{ "data": { "similar": [ { "grade": "B", "json": "https://www.anchorterminal.com/tools/airwallex.json", "name": "Airwallex Spend and Issuing", "score": 68.3, "shared": [ "spend.transactions", "spend.expenses" ], "slug": "airwallex" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/mercury.json", "name": "Mercury API", "score": 63.8, "shared": [ "spend.transactions", "spend.expenses" ], "slug": "mercury" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/pleo.json", "name": "Pleo API + MCP", "score": 62.9, "shared": [ "spend.transactions", "spend.expenses" ], "slug": "pleo" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/spendesk.json", "name": "Spendesk API + MCP", "score": 62.3, "shared": [ "spend.transactions", "spend.expenses" ], "slug": "spendesk" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/bill.json", "name": "BILL", "score": 60.9, "shared": [ "spend.transactions", "spend.expenses" ], "slug": "bill" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/brex.json", "name": "Brex", "score": 60.7, "shared": [ "spend.transactions", "spend.expenses" ], "slug": "brex" } ], "tool": { "slug": "expensify", "name": "Expensify", "vendor": "Expensify, Inc.", "vendorUrl": "https://www.expensify.com", "kind": "http-api", "category": "spend-management", "summary": "Expensify is an expense management service with receipt scanning, expense reports, approvals, reimbursement and company cards. Its Integration Server API exports report and card data and creates expenses, reports and workspace settings. A hosted MCP server gives read-only search.", "url": "https://www.anchorterminal.com/tools/expensify", "markdownUrl": "https://www.anchorterminal.com/tools/expensify.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/expensify.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/expensify.json", "license": "Proprietary service under the Expensify Terms of Service. The Expensify app client and help articles on GitHub (Expensify/App) are MIT", "transports": [ "http" ], "remoteUrl": "https://integrations.expensify.com/Integration-Server/ExpensifyIntegrations", "packages": [], "auth": "mixed", "authNotes": "Access is self-serve for anyone with an Expensify account. Signing in at https://www.expensify.com/tools/integrations/ generates a partnerUserID and partnerUserSecret pair, shown once and replaceable on the same page. The pair travels inside the `requestJobDescription` form field and acts with the account's own rights, so domain and workspace admin jobs need an admin's credentials. Creating reports or expenses in other users' accounts needs Expensify to enable it for the domain by email to Concierge. OAuth2 for the API (authorisation code grant, scope `integrations:api`, two-hour access tokens, rotating refresh tokens) is in private beta by request form. The MCP server uses OAuth 2.1 with PKCE and the `mcp:tools` scope.", "pricing": "freemium", "pricingNotes": "No separate API fee is published. Collect is $5 per unique member a month, pay-per-use. Control is $18 per member a month on an annual subscription or $36 per active member pay-per-use, and as low as $9 with Expensify Card spend. A workspace starts a 30-day free trial, with a payment card asked for when it ends, and a free Submit workspace exists for individuals. An agent can start on the trial without a contract. No sandbox was found, and whether the API works without a paid plan wasn't established (checked 2026-10-08).", "priceSummary": "$5 / seat-mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Integration Server reference, the help articles or the pricing article (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://integrations.expensify.com/Integration-Server/doc/", "capabilities": [ "spend.transactions", "spend.expenses" ], "tags": [ "hosted", "freemium", "api-key", "oauth", "mcp", "soc2", "pci-dss" ], "graded": true, "anchor": { "graded": true, "score": 41.1, "grade": "E", "agentReady": false, "rank": 684, "ranked": true, "rankOf": 722, "categoryRank": 8, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 45, "maintenance": 23, "payments": 30, "reliability": 62, "schema": 28, "security": 34, "transparency": 58 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 62, "points": 12.4, "reason": "Read with the hosted lines and scored on the Integration Server API, the surface an outside agent can write through. A Statuspage site at status.expensify.com lists 20 components, with Integration APIs as its own (20). In the 90 days to 8 October 2026 no incident names Integration APIs. The website and app had four incidents of over an hour, on 9 August (critical, 8 hours 45 minutes, described as degraded performance), 19 August (critical, 2 hours 44 minutes), 31 August (major, 1 hour 42 minutes) and 18 September (major, 1 hour 16 minutes). The updates don't say whether the API was affected, and OAuth sign-in runs on www.expensify.com, so we scored between minor only and one major (15 of 30). Limits are published, 5 requests per 10 seconds and 20 per 60 seconds (15). The docs name status 429 but give no Retry-After header or backoff guidance, and no idempotency key exists for create jobs. A `test` flag on exports and `dry-run` on the Advanced Employee Updater are the only safe-retry aids (4 of 15). No SLA was found in the Terms of Service (0). The API is generally available. OAuth2 partner authentication is in private beta and the older Employee updater is marked no longer maintained (8 of 10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 28, "points": 4.55, "reason": "No OpenAPI or other machine-readable spec was found. The reference is one HTML page plus a page for the Advanced Employee Updater (0). www.expensify.com/llms.txt and help.expensify.com/llms.txt both return 404 (0). Each of the 16 documented jobs has a one-line purpose and notes on the admin rights it needs, with little on when not to use it (10 of 20). Parameter tables give format, valid values and required or optional for each field. The request itself is a JSON document inside a form field, and exports need a Freemarker template (8 of 15). Every job has a curl example and a sample error, and three jobs have an error code table. Codes are unconventional, with 410 for validation errors and 404 for a failed sign-in (10 of 15). The API has no version number and no changelog was found (0)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 45, "points": 7.31, "reason": "Exports return only the fields the caller's Freemarker template names, `limit` caps the number of reports, and the policy getter takes a `fields` list. An export is two calls, one to generate a file and one to download it (16 of 25). No pagination is documented. Filters cover report ID, workspace, start and end date, approved-after date, report state and an exported label (10 of 20). Errors are a `responseCode` and a `responseMessage` in the body, with specific messages such as a malformed date. There is no list of messages, and an invalid credential returned HTTP 200 with `responseCode` 404 when we tried it (9 of 20). No idempotency key is documented. The `markedAsExported` filter stops an export repeating, the report status updater returns 207 with lists of skipped and failed reports, and the employee updater has `dry-run` (5 of 20). One endpoint and few required fields per job. No official SDK was found (5 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 34, "points": 5.95, "reason": "A partnerUserID and partnerUserSecret pair is generated per account at www.expensify.com/tools/integrations, shown once and replaceable there. It acts with all of the account's rights. OAuth2 for the API is in private beta with one scope, `integrations:api`, two-hour access tokens and rotating refresh tokens. The MCP server uses OAuth 2.1 with PKCE (18 of 30). A Postman guide on Expensify's help site places `requestJobDescription`, which carries the secret, in the URL parameters, so the checklist's 10 comes off (8). The MCP server is read-only. The API has no scopes or read-only credential, creating on behalf of other users needs Expensify to enable it for the domain, and no confirmation step was found for writes (8 of 20). Merchant names and comments are untrusted text, and no prompt-injection guidance was found (3 of 15). An `onFinish` email can report what a job changed. No log of API calls was found in the docs (3 of 15). Expensify states annual SOC 1 Type 2 