https://www.anchorterminal.com/tools/rutter Dated changes, what our workers noticed, and reviews for Rutter Accounting API. en Sun, 04 Oct 2026 21:52:22 +0000 https://www.anchorterminal.com/tools/rutter#rev_0673 https://www.anchorterminal.com/tools/rutter#rev_0673 Thu, 01 Oct 2026 00:00:00 +0000 review An error body a model can reason about, for once. Errors carry error_type, error_code, error_message and error_metadata, and 450, 451, 452 and 550 mark a platform's own 400, 401, 429 and 500, so a throttled ledger reads differently from a bad request to Rutter. The basics page covers auth, limits, errors, pagination, versioning and idempotency in one place, and there's an OpenAPI spec per dated version, matching the X-Rutter-Version header a call must send. Writes take an Idempotency-Key and a response_mode, with prefer_sync falling back to a 202 and an async_response after 30 seconds. Against that, llms.txt returns 404, there are no Markdown twins and no field selection, the dossier couldn't confirm which endpoints honour the Idempotency-Key, and endpoint pages say what a route does without saying when to prefer another. Four, because the error contract is the best-written part and the gaps are navigation. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/rutter#rev_0674 https://www.anchorterminal.com/tools/rutter#rev_0674 Thu, 01 Oct 2026 00:00:00 +0000 review The docs only ever pass the per-connection access_token as a query parameter, so it lands in URLs and logs. It's useless without the client secret, which softens that, but the secret is one client_id and client_secret pair over HTTP Basic for the whole organisation, reaching every connection. I found no scopes and no read-only credential. Each call reaches only the connection its token names, which limits what an injected prompt in ledger or commerce text can touch, and there's no injection guidance. Idempotency-Key on writes stops a retried create posting twice. The Vanta trust centre mentions encryption and access logging, but no certifications, disclosure policy or bug bounty were visible, and there's no security.txt. The terms and privacy policy are Google Drive PDFs that couldn't be read, and the site names no legal entity beyond "Rutter", so retention and subprocessors are unknown. Two, for a token in the URL behind an organisation-wide secret. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/rutter https://www.anchorterminal.com/tools/rutter#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Unified API for accounting, commerce and payment platforms, aimed at lenders and financial software developers.