{ "data": { "similar": [ { "grade": "F", "json": "https://www.anchorterminal.com/tools/snoop.json", "name": "Snoop", "score": 26.7, "shared": [ "finance.budgets", "finance.transactions" ], "slug": "snoop" }, { "grade": "F", "json": "https://www.anchorterminal.com/tools/quicken-simplifi.json", "name": "Quicken Simplifi", "score": 20.7, "shared": [ "finance.budgets", "finance.transactions" ], "slug": "quicken-simplifi" }, { "grade": "F", "json": "https://www.anchorterminal.com/tools/emma.json", "name": "Emma", "score": 17.4, "shared": [ "finance.budgets", "finance.transactions" ], "slug": "emma" }, { "grade": "F", "json": "https://www.anchorterminal.com/tools/rocket-money.json", "name": "Rocket Money", "score": 17, "shared": [ "finance.budgets", "finance.transactions" ], "slug": "rocket-money" }, { "grade": "F", "json": "https://www.anchorterminal.com/tools/copilot-money.json", "name": "Copilot Money", "score": 16.3, "shared": [ "finance.budgets", "finance.transactions" ], "slug": "copilot-money" }, { "grade": "F", "json": "https://www.anchorterminal.com/tools/pocketguard.json", "name": "PocketGuard", "score": 14.6, "shared": [ "finance.budgets", "finance.transactions" ], "slug": "pocketguard" } ], "tool": { "slug": "ynab", "name": "YNAB", "vendor": "YNAB", "vendorUrl": "https://www.ynab.com", "kind": "http-api", "category": "personal-finance", "summary": "YNAB is a subscription budgeting app for people. Its REST API reads and edits a user's plans, accounts, categories, payees and transactions, with personal access tokens or OAuth for apps other users authorise.", "url": "https://www.anchorterminal.com/tools/ynab", "markdownUrl": "https://www.anchorterminal.com/tools/ynab.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/ynab.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/ynab.json", "repo": "https://github.com/ynab/ynab-sdk-js", "license": "Proprietary service; SDKs Apache-2.0", "transports": [ "http" ], "remoteUrl": "https://api.ynab.com/v1", "packages": [ { "registry": "npm", "name": "ynab" }, { "registry": "pypi", "name": "ynab" }, { "registry": "rubygems", "name": "ynab" } ], "auth": "mixed", "authNotes": "Bearer token in the Authorization header. A personal access token is made in the web app under Account Settings, Developer Settings, after entering the password; it never expires and is revoked from the same page. OAuth apps use the implicit grant or the authorisation code grant with PKCE and state; access tokens last 2 hours and the code grant returns a refresh token. scope=read-only gives a token that gets 403 on writes. New OAuth apps are in Restricted Mode, limited to 25 users other than the owner, until a review that takes 2 to 4 weeks (https://api.ynab.com/).", "pricing": "paid", "pricingNotes": "The API comes with a YNAB subscription at no extra charge. $14.99 a month or $109 a year in US dollars, with a 34-day free trial that needs no card when signing up on ynab.com (app stores may ask for one) and a 365-day trial for college students (https://www.ynab.com/pricing). A lapsed subscription or expired trial returns 403.1 or 403.2 on every call (https://api.ynab.com/#errors).", "priceSummary": "$14.99 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API documentation, the OpenAPI file or the pricing page (checked 2026-10-14).", "endpoints": [] }, "toolCount": 0, "popularity": { "githubStars": 240, "npmWeekly": 9596, "pypiWeekly": 2299, "asOf": "2026-10-14" }, "docsUrl": "https://api.ynab.com/", "openapi": "https://api.ynab.com/papi/open_api_spec.yaml", "capabilities": [ "finance.budgets", "finance.transactions" ], "tags": [ "hosted", "oauth", "openapi", "typescript", "python", "ruby", "status-page", "bug-bounty", "security-txt", "free-trial", "no-card", "read-only-mode", "closed-source" ], "lastRelease": "2026-09-17", "graded": true, "anchor": { "graded": true, "score": 65.1, "grade": "B", "agentReady": false, "rank": 351, "ranked": true, "rankOf": 1076, "categoryRank": 1, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 71, "maintenance": 62, "payments": 30, "reliability": 82, "schema": 77, "security": 51, "transparency": 75 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 82, "points": 16.4, "reason": "Statuspage at ynabstatus.com with a Public API component and incident history back to 2024 (20). No incident of any kind from 16 July to 14 October 2026; the last one touching the Public API was intermittent loading on 18 November 2025, about 3 hours (30). Rate limit of 200 requests an hour per access token, rolling window, documented (15). 