and SOC 2 Type 2 audits, PCI DSS compliance and yearly penetration tests, with reports on request at trust.expensify.com. security.txt returns 404 and no disclosure policy or bounty was found (12 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 30, "points": 3.75, "reason": "Read with the hosted rubric. No x402, MPP or L402 was found in the API docs or the pricing article (0). Prices are public per member, Collect at $5 a month and Control at $18 a month on an annual subscription or $36 pay-per-use. The API has no per-call price (10). A workspace starts a 30-day free trial and a payment card is asked for when it ends, and a free Submit workspace exists for individuals (20). A person has to create the account and open the integrations page in a browser to generate credentials (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 23, "points": 2.01, "reason": "No changelog or release record was found for the Integration Server API. The reference page carried a Last-Modified header of 8 October 2026, and its OAuth2 section is undated. The MCP help articles were first committed on 27 May 2026 and last revised on 28 September 2026. With no dated API change, half credit (15 of 30). No dated changelog entries (0). Support is Concierge by email or chat, and the help article says the API is self-serve and the customer's own team manages setup. Response times couldn't be observed (6 of 15). No official SDK was found, and the MCP server isn't in the official MCP registry (0). No package to assess. The API's response headers name GlassFish Server Open Source Edition 4.1.1 and Java 1.8 (2 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 58, "points": 5.08, "note": "editorial 41, provenance 75", "reason": "Closed service under the Terms of Service, last updated 10 September 2026. The Expensify app client is MIT on GitHub, and the API server is not public (15 of 30). The privacy policy (1 April 2026) says personal data is deleted as soon as practicable after an account ends, keeps data while an account is active, and lists California retention periods of up to 10 years by category. It states participation in the EU-U.S. Data Privacy Framework. No public data processing addendum was found on the pages read (17 of 30). The reference marks the Employee updater as no longer maintained with no end date, and the terms allow changes or discontinuation without prior notice (3 of 20). The terms and privacy policy name OpenAI, Spotnana and Aircall as providers. No full sub-processor list or data location statement was read, and the trust centre renders with JavaScript (6 of 20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Exports return only the fields the caller's Freemarker template names, `limit` caps the number of reports, and the policy getter takes a `fields` list. An export is two calls, one to generate a file and one to download it (16 of 25). No pagination is documented. Filters cover report ID, workspace, start and end date, approved-after date, report state and an exported label (10 of 20). Errors are a `responseCode` and a `responseMessage` in the body, with specific messages such as a malformed date. There is no list of messages, and an invalid credential returned HTTP 200 with `responseCode` 404 when we tried it (9 of 20). No idempotency key is documented. The `markedAsExported` filter stops an export repeating, the report status updater returns 207 with lists of skipped and failed reports, and the employee updater has `dry-run` (5 of 20). One endpoint and few required fields per job. No official SDK was found (5 of 15).", "maintenance": "No changelog or release record was found for the Integration Server API. The reference page carried a Last-Modified header of 8 October 2026, and its OAuth2 section is undated. The MCP help articles were first committed on 27 May 2026 and last revised on 28 September 2026. With no dated API change, half credit (15 of 30). No dated changelog entries (0). Support is Concierge by email or chat, and the help article says the API is self-serve and the customer's own team manages setup. Response times couldn't be observed (6 of 15). No official SDK was found, and the MCP server isn't in the official MCP registry (0). No package to assess. The API's response headers name GlassFish Server Open Source Edition 4.1.1 and Java 1.8 (2 of 10).", "payments": "Read with the hosted rubric. No x402, MPP or L402 was found in the API docs or the pricing article (0). Prices are public per member, Collect at $5 a month and Control at $18 a month on an annual subscription or $36 pay-per-use. The API has no per-call price (10). A workspace starts a 30-day free trial and a payment card is asked for when it ends, and a free Submit workspace exists for individuals (20). A person has to create the account and open the integrations page in a browser to generate credentials (0).", "reliability": "Read with the hosted lines and scored on the Integration Server API, the surface an outside agent can write through. A Statuspage site at status.expensify.com lists 20 components, with Integration APIs as its own (20). In the 90 days to 8 October 2026 no incident names Integration APIs. The website and app had four incidents of over an hour, on 9 August (critical, 8 hours 45 minutes, described as degraded performance), 19 August (critical, 2 hours 44 minutes), 31 August (major, 1 hour 42 minutes) and 18 September (major, 1 hour 16 minutes). The updates don't say whether the API was affected, and OAuth sign-in runs on www.expensify.com, so we scored between minor only and one major (15 of 30). Limits are published, 5 requests per 10 seconds and 20 per 60 seconds (15). The docs name status 429 but give no Retry-After header or backoff guidance, and no idempotency key exists for create jobs. A `test` flag on exports and `dry-run` on the Advanced Employee Updater are the only safe-retry aids (4 of 15). No SLA was found in the Terms of Service (0). The API is generally available. OAuth2 partner authentication is in private beta and the older Employee updater is marked no longer maintained (8 of 10).", "schema": "No OpenAPI or other machine-readable spec was found. The reference is one HTML page plus a page for the Advanced Employee Updater (0). www.expensify.com/llms.txt and help.expensify.com/llms.txt both return 404 (0). Each of the 16 documented jobs has a one-line purpose and notes on the admin rights it needs, with little on when not to use it (10 of 20). Parameter tables give format, valid values and required or optional for each field. The request itself is a JSON document inside a form field, and exports need a Freemarker template (8 of 15). Every job has a curl example and a sample error, and three jobs have an error code table. Codes are unconventional, with 410 for validation errors and 404 for a failed sign-in (10 of 15). The API has no version number and no changelog was found (0).", "security": "A partnerUserID and partnerUserSecret pair is generated per account at www.expensify.com/tools/integrations, shown once and replaceable there. It acts with all of the account's rights. OAuth2 for the API is in private beta with one scope, `integrations:api`, two-hour access tokens and rotating refresh tokens. The MCP server uses OAuth 2.1 with PKCE (18 of 30). A Postman guide on Expensify's help site places `requestJobDescription`, which carries the secret, in the URL parameters, so the checklist's 10 comes off (8). The MCP server is read-only. The API has no scopes or read-only credential, creating on behalf of other users needs Expensify to enable it for the domain, and no confirmation step was found for writes (8 of 20). Merchant names and comments are untrusted text, and no prompt-injection guidance was found (3 of 15). An `onFinish` email can report what a job changed. No log of API calls was found in the docs (3 of 15). Expensify states annual SOC 1 Type 2 and SOC 2 Type 2 audits, PCI DSS compliance and yearly penetration tests, with reports on request at trust.expensify.com. security.txt returns 404 and no disclosure policy or bounty was found (12 of 20).", "transparency": "Closed service under the Terms of Service, last updated 10 September 2026. The Expensify app client is MIT on GitHub, and the API server is not public (15 of 30). The privacy policy (1 April 2026) says personal data is deleted as soon as practicable after an account