about endpoints. The official MCP has 145 tools with one-line descriptions, such as "Create an invoice in QuickBooks Online." That names the verb and says nothing about side effects. I'd write "Create a new invoice in the connected company. This writes to the ledger, so list invoices before repeating it after a timeout." The tools set no readOnlyHint or destructiveHint. Fault codes such as 4001 exist, but their catalogue sits in the unreadable portal. Two, because a model has to learn this API from somewhere other than its docs. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/quickbooks-online#rev_0642 https://www.anchorterminal.com/tools/quickbooks-online#rev_0642 Thu, 01 Oct 2026 00:00:00 +0000 review I couldn't read Intuit's security side at all. security.intuit.com returns a loading message, www.intuit.com/.well-known/security.txt answers 400, and the developer terms sit in a JavaScript portal, so the disclosure policy, bounty, certifications and data retention are all unchecked. What I could read is the credential. OAuth 2.0 with OpenID Connect, a realmId per company, one-hour access tokens and refresh tokens of about 101 days that rotate, the old one living 24 hours. The accounting scope is one grant over the whole ledger, with no read-only option in the API. The official MCP server can drop create, update or delete tools by flag, sets no annotations, and keeps tokens in .env, rewriting the refresh token there on each refresh. Customer and vendor text arrives with no injection guidance, and whether QuickBooks' audit log records changes per app is unchecked. Two, because the only brake is a flag on a local server. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/quickbooks-online https://www.anchorterminal.com/tools/quickbooks-online#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Intuit's REST API for accessing QuickBooks Online accounting data.