429 too_many_requests is documented with \"wait awhile and try again\", but there's no Retry-After and the X-Rate-Limit header was removed in v1.73.0; import_id on created transactions matches retries instead of duplicating them (7 of 15). No SLA found (0). The API is generally available (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 77, "points": 12.51, "reason": "Public OpenAPI 3.1.1 file, version 1.87.0, 44 operations (25). No llms.txt or Markdown docs for the API; api.ynab.com/llms.txt answers 401 and www.ynab.com/llms.txt describes the app (0). Tag and parameter descriptions say what each resource is and when to use the last-used and default plan aliases, and the docs say to request the most specific resource; little when-not-to-use guidance (14 of 20). Typed parameters with 15 enums, maxLength and required fields, few loose objects (12 of 15). An error table with ids such as 403.1 subscription_lapsed and 403.4 data_limit_reached, sample responses in the docs, few examples in the spec (11 of 15). Versioned spec and a dated changelog from v1.68.0 to v1.87.0 (15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 71, "points": 11.54, "reason": "Specific single-resource endpoints, since_date and until_date, a type filter (`uncategorized`, `unapproved`), and delta requests on nine resources; no field selection (17 of 25). No pagination on lists; date filters and delta requests stand in for it (12 of 20). Errors carry id, name and detail, with 403 split into five documented causes an agent can act on (17 of 20). Reads are safe to repeat and import_id prevents duplicate transactions, with 409 on conflicts and duplicate_import_ids in responses; no idempotency key for other writes (10 of 20). The last-used plan alias cuts a call, few required parameters, and official SDKs for JavaScript, Python and Ruby (15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 51, "points": 8.93, "reason": "OAuth authorisation code grant with PKCE, state, 2-hour access tokens and refresh tokens, with one read-only scope; the implicit grant is still offered, and personal access tokens never expire and carry full access, though each is revocable. Tokens travel only in the Authorization header (22 of 30). The read-only scope returns 403 on writes, but personal access tokens have no read-only option and deletes need no confirmation (10 of 20). Responses include payee names and memos imported from banks; no guidance on treating them as untrusted (5 of 15). No per-call log or audit trail for API use found (0). security.txt with Bugcrowd and security@ynab.com but no Expires line, a public Bugcrowd bounty, and SOC 2 and ISO 27001 claimed only for the AWS infrastructure beneath Heroku (14 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 30, "points": 3.75, "reason": "No x402, MPP or L402 (0). Public plan prices, $14.99 a month or $109 a year, with the API included at no extra charge (10). 34-day free trial with no card when signing up on ynab.com (20). A person has to sign up in a browser and create a token or OAuth app in Developer Settings (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 62, "points": 5.43, "reason": "Last API change v1.87.0 on 17 September 2026 (30). In the last 90 days only v1.87.0 and ynab Python 4.4.0 on 12 August 2026, two dated releases (0). Closed service with a dated changelog and email support at api@ynab.com that says replies may take up to a week; on the JavaScript SDK maintainers merge their own pull requests within days, but an issue opened on 1 August and a community pull request of 23 August have no reply (10 of 15). Three official SDKs, regenerated from the spec; the JavaScript SDK's 4.5.0 of 1 July 2026 predates v1.87.0 (12 of 15). Build and Test CI passing on main on 8 October 2026, Dependabot and Socket scans (10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 75, "points": 6.56, "note": "editorial 57, provenance 92", "reason": "Closed service with API terms, general terms and a privacy policy; SDKs under Apache-2.0 (15). The privacy policy, effective 20 April 2026, gives retention periods (account data up to 24 months after a subscription or trial ends, support conversations up to 3 years, workshop recordings 21 days) and agrees with the security page on deletion; no DPA or subprocessor list found (20 of 30). Deprecated fields such as goal_target_month and debt_original_balance are dated in the changelog, and the old domain and /budgets paths still work; no written deprecation policy (12 of 20). Data is processed in the US with Standard Contractual Clauses for UK and EEA transfers, hosting on Heroku and AWS and the aggregators Plaid and MX are named, other subprocessors only by category (10 of 20)." } ], "assessment": { "date": "2026-10-14", "basis": "public evidence", "confidence": "high", "notes": { "ergonomics": "Specific single-resource endpoints, since_date and until_date, a type filter (`uncategorized`, `unapproved`), and delta requests on nine resources; no field selection (17 of 25). No pagination on lists; date filters and delta requests stand in for it (12 of 20). Errors carry id, name and detail, with 403 split into five documented causes an agent can act on (17 of 20). Reads are safe to repeat and import_id prevents duplicate transactions, with 409 on conflicts and duplicate_import_ids in responses; no idempotency key for other writes (10 of 20). The last-used plan alias cuts a call, few required parameters, and official SDKs for JavaScript, Python and Ruby (15).", "maintenance": "Last API change v1.87.0 on 17 September 2026 (30). In the last 90 days only v1.87.0 and ynab Python 4.4.0 on 12 August 2026, two dated releases (0). Closed service with a dated changelog and email support at api@ynab.com that says replies may take up to a week; on the JavaScript SDK maintainers merge their own pull requests within days, but an issue opened on 1 August and a community pull request of 23 August have no reply (10 of 15). Three official SDKs, regenerated from the spec; the JavaScript SDK's 4.5.0 of 1 July 2026 predates v1.87.0 (12 of 15). Build and Test CI passing on main on 8 October 2026, Dependabot and Socket scans (10).", "payments": "No x402, MPP or L402 (0). Public plan prices, $14.99 a month or $109 a year, with the API included at no extra charge (10). 