ends, keeps data while an account is active, and lists California retention periods of up to 10 years by category. It states participation in the EU-U.S. Data Privacy Framework. No public data processing addendum was found on the pages read (17 of 30). The reference marks the Employee updater as no longer maintained with no end date, and the terms allow changes or discontinuation without prior notice (3 of 20). The terms and privacy policy name OpenAI, Spotnana and Aircall as providers. No full sub-processor list or data location statement was read, and the trust centre renders with JavaScript (6 of 20)." }, "sources": [ { "what": "Integration Server API reference", "url": "https://integrations.expensify.com/Integration-Server/doc/", "seen": "2026-10-08" }, { "what": "Advanced Employee Updater reference", "url": "https://integrations.expensify.com/Integration-Server/doc/employeeUpdater/", "seen": "2026-10-08" }, { "what": "API help article with limits and Postman guides", "url": "https://help.expensify.com/articles/new-expensify/connections/Expensify-API", "seen": "2026-10-08" }, { "what": "MCP server help article", "url": "https://help.expensify.com/articles/new-expensify/connections/connect-ai-assistants/Use-the-Expensify-MCP-Server-With-AI-Assistants", "seen": "2026-10-08" }, { "what": "Claude connection guide for the MCP server", "url": "https://help.expensify.com/articles/new-expensify/connections/connect-ai-assistants/Connect-Claude-to-Expensify-Using-MCP", "seen": "2026-10-08" }, { "what": "OAuth authorisation server metadata", "url": "https://www.expensify.com/.well-known/oauth-authorization-server", "seen": "2026-10-08" }, { "what": "pricing help article", "url": "https://help.expensify.com/articles/new-expensify/billing-and-subscriptions/explore-plans-subscriptions-and-pricing/Understand-Expensify-Pricing", "seen": "2026-10-08" }, { "what": "pricing page, rendered with JavaScript", "url": "https://www.expensify.com/pricing", "seen": "2026-10-08" }, { "what": "status page incidents", "url": "https://status.expensify.com/api/v2/incidents.json", "seen": "2026-10-08" }, { "what": "status page components", "url": "https://status.expensify.com/api/v2/summary.json", "seen": "2026-10-08" }, { "what": "Terms of Service", "url": "https://www.expensify.com/terms", "seen": "2026-10-08" }, { "what": "privacy policy", "url": "https://www.expensify.com/privacy", "seen": "2026-10-08" }, { "what": "encryption and data security help article", "url": "https://help.expensify.com/articles/new-expensify/settings/Encryption-and-Data-Security", "seen": "2026-10-08" }, { "what": "compliance documentation help article", "url": "https://help.expensify.com/articles/Unlisted/Compliance-Documentation", "seen": "2026-10-08" }, { "what": "security.txt, returns 404", "url": "https://www.expensify.com/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "help articles source and commit history", "url": "https://github.com/Expensify/App/tree/main/docs/articles", "seen": "2026-10-08" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=expensify", "seen": "2026-10-08" }, { "what": "RDAP for expensify.com", "url": "https://rdap.verisign.com/com/v1/domain/expensify.com", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: the pricing page at www.expensify.com/pricing renders with JavaScript. Prices come from Expensify's pricing help article", "unchecked: trust.expensify.com renders with JavaScript, so the sub-processor list, the security reports and any disclosure policy there weren't read", "unchecked: whether API credentials work on the free Submit workspace or during the trial without a paid plan. The reference only says to create an account", "unchecked: whether 429 responses carry a Retry-After header", "unchecked: the MCP server's tool list, input schemas and annotations, which need a signed-in account. The help article describes one Search tool", "unchecked: whether an SLA or a data processing addendum is available under a Statement of Work. Neither was found in the Terms of Service or the privacy policy", "unchecked: when the Integration Server API last changed. No changelog exists, and the Last-Modified header of 8 October 2026 may reflect a redeploy", "The lead named only the Integration Server API. Expensify also runs a read-only MCP server at https://www.expensify.com/mcp, and OAuth2 for the API is in private beta by request form", "The 10-point query string deduction rests on a customer-written Postman guide published on Expensify's help site. The reference's own examples send the secret in the POST body", "The four website incidents of over an hour in the last 90 days don't name the Integration APIs component, and their updates give no detail. The incident score of 15 is a judgement between 20 and 10" ] }, "negative": 0, "verdict": "One endpoint exports reports through caller-written templates and creates expenses, reports, rules and workspace settings, with limits of 5 requests per 10 seconds published and a status page that tracks the API separately. There is no OpenAPI spec, changelog, SDK, pagination or idempotency key, and one credential pair carries the whole account's rights.", "bestFor": "A finance team already on Expensify that wants an agent to export approved reports to an accounting system, create expenses and reports, keep categories, tags and employees in step with an HR system, or mark reports reimbursed.", "strengths": [ "Export templates written in Freemarker let the caller choose every output field, in CSV, XLS, XLSX, TXT, PDF, JSON or XML, filtered by date, state, workspace and report ID", "Rate limits are published as 5 requests per 10 seconds and 20 per 60 seconds, with status 429 when exceeded", "The status page lists Integration APIs as its own component, and no incident in the 90 days to 8 October 2026 names it", "The hosted MCP server at https://www.expensify.com/mcp is read-only and uses OAuth 2.1 with PKCE, the `mcp:tools` scope and a revocation endpoint", "Every job in the reference has a curl example, a parameter table with valid values and a sample error response" ], "weaknesses": [ "No OpenAPI spec, llms.txt, version number or changelog was found for the Integration Server API", "The partnerUserID and partnerUserSecret pair acts with all of the account's rights. No scopes or read-only credential were found for the API", "No idempotency key or pagination is documented, and no official SDK was found", "Errors arrive as `responseCode` in the body. An invalid credential returned HTTP 200 with `responseCode` 404 when we tried it on 8 October 2026", "The Terms of Service allow Expensify to modify or discontinue the service at any time without prior notice, and no SLA was found" ], "agentNotes": [ "POST `requestJobDescription` as a form field to the single endpoint. Keep it out of the URL query string, because it carries the secret", "Read `responseCode` in the body on every reply. HTTP status can be 200 on failure, and validation errors use 410", "Stay under 5 requests per 10 seconds and 20 per 60 seconds. No Retry-After header is documented, so space retries yourself", "Export in two calls. A `file` job returns a filename, then a `download` job fetches it. Amounts are in cents", "Don't retry a create job blindly. No idempotency key exists, so export and check before resending. Set `dry-run` to true when testing the Advanced Employee Updater" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 41.1 } ], "editorialScores": { "ergonomics": 45, "maintenance": 23, "payments": 30, "reliability": 62, "schema": 28, "security": 34, "transparency": 41 }, "provenanceScore": 75 }, "connect": { "http": "curl -X POST 'https://integrations.expensify.com/Integration-Server/ExpensifyIntegrations' \\\n -d 'requestJobDescription={\"type\":\"get\",\"credentials\":{\"partnerUserID\":\"_REPLACE_\",\"partnerUserSecret\":\"_REPLACE_\"},\"inputSettings\":{\"type\":\"policyList\"}}'" }, "letme": { "capability": "https://letme.dev/spend.transactions", "tool": "https://letme.dev/expensify" }, "notable": [ "Every call is a POST to one endpoint with a JSON `requestJobDescription` form field naming the job type, the credentials and the input settings (https://integrations.expensify.com/Integration-Server/doc/)", "16 documented jobs. Export covers reports, card reconciliation and file download. Create covers reports, expenses, workspaces and expense rules. Get covers workspace details, the workspace list and domain cards. Update covers workspace categories and tags, employees, expense rules, report status and tag approvers (https://integrations.expensify.com/Integration-Server/doc/)", "Report exports take a caller-written Freemarker template and return CSV, XLS, XLSX, TXT, PDF, JSON or XML, with optional email, SFTP upload and mark-as-exported actions on finish (https://integrations.expensify.com/Integration-Server/doc/)", "Rate limits are 5 requests per 10 seconds and 20 per 60 seconds, with status 429 beyond them (https://integrations.expensify.com/Integration-Server/doc/#rate-limits)", "The report status updater supports one action, marking Approved reports as Reimbursed, and returns 207 with lists of skipped and failed reports (https://integrations.expensify.com/Integration-Server/doc/)", "A hosted MCP server at https://www.expensify.com/mcp exposes Expensify Search read-only over OAuth 2.1 with PKCE. It can't create, edit, approve or reimburse (https://help.expensify.com/articles/new-expensify/connections/connect-ai-assistants/Use-the-Expensify-MCP-Server-With-AI-Assistants)", "OAuth2 partner authentication for the API is in private beta by request form, with the single scope `integrations:api` (https://integrations.expensify.com/Integration-Server/doc/#authentication)", "The Terms of Service, last updated 10 September 2026, reserve the right to modify or discontinue the service at any time without prior notice (https://www.expensify.com/terms)" ], "area": "domain-data", "details": [ { "label": "API", "value": "Integration Server API, one endpoint at https://integrations.expensify.com/Integration-Server/ExpensifyIntegrations, 16 documented jobs, no version number and no OpenAPI spec" }, { "label": "MCP server", "value": "https://www.expensify.com/mcp, read-only Expensify Search, OAuth 2.1 with PKCE (S256), scope `mcp:tools`, registration and revocation endpoints. Guides for Claude, ChatGPT and Cursor" }, { "label": "Credentials", "value": "partnerUserID and partnerUserSecret per account, shown once, replaceable at www.expensify.com/tools/integrations. OAuth2 for the API in private beta, with two-hour access tokens and rotating refresh tokens" }, { "label": "Rate limits", "value": "5 requests per 10 seconds and 20 per 60 seconds. Status 429 beyond them. No Retry-After documented" }, { "label": "Exports", "value": "Freemarker template chosen by the caller. Filters by report ID, workspace, date range, approved-after date, state and exported label, with `limit` on the number of reports. Two calls, generate then download" }, { "label": "Writes", "value": "Create reports, expenses, workspaces and expense rules. Update categories, tags, report fields, employees, tag approvers and report status (Approved to Reimbursed only)" }, { "label": "Errors", "value": "`responseCode` and `responseMessage` in the body. 404 sign-in failure or workspace not found, 403 not an admin, 410 validation, 500 generic, 207 partial success" }, { "label": "Testing", "value": "No sandbox found. `test` on exports skips the on-finish actions, and `dry-run` on the Advanced Employee Updater makes no changes" }, { "label": "Pagination and idempotency", "value": "Neither is documented" }, { "label": "Certifications", "value": "Annual SOC 1 Type 2 and SOC 2 Type 2 audits and PCI DSS compliance per Expensify's help site, with reports on request at trust.expensify.com" }, { "label": "Status", "value": "status.expensify.com, 20 components including Integration APIs" } ], "unitPrices": [ { "item": "Collect plan, pay-per-use", "unit": "seat-month", "usd": 5, "note": "Per unique member. No separate API fee is published" }, { "item": "Control plan, annual subscription", "unit": "seat-month", "usd": 18, "note": "As low as $9 with Expensify Card spend. Active members above the subscription size are $36" }, { "item": "Control plan, pay-per-use", "unit": "seat-month", "usd": 36, "note": "Per active member" } ], "provenance": { "legalEntity": "Expensify, Inc.", "domain": "expensify.com", "domainRegistered": "2007-10-26", "endpointOnVendorDomain": true, "terms": "https://www.expensify.com/terms", "privacy": "https://www.expensify.com/privacy", "statusPage": "https://status.expensify.com", "changelog": "", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The Terms of Service (last updated 10 September 2026) name Expensify, Inc., 401 SW 5th Ave, Portland, OR 97204, and govern the Expensify Service including related software and tools. No separate API agreement was found.", "The privacy policy (last updated 1 April 2026) is issued for the Expensify group and names Expensify, Inc. as controller.", "The API answers at integrations.expensify.com and the MCP server at www.expensify.com/mcp.", "https://www.expensify.com/.well-known/security.txt returned 404 on 8 October 2026.", "No changelog was found for the Integration Server API.", "RDAP for expensify.com gives a registration date of 2007-10-26." ], "score": 75, "checks": [ { "check": "Legal entity named", "value": "Expensify, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "expensify.com, registered 2007-10-26 (18 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "integrations.expensify.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 6 of the 7 things a reader expects, and has 2 clauses that cost points", "points": 5.1, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects", "points": 10, "max": 10, "state": "ok" }, { "check": "Status page", "value": "status.expensify.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://www.expensify.com/terms", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-09-10", "words": 14967, "points": 5.1, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated: September 10, 2026", "says": "Last updated 2026-09-10" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "9.6 Arbitrator's Decision and Governing Law These Terms of Service and the rights of the parties hereunder shall be governed by and construed in accordance with the laws of the State of California, exclusive of conflict or choice of law rules.", "says": "The law of the State of California" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "EXCEPT FOR THE INDEMNITY OBLIGATIONS SET FORTH HEREIN, IN NO EVENT WILL EXPENSIFY'S AGGREGATE LIABILITY ARISING OUT OF OR IN CONNECTION WITH THESE TERMS OF SERVICE OR FROM THE USE OF OR INABILITY TO USE THE EXPENSIFY SERVICE OR SITE CONTENT EXCEED THE AMOUNTS YOU HAVE PAID TO EXPENSIFY FOR USE OF THE EXPENSIFY SERVICE…" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "…we have grounds to suspect that such information is untrue, inaccurate, not current, or incomplete, we may suspend or terminate your Account and refuse any and all current or future use of the Expensify Service (or any portion thereof)." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "Expensify reserves the right, at its sole discretion, to modify, discontinue or terminate the Expensify Service or to modify these Terms of Service, at any time and without prior notice.", "says": "Says it gives notice of a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "If you do not meet all of these requirements, you must not access or use the Expensify Service." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "agent, device or mechanism (including spiders, robots, crawlers, data mining tools", "costsPoints": true }, { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "Expensify reserves the right, at its sole discretion, to modify, discontinue or terminate the Expensify Service or to modify these Terms of Service, at any time and without prior notice.", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "Expensify reserves the right, at its sole discretion, to modify, discontinue or terminate the Expensify Service or to modify these Terms of Service, at any time and without prior notice." }, { "key": "terms.arbitration", "label": "Requires arbitration or waives class actions", "found": true, "quote": "disputes by individual arbitration and to waive the right to participate in any kind" } ], "notes": [ { "date": "2026-10-08", "text": "The terms say a member may not authorise any third party to access or use the service on the member's behalf.", "quote": "You may not authorize any third party to access or use the Expensify Service or any payment" }, { "date": "2026-10-08", "text": "Members grant Expensify, its affiliates and service providers a transferable, sub-licensable licence to use, distribute, modify and copy member-generated content.", "quote": "sub-licensable, royalty-free, and worldwide, license to use, distribute, modify, run, copy," }, { "date": "2026-10-08", "text": "The terms say Expensify may share member-generated content with third party services, naming OpenAI.", "quote": "Member-Generated Content with third party services, including but not limited to OpenAI," } ] }, { "kind": "privacy", "url": "https://www.expensify.com/privacy", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-04-01", "words": 13947, "points": 10, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated: April 1, 2026", "says": "Last updated 2026-04-01" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "This privacy policy (\"Privacy Policy\" or \"Policy\") describes how we collect, use, disclose, share and secure the personal and company information you provide when you use our expense management, invoicing or bill processing software, through our mobile application (the \"Application\") or visit the Expensify websites ww…" }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "If you request deletion, subject to our rights to retain the Personal Data as set out in this Privacy Policy and the rights of any Corporate Member to retain the Personal Data as set forth below, we will respond to your request within 1 month.", "says": "Names a period of 1 month" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "We may share your geo-location data with third parties for the sole purpose of providing these services." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "Except as otherwise stated in this policy and our Terms of Service, we do not sell, trade, share, or rent the Personal Data collected from the Expensify Service to third parties.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "9.1 Access to Data Controlled by our Corporate Members You have the right to access your Personal Data subject to any exceptions which may apply in the jurisdiction in which you reside." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "To contact us with questions about our compliance with state general privacy laws, please reach out to privacy@expensify.com.", "says": "privacy@expensify.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "Data Privacy Framework, and more information about these programs is also provided below.", "says": "Relies on the Data Privacy Framework" } ], "toKnow": [ { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "We may share personal information about you for cross-context behavioral advertising — seeking to place ads to you on others' digital properties based, at least in part, on personal information obtained from your activity on others' digital properties." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/expensify.json", "live": { "slug": "expensify", "probe": { "target": "https://integrations.expensify.com/Integration-Server/ExpensifyIntegrations", "method": "get", "lastAt": "2026-10-08T19:52:50.636571342Z", "lastOk": true, "lastStatus": 200, "lastMs": 460, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 447, "p95ms24h": 522, "samples24h": 27, "samples30d": 27, "days": [ { "date": "2026-10-08", "probes": 27, "ok": 27 } ] }, "vendorStatus": { "page": "https://status.expensify.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-08T19:50:40.504698851Z" }, "pages": [ { "url": "https://www.expensify.com/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:27:38.986175098Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "a6875581ee6f" }, { "url": "https://www.expensify.com/terms", "kind": "terms", "status": 200, "checkedAt": "2026-10-08T18:27:41.220273608Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "2df10b1a9dea" } ], "updatedAt": "2026-10-08T19:52:50.636571342Z" } }, "verify": { "accepts": "a page on expensify.com or one of its subdomains", "badgeUrl": "https://www.anchorterminal.com/badges/expensify.svg", "body": { "slug": "expensify", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/expensify", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/expensify\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/expensify.svg\" alt=\"Expensify on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Expensify on Anchor Terminal](https://www.anchorterminal.com/badges/expensify.svg)](https://www.anchorterminal.com/tools/expensify)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/expensify\"\u003eExpensify on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/expensify", "json": "https://www.anchorterminal.com/tools/expensify.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/expensify.md", "slim": "https://www.anchorterminal.com/tools/expensify.min.md" }, "markdown": "## Overview\n\n**Grade E · 41.1/100 · rank #684 of 722 · #8 in Spend management \u0026 procurement · not agent-ready · confidence medium**\n\n\n## Assessment\n\nOne endpoint exports reports through caller-written templates and creates expenses, reports, rules and workspace settings, with limits of 5 requests per 10 seconds published and a status page that tracks the API separately. There is no OpenAPI spec, changelog, SDK, pagination or idempotency key, and one credential pair carries the whole account's rights.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Expensify, Inc. (https://www.expensify.com) |\n| Kind | HTTP API |\n| Category | Spend management \u0026 procurement (https://www.anchorterminal.com/categories/spend-management) |\n| Transport | HTTP |\n| Endpoint | `https://integrations.expensify.com/Integration-Server/ExpensifyIntegrations` |\n| Auth | OAuth or key · Access is self-serve for anyone with an Expensify account. Signing in at https://www.expensify.com/tools/integrations/ generates a partnerUserID and partnerUserSecret pair, shown once and replaceable on the same page. The pair travels inside the `requestJobDescription` form field and acts with the account's own rights, so domain and workspace admin jobs need an admin's credentials. Creating reports or expenses in other users' accounts needs Expensify to enable it for the domain by email to Concierge. OAuth2 for the API (authorisation code grant, scope `integrations:api`, two-hour access tokens, rotating refresh tokens) is in private beta by request form. The MCP server uses OAuth 2.1 with PKCE and the `mcp:tools` scope. |\n| Pricing | Freemium ($5 / seat-mo) · No separate API fee is published. Collect is $5 per unique member a month, pay-per-use. Control is $18 per member a month on an annual subscription or $36 per active member pay-per-use, and as low as $9 with Expensify Card spend. A workspace starts a 30-day free trial, with a payment card asked for when it ends, and a free Submit workspace exists for individuals. An agent can start on the trial without a contract. No sandbox was found, and whether the API works without a paid plan wasn't established (checked 2026-10-08). |\n| x402 | No · No x402, MPP or L402 in the Integration Server reference, the help articles or the pricing article (checked 2026-10-08). |\n| Licence | Proprietary service under the Expensify Terms of Service. The Expensify app client and help articles on GitHub (Expensify/App) are MIT |\n| Docs | https://integrations.expensify.com/Integration-Server/doc/ |\n| llms.txt | not found |\n| API | Integration Server API, one endpoint at https://integrations.expensify.com/Integration-Server/ExpensifyIntegrations, 16 documented jobs, no version number and no OpenAPI spec |\n| MCP server | https://www.expensify.com/mcp, read-only Expensify Search, OAuth 2.1 with PKCE (S256), scope `mcp:tools`, registration and revocation endpoints. Guides for Claude, ChatGPT and Cursor |\n| Credentials | partnerUserID and partnerUserSecret per account, shown once, replaceable at www.expensify.com/tools/integrations. OAuth2 for the API in private beta, with two-hour access tokens and rotating refresh tokens |\n| Rate limits | 5 requests per 10 seconds and 20 per 60 seconds. Status 429 beyond them. No Retry-After documented |\n| Exports | Freemarker template chosen by the caller. Filters by report ID, workspace, date range, approved-after date, state and exported label, with `limit` on the number of reports. Two calls, generate then download |\n| Writes | Create reports, expenses, workspaces and expense rules. Update categories, tags, report fields, employees, tag approvers and report status (Approved to Reimbursed only) |\n| Errors | `responseCode` and `responseMessage` in the body. 404 sign-in failure or workspace not found, 403 not an admin, 410 validation, 500 generic, 207 partial success |\n| Testing | No sandbox found. `test` on exports skips the on-finish actions, and `dry-run` on the Advanced Employee Updater makes no changes |\n| Pagination and idempotency | Neither is documented |\n| Certifications | Annual SOC 1 Type 2 and SOC 2 Type 2 audits and PCI DSS compliance per Expensify's help site, with reports on request at trust.expensify.com |\n| Status | status.expensify.com, 20 components including Integration APIs |\n| Capabilities | spend.transactions, spend.expenses |\n| Tags | hosted, freemium, api-key, oauth, mcp, soc2, pci-dss |\n| JSON | https://www.anchorterminal.com/api/v1/tools/expensify.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-08 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 62 | 12.4 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 28 | 4.5 |\n| Agent ergonomics | 13% | 16.2 | 45 | 7.3 |\n| Security \u0026 auth | 14% | 17.5 | 34 | 6.0 |\n| Payments \u0026 pricing | 10% | 12.5 | 30 | 3.8 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 23 | 2.0 |\n| Transparency \u0026 trust (editorial 41, provenance 75) | 7% | 8.8 | 58 | 5.1 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **41.1 → E** |\n\n### Why each score\n\n- Reliability 62: Read with the hosted lines and scored on the Integration Server API, the surface an outside agent can write through. A Statuspage site at status.expensify.com lists 20 components, with Integration APIs as its own (20). In the 90 days to 8 October 2026 no incident names Integration APIs. The website and app had four incidents of over an hour, on 9 August (critical, 8 hours 45 minutes, described as degraded performance), 19 August (critical, 2 hours 44 minutes), 31 August (major, 1 hour 42 minutes) and 18 September (major, 1 hour 16 minutes). The updates don't say whether the API was affected, and OAuth sign-in runs on www.expensify.com, so we scored between minor only and one major (15 of 30). Limits are published, 5 requests per 10 seconds and 20 per 60 seconds (15). The docs name status 429 but give no Retry-After header or backoff guidance, and no idempotency key exists for create jobs. A `test` flag on exports and `dry-run` on the Advanced Employee Updater are the only safe-retry aids (4 of 15). No SLA was found in the Terms of Service (0). The API is generally available. OAuth2 partner authentication is in private beta and the older Employee updater is marked no longer maintained (8 of 10).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 28: No OpenAPI or other machine-readable spec was found. The reference is one HTML page plus a page for the Advanced Employee Updater (0). www.expensify.com/llms.txt and help.expensify.com/llms.txt both return 404 (0). Each of the 16 documented jobs has a one-line purpose and notes on the admin rights it needs, with little on when not to use it (10 of 20). Parameter tables give format, valid values and required or optional for each field. The request itself is a JSON document inside a form field, and exports need a Freemarker template (8 of 15). Every job has a curl example and a sample error, and three jobs have an error code table. Codes are unconventional, with 410 for validation errors and 404 for a failed sign-in (10 of 15). The API has no version number and no changelog was found (0).\n- Agent ergonomics 45: Exports return only the fields the caller's Freemarker template names, `limit` caps the number of reports, and the policy getter takes a `fields` list. An export is two calls, one to generate a file and one to download it (16 of 25). No pagination is documented. Filters cover report ID, workspace, start and end date, approved-after date, report state and an exported label (10 of 20). Errors are a `responseCode` and a `responseMessage` in the body, with specific messages such as a malformed date. There is no list of messages, and an invalid credential returned HTTP 200 with `responseCode` 404 when we tried it (9 of 20). No idempotency key is documented. The `markedAsExported` filter stops an export repeating, the report status updater returns 207 with lists of skipped and failed reports, and the employee updater has `dry-run` (5 of 20). One endpoint and few required fields per job. No official SDK was found (5 of 15).\n- Security \u0026 auth 34: A partnerUserID and partnerUserSecret pair is generated per account at www.expensify.com/tools/integrations, shown once and replaceable there. It acts with all of the account's rights. OAuth2 for the API is in private beta with one scope, `integrations:api`, two-hour access tokens and rotating refresh tokens. The MCP server uses OAuth 2.1 with PKCE (18 of 30). A Postman guide on Expensify's help site places `requestJobDescription`, which carries the secret, in the URL parameters, so the checklist's 10 comes off (8). The MCP server is read-only. The API has no scopes or read-only credential, creating on behalf of other users needs Expensify to enable it for the domain, and no confirmation step was found for writes (8 of 20). Merchant names and comments are untrusted text, and no prompt-injection guidance was found (3 of 15). An `onFinish` email can report what a job changed. No log of API calls was found in the docs (3 of 15). Expensify states annual SOC 1 Type 2 and SOC 2 Type 2 audits, PCI DSS compliance and yearly penetration tests, with reports on request at trust.expensify.com. security.txt returns 404 and no disclosure policy or bounty was found (12 of 20).\n- Payments \u0026 pricing 30: Read with the hosted rubric. No x402, MPP or L402 was found in the API docs or the pricing article (0). Prices are public per member, Collect at $5 a month and Control at $18 a month on an annual subscription or $36 pay-per-use. The API has no per-call price (10). A workspace starts a 30-day free trial and a payment card is asked for when it ends, and a free Submit workspace exists for individuals (20). A person has to create the account and open the integrations page in a browser to generate credentials (0).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 23: No changelog or release record was found for the Integration Server API. The reference page carried a Last-Modified header of 8 October 2026, and its OAuth2 section is undated. The MCP help articles were first committed on 27 May 2026 and last revised on 28 September 2026. With no dated API change, half credit (15 of 30). No dated changelog entries (0). Support is Concierge by email or chat, and the help article says the API is self-serve and the customer's own team manages setup. Response times couldn't be observed (6 of 15). No official SDK was found, and the MCP server isn't in the official MCP registry (0). No package to assess. The API's response headers name GlassFish Server Open Source Edition 4.1.1 and Java 1.8 (2 of 10).\n- Transparency \u0026 trust 58: Closed service under the Terms of Service, last updated 10 September 2026. The Expensify app client is MIT on GitHub, and the API server is not public (15 of 30). The privacy policy (1 April 2026) says personal data is deleted as soon as practicable after an account ends, keeps data while an account is active, and lists California retention periods of up to 10 years by category. It states participation in the EU-U.S. Data Privacy Framework. No public data processing addendum was found on the pages read (17 of 30). The reference marks the Employee updater as no longer maintained with no end date, and the terms allow changes or discontinuation without prior notice (3 of 20). The terms and privacy policy name OpenAI, Spotnana and Aircall as providers. No full sub-processor list or data location statement was read, and the trust centre renders with JavaScript (6 of 20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (20 items): https://www.anchorterminal.com/fixes/expensify.md (JSON https://www.anchorterminal.com/fixes/expensify.json)\n\n### What we couldn't check\n\n- unchecked: the pricing page at www.expensify.com/pricing renders with JavaScript. Prices come from Expensify's pricing help article\n- unchecked: trust.expensify.com renders with JavaScript, so the sub-processor list, the security reports and any disclosure policy there weren't read\n- unchecked: whether API credentials work on the free Submit workspace or during the trial without a paid plan. The reference only says to create an account\n- unchecked: whether 429 responses carry a Retry-After header\n- unchecked: the MCP server's tool list, input schemas and annotations, which need a signed-in account. The help article describes one Search tool\n- unchecked: whether an SLA or a data processing addendum is available under a Statement of Work. Neither was found in the Terms of Service or the privacy policy\n- unchecked: when the Integration Server API last changed. No changelog exists, and the Last-Modified header of 8 October 2026 may reflect a redeploy\n- The lead named only the Integration Server API. Expensify also runs a read-only MCP server at https://www.expensify.com/mcp, and OAuth2 for the API is in private beta by request form\n- The 10-point query string deduction rests on a customer-written Postman guide published on Expensify's help site. The reference's own examples send the secret in the POST body\n- The four website incidents of over an hour in the last 90 days don't name the Integration APIs component, and their updates give no detail. The incident score of 15 is a judgement between 20 and 10\n\n### Sources\n\n- Integration Server API reference: \u003chttps://integrations.expensify.com/Integration-Server/doc/\u003e (seen 2026-10-08)\n- Advanced Employee Updater reference: \u003chttps://integrations.expensify.com/Integration-Server/doc/employeeUpdater/\u003e (seen 2026-10-08)\n- API help article with limits and Postman guides: \u003chttps://help.expensify.com/articles/new-expensify/connections/Expensify-API\u003e (seen 2026-10-08)\n- MCP server help article: \u003chttps://help.expensify.com/articles/new-expensify/connections/connect-ai-assistants/Use-the-Expensify-MCP-Server-With-AI-Assistants\u003e (seen 2026-10-08)\n- Claude connection guide for the MCP server: \u003chttps://help.expensify.com/articles/new-expensify/connections/connect-ai-assistants/Connect-Claude-to-Expensify-Using-MCP\u003e (seen 2026-10-08)\n- OAuth authorisation server metadata: \u003chttps://www.expensify.com/.well-known/oauth-authorization-server\u003e (seen 2026-10-08)\n- pricing help article: \u003chttps://help.expensify.com/articles/new-expensify/billing-and-subscriptions/explore-plans-subscriptions-and-pricing/Understand-Expensify-Pricing\u003e (seen 2026-10-08)\n- pricing page, rendered with JavaScript: \u003chttps://www.expensify.com/pricing\u003e (seen 2026-10-08)\n- status page incidents: \u003chttps://status.expensify.com/api/v2/incidents.json\u003e (seen 2026-10-08)\n- status page components: \u003chttps://status.expensify.com/api/v2/summary.json\u003e (seen 2026-10-08)\n- Terms of Service: \u003chttps://www.expensify.com/terms\u003e (seen 2026-10-08)\n- privacy policy: \u003chttps://www.expensify.com/privacy\u003e (seen 2026-10-08)\n- encryption and data security help article: \u003chttps://help.expensify.com/articles/new-expensify/settings/Encryption-and-Data-Security\u003e (seen 2026-10-08)\n- compliance documentation help article: \u003chttps://help.expensify.com/articles/Unlisted/Compliance-Documentation\u003e (seen 2026-10-08)\n- security.txt, returns 404: \u003chttps://www.expensify.com/.well-known/security.txt\u003e (seen 2026-10-08)\n- help articles source and commit history: \u003chttps://github.com/Expensify/App/tree/main/docs/articles\u003e (seen 2026-10-08)\n- official MCP registry search: \u003chttps://registry.modelcontextprotocol.io/v0/servers?search=expensify\u003e (seen 2026-10-08)\n- RDAP for expensify.com: \u003chttps://rdap.verisign.com/com/v1/domain/expensify.com\u003e (seen 2026-10-08)\n\n## Who's behind it (provenance 75/100, checked 2026-10-08)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Expensify, Inc. | 20/20 |\n| Domain age | expensify.com, registered 2007-10-26 (18 years) | 15/15 |\n| Endpoint on the vendor's domain | integrations.expensify.com | 15/15 |\n| Terms of service | read, states 6 of the 7 things a reader expects, and has 2 clauses that cost points | 5.1/10 |\n| Privacy policy | read, states 8 of the 8 things a reader expects | 10/10 |\n| Status page | status.expensify.com | 10/10 |\n| Changelog | not found | 0/10 |\n| security.txt | not found | 0/10 |\n\nThe Terms of Service (last updated 10 September 2026) name Expensify, Inc., 401 SW 5th Ave, Portland, OR 97204, and govern the Expensify Service including related software and tools. No separate API agreement was found.\n\nThe privacy policy (last updated 1 April 2026) is issued for the Expensify group and names Expensify, Inc. as controller.\n\nThe API answers at integrations.expensify.com and the MCP server at www.expensify.com/mcp.\n\nhttps://www.expensify.com/.well-known/security.txt returned 404 on 8 October 2026.\n\nNo changelog was found for the Integration Server API.\n\nRDAP for expensify.com gives a registration date of 2007-10-26.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://www.expensify.com/terms), read 2026-10-08, dated 2026-09-10, states 6 of the 7 things a reader expects.\n\n- To know. Restricts automated access (costs points). \"agent, device or mechanism (including spiders, robots, crawlers, data mining tools\"\n- To know. Says the terms or the service can change without notice (costs points). \"Expensify reserves the right, at its sole discretion, to modify, discontinue or terminate the Expensify Service or to modify these Terms of Service, at any time and without prior notice.\"\n- To know. Says access can be ended without notice or for any reason. \"Expensify reserves the right, at its sole discretion, to modify, discontinue or terminate the Expensify Service or to modify these Terms of Service, at any time and without prior notice.\"\n- To know. Requires arbitration or waives class actions. \"disputes by individual arbitration and to waive the right to participate in any kind\"\n- Gives the date it was last updated. Last updated 2026-09-10.\n- Names the governing law or courts. The law of the State of California.\n- Says how changes to the terms are announced. Says it gives notice of a change.\n- Not found in the text. Refers to a service level or uptime commitment.\n- Also in the text (2026-10-08). The terms say a member may not authorise any third party to access or use the service on the member's behalf. \"You may not authorize any third party to access or use the Expensify Service or any payment\"\n- Also in the text (2026-10-08). Members grant Expensify, its affiliates and service providers a transferable, sub-licensable licence to use, distribute, modify and copy member-generated content. \"sub-licensable, royalty-free, and worldwide, license to use, distribute, modify, run, copy,\"\n- Also in the text (2026-10-08). The terms say Expensify may share member-generated content with third party services, naming OpenAI. \"Member-Generated Content with third party services, including but not limited to OpenAI,\"\n\n**Privacy policy** (https://www.expensify.com/privacy), read 2026-10-08, dated 2026-04-01, states 8 of the 8 things a reader expects.\n\n- To know. Says it sells personal data or shares it for advertising. \"We may share personal information about you for cross-context behavioral advertising — seeking to place ads to you on others' digital properties based, at least in part, on personal information obtained from your activity on others' digital properties.\"\n- Gives the date it was last updated. Last updated 2026-04-01.\n- Says how long data is kept. Names a period of 1 month.\n- Says whether personal data is sold or shared for advertising. Says it does not sell personal data.\n- Gives a privacy contact. privacy@expensify.com.\n- Says where data is transferred or stored. Relies on the Data Privacy Framework.\n\n## Live (updated 2026-10-08 19:52 UTC)\n\n- Right now: up, HTTP 200, 460 ms, checked 2026-10-08 19:52 UTC (get on `https://integrations.expensify.com/Integration-Server/ExpensifyIntegrations`)\n- Uptime 24h 100.0% (27 probes) · 30 days 100.0% (27 probes) · p50 447 ms · p95 522 ms\n- Vendor status page: none, All Systems Operational\n- Watching privacy \u003chttps://www.expensify.com/privacy\u003e\n- Watching terms \u003chttps://www.expensify.com/terms\u003e\n- Always current: https://www.anchorterminal.com/api/v1/live/expensify.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Prices\n\n| Item | Price | Unit | Note |\n| --- | --- | --- | --- |\n| Collect plan, pay-per-use | $5 | per seat per month | Per unique member. No separate API fee is published |\n| Control plan, annual subscription | $18 | per seat per month | As low as $9 with Expensify Card spend. Active members above the subscription size are $36 |\n| Control plan, pay-per-use | $36 | per seat per month | Per active member |\n\nAcross all listings: https://www.anchorterminal.com/prices/index.md\n\n## Strengths\n\n- Export templates written in Freemarker let the caller choose every output field, in CSV, XLS, XLSX, TXT, PDF, JSON or XML, filtered by date, state, workspace and report ID\n- Rate limits are published as 5 requests per 10 seconds and 20 per 60 seconds, with status 429 when exceeded\n- The status page lists Integration APIs as its own component, and no incident in the 90 days to 8 October 2026 names it\n- The hosted MCP server at https://www.expensify.com/mcp is read-only and uses OAuth 2.1 with PKCE, the `mcp:tools` scope and a revocation endpoint\n- Every job in the reference has a curl example, a parameter table with valid values and a sample error response\n\n## Weaknesses\n\n- No OpenAPI spec, llms.txt, version number or changelog was found for the Integration Server API\n- The partnerUserID and partnerUserSecret pair acts with all of the account's rights. No scopes or read-only credential were found for the API\n- No idempotency key or pagination is documented, and no official SDK was found\n- Errors arrive as `responseCode` in the body. An invalid credential returned HTTP 200 with `responseCode` 404 when we tried it on 8 October 2026\n- The Terms of Service allow Expensify to modify or discontinue the service at any time without prior notice, and no SLA was found\n\n## Before you call it (notes for agents)\n\n1. POST `requestJobDescription` as a form field to the single endpoint. Keep it out of the URL query string, because it carries the secret\n2. Read `responseCode` in the body on every reply. HTTP status can be 200 on failure, and validation errors use 410\n3. Stay under 5 requests per 10 seconds and 20 per 60 seconds. No Retry-After header is documented, so space retries yourself\n4. Export in two calls. A `file` job returns a filename, then a `download` job fetches it. Amounts are in cents\n5. Don't retry a create job blindly. No idempotency key exists, so export and check before resending. Set `dry-run` to true when testing the Advanced Employee Updater\n\n## Connect\n\nFirst request:\n\n```bash\ncurl -X POST 'https://integrations.expensify.com/Integration-Server/ExpensifyIntegrations' \\\n -d 'requestJobDescription={\"type\":\"get\",\"credentials\":{\"partnerUserID\":\"_REPLACE_\",\"partnerUserSecret\":\"_REPLACE_\"},\"inputSettings\":{\"type\":\"policyList\"}}'\n```\n\nThrough letme (picks today, calling later): https://letme.dev/expensify. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Airwallex Spend and Issuing | B | 68.3 | 187 | spend.transactions, spend.expenses | no | https://www.anchorterminal.com/tools/airwallex.md |\n| Mercury API | B | 63.8 | 293 | spend.transactions, spend.expenses | no | https://www.anchorterminal.com/tools/mercury.md |\n| Pleo API + MCP | B | 62.9 | 325 | spend.transactions, spend.expenses | no | https://www.anchorterminal.com/tools/pleo.md |\n| Spendesk API + MCP | B | 62.3 | 342 | spend.transactions, spend.expenses | no | https://www.anchorterminal.com/tools/spendesk.md |\n| BILL | C | 60.9 | 380 | spend.transactions, spend.expenses | no | https://www.anchorterminal.com/tools/bill.md |\n| Brex | C | 60.7 | 391 | spend.transactions, spend.expenses | no | https://www.anchorterminal.com/tools/brex.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- Every call is a POST to one endpoint with a JSON `requestJobDescription` form field naming the job type, the credentials and the input settings (source: \u003chttps://integrations.expensify.com/Integration-Server/doc/\u003e)\n- 16 documented jobs. Export covers reports, card reconciliation and file download. Create covers reports, expenses, workspaces and expense rules. Get covers workspace details, the workspace list and domain cards. Update covers workspace categories and tags, employees, expense rules, report status and tag approvers (source: \u003chttps://integrations.expensify.com/Integration-Server/doc/\u003e)\n- Report exports take a caller-written Freemarker template and return CSV, XLS, XLSX, TXT, PDF, JSON or XML, with optional email, SFTP upload and mark-as-exported actions on finish (source: \u003chttps://integrations.expensify.com/Integration-Server/doc/\u003e)\n- Rate limits are 5 requests per 10 seconds and 20 per 60 seconds, with status 429 beyond them (source: \u003chttps://integrations.expensify.com/Integration-Server/doc/#rate-limits\u003e)\n- The report status updater supports one action, marking Approved reports as Reimbursed, and returns 207 with lists of skipped and failed reports (source: \u003chttps://integrations.expensify.com/Integration-Server/doc/\u003e)\n- A hosted MCP server at https://www.expensify.com/mcp exposes Expensify Search read-only over OAuth 2.1 with PKCE. It can't create, edit, approve or reimburse (source: \u003chttps://help.expensify.com/articles/new-expensify/connections/connect-ai-assistants/Use-the-Expensify-MCP-Server-With-AI-Assistants\u003e)\n- OAuth2 partner authentication for the API is in private beta by request form, with the single scope `integrations:api` (source: \u003chttps://integrations.expensify.com/Integration-Server/doc/#authentication\u003e)\n- The Terms of Service, last updated 10 September 2026, reserve the right to modify or discontinue the service at any time without prior notice (source: \u003chttps://www.expensify.com/terms\u003e)\n\n## Compare\n\n- [Airwallex Spend and Issuing vs Expensify](https://www.anchorterminal.com/compare/airwallex-vs-expensify.md): B 68.3 vs E 41.1\n- [BILL vs Expensify](https://www.anchorterminal.com/compare/bill-vs-expensify.md): C 60.9 vs E 41.1\n- [Brex vs Expensify](https://www.anchorterminal.com/compare/brex-vs-expensify.md): C 60.7 vs E 41.1\n- [Expensify vs Mercury API](https://www.anchorterminal.com/compare/expensify-vs-mercury.md): E 41.1 vs B 63.8\n- [Expensify vs Pleo API + MCP](https://www.anchorterminal.com/compare/expensify-vs-pleo.md): E 41.1 vs B 62.9\n- [Expensify vs Ramp](https://www.anchorterminal.com/compare/expensify-vs-ramp.md): E 41.1 vs C 57.3\n- [Expensify vs Spendesk API + MCP](https://www.anchorterminal.com/compare/expensify-vs-spendesk.md): E 41.1 vs B 62.3\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on expensify.com or one of its subdomains. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"expensify\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/expensify\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/expensify.svg\" alt=\"Expensify on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Expensify on Anchor Terminal](https://www.anchorterminal.com/badges/expensify.svg)](https://www.anchorterminal.com/tools/expensify)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/expensify\"\u003eExpensify on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Expensify is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/expensify-dark.png\n- Light: https://www.anchorterminal.com/assets/share/expensify-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Spend management \u0026 procurement", "url": "https://www.anchorterminal.com/categories/spend-management" }, { "name": "Expensify", "url": "" } ], "description": "Expensify is an expense management service with receipt scanning, expense reports, approvals, reimbursement and company cards. Its Integration Server API exports report and card data and creates expenses, reports and workspace settings. A hosted MCP server gives read-only search.", "facts": [ "rank #684 of 722", "OAuth or key auth", "0 desk reviews" ], "h1": "Expensify", "image": "https://www.anchorterminal.com/assets/og/tools-expensify.png", "path": "/tools/expensify", "published": "2026-10-01", "section": "tools", "title": "Expensify review for AI agents, grade E (41.1/100) | Anchor Terminal", "toc": null, "updated": "2026-10-08", "url": "https://www.anchorterminal.com/tools/expensify" }, "tokens": { "markdown": 7750, "slim": 1730 }, "version": 1 }