34-day free trial with no card when signing up on ynab.com (20). A person has to sign up in a browser and create a token or OAuth app in Developer Settings (0).", "reliability": "Statuspage at ynabstatus.com with a Public API component and incident history back to 2024 (20). No incident of any kind from 16 July to 14 October 2026; the last one touching the Public API was intermittent loading on 18 November 2025, about 3 hours (30). Rate limit of 200 requests an hour per access token, rolling window, documented (15). 429 too_many_requests is documented with \"wait awhile and try again\", but there's no Retry-After and the X-Rate-Limit header was removed in v1.73.0; import_id on created transactions matches retries instead of duplicating them (7 of 15). No SLA found (0). The API is generally available (10).", "schema": "Public OpenAPI 3.1.1 file, version 1.87.0, 44 operations (25). No llms.txt or Markdown docs for the API; api.ynab.com/llms.txt answers 401 and www.ynab.com/llms.txt describes the app (0). Tag and parameter descriptions say what each resource is and when to use the last-used and default plan aliases, and the docs say to request the most specific resource; little when-not-to-use guidance (14 of 20). Typed parameters with 15 enums, maxLength and required fields, few loose objects (12 of 15). An error table with ids such as 403.1 subscription_lapsed and 403.4 data_limit_reached, sample responses in the docs, few examples in the spec (11 of 15). Versioned spec and a dated changelog from v1.68.0 to v1.87.0 (15).", "security": "OAuth authorisation code grant with PKCE, state, 2-hour access tokens and refresh tokens, with one read-only scope; the implicit grant is still offered, and personal access tokens never expire and carry full access, though each is revocable. Tokens travel only in the Authorization header (22 of 30). The read-only scope returns 403 on writes, but personal access tokens have no read-only option and deletes need no confirmation (10 of 20). Responses include payee names and memos imported from banks; no guidance on treating them as untrusted (5 of 15). No per-call log or audit trail for API use found (0). security.txt with Bugcrowd and security@ynab.com but no Expires line, a public Bugcrowd bounty, and SOC 2 and ISO 27001 claimed only for the AWS infrastructure beneath Heroku (14 of 20).", "transparency": "Closed service with API terms, general terms and a privacy policy; SDKs under Apache-2.0 (15). The privacy policy, effective 20 April 2026, gives retention periods (account data up to 24 months after a subscription or trial ends, support conversations up to 3 years, workshop recordings 21 days) and agrees with the security page on deletion; no DPA or subprocessor list found (20 of 30). Deprecated fields such as goal_target_month and debt_original_balance are dated in the changelog, and the old domain and /budgets paths still work; no written deprecation policy (12 of 20). Data is processed in the US with Standard Contractual Clauses for UK and EEA transfers, hosting on Heroku and AWS and the aggregators Plaid and MX are named, other subprocessors only by category (10 of 20)." }, "sources": [ { "what": "API documentation, auth, errors, rate limits, changelog and API terms", "url": "https://api.ynab.com/", "seen": "2026-10-14" }, { "what": "OpenAPI file", "url": "https://api.ynab.com/papi/open_api_spec.yaml", "seen": "2026-10-14" }, { "what": "status page incidents", "url": "https://ynabstatus.com/api/v2/incidents.json", "seen": "2026-10-14" }, { "what": "pricing", "url": "https://www.ynab.com/pricing", "seen": "2026-10-14" }, { "what": "security page", "url": "https://www.ynab.com/security", "seen": "2026-10-14" }, { "what": "privacy policy", "url": "https://www.ynab.com/privacy-policy/", "seen": "2026-10-14" }, { "what": "terms of service", "url": "https://www.ynab.com/terms/", "seen": "2026-10-14" }, { "what": "security.txt", "url": "https://api.ynab.com/.well-known/security.txt", "seen": "2026-10-14" }, { "what": "JavaScript SDK repository, issues and CI", "url": "https://github.com/ynab/ynab-sdk-js", "seen": "2026-10-14" }, { "what": "npm package", "url": "https://registry.npmjs.org/ynab", "seen": "2026-10-14" }, { "what": "PyPI package", "url": "https://pypi.org/pypi/ynab/json", "seen": "2026-10-14" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0.1/servers?search=ynab", "seen": "2026-10-14" } ], "openQuestions": [ "unchecked: whether Developer Settings shows any per-token usage or last-used date, which the docs don't describe.", "unchecked: whether YNAB holds its own SOC 2 or ISO 27001 report; the security page names only AWS's.", "The JavaScript SDK repository shows a pull request bumping 4.4.0 to 4.5.0 on 19 August 2026, while npm dates 4.5.0 to 1 July 2026; the npm date is used." ] }, "negative": 0, "verdict": "A public OpenAPI 3.1.1 file, a dated changelog and an OAuth read-only scope let an agent read and edit a person's own budget. Each token is limited to 200 requests an hour with no Retry-After, personal access tokens never expire and have no read-only option, and access always starts with a person signing up in a browser.", "bestFor": "An agent helping one person with their own YNAB plan, reading spending and editing categories, transactions and targets.", "strengths": [ "Public OpenAPI 3.1.1 file at api.ynab.com/papi/open_api_spec.yaml, version 1.87.0, with 44 operations", "OAuth authorisation code grant with PKCE, refresh tokens and a read-only scope that returns 403 on writes", "Delta requests with last_knowledge_of_server on nine resources return only what changed", "Dated API changelog with 21 versions since February 2024, the latest on 17 September 2026", "Official SDKs for JavaScript, Python and Ruby under Apache-2.0, with CI passing on the JavaScript SDK" ], "weaknesses": [ "Each access token is limited to 200 requests an hour in a rolling window, and 429 responses carry no Retry-After", "Personal access tokens don't expire and can't be limited to reading", "No list pagination, so a full transaction list depends on date filters and delta requests", "Getting access needs a person to sign up and create a token or OAuth app in the web app", "No llms.txt or Markdown version of the API docs; the site's llms.txt is a product description" ], "agentNotes": [ "Use last-used in place of plan_id until you have listed plans with GET /v1/plans", "Store server_knowledge and send it back as last_knowledge_of_server to stay inside 200 requests an hour", "Read and write amounts in milliunits, or read the _currency fields added in v1.82.0", "Set import_id on transactions you create so a retried POST is matched instead of duplicated", "Request scope=read-only on OAuth when the task only reads the budget" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "high", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 65.1 } ], "editorialScores": { "ergonomics": 71, "maintenance": 62, "payments": 30, "reliability": 82, "schema": 77, "security": 51, "transparency": 57 }, "provenanceScore": 92 }, "connect": { "install": "npm install ynab", "http": "curl -H \"Authorization: Bearer \u003cACCESS_TOKEN\u003e\" https://api.ynab.com/v1/plans" }, "letme": { "capability": "https://letme.dev/finance.budgets", "tool": "https://letme.dev/ynab" }, "notable": [ "OpenAPI 3.1.1 file, version 1.87.0, with 44 operations (28 GET, 7 POST, 5 PATCH, 2 PUT, 2 DELETE) across user, plans, accounts, categories, payees, months, money movements, transactions and scheduled transactions (https://api.ynab.com/papi/open_api_spec.yaml)", "v1.79.0 on 5 March 2026 renamed budgets to plans in every path and response key. The old /budgets paths still work with the old key names but are no longer documented (https://api.ynab.com/#changelog)", "Rate limit of 200 requests an hour per access token in a rolling window; v1.73.0 on 29 January 2025 removed the X-Rate-Limit header from 429 responses (https://api.ynab.com/#rate-limiting)", "Transactions listings default since_date to one year ago since v1.85.0 on 27 May 2026, so older history needs an explicit since_date (https://api.ynab.com/#changelog)", "No official MCP server. The docs list community MCP servers such as avenir-mcp under Works with YNAB third party, which YNAB says it doesn't support; the official MCP registry has only community entries (https://registry.modelcontextprotocol.io/v0.1/servers?search=ynab)", "Bank connections come from Plaid and MX, and TrueLayer for Europe per the status page. The API can trigger an import with POST /plans/{plan_id}/transactions/import but never sees bank credentials (https://www.ynab.com/security, https://ynabstatus.com)", "The API terms forbid requesting or storing users' bank credentials and require OAuth apps to state they are not affiliated with YNAB. The general terms forbid any robot, bot, spider or scraper to access the services, outside the API (https://api.ynab.com/#terms, https://www.ynab.com/terms/)" ], "area": "domain-data", "details": [ { "label": "Base URL", "value": "https://api.ynab.com/v1 (the old https://api.youneedabudget.com/v1 still answers)" }, { "label": "Write access", "value": "Create and update transactions, scheduled transactions, categories, category groups and payees; set a category's assigned amount for a month; create accounts; delete transactions and scheduled transactions" }, { "label": "Rate limit", "value": "200 requests an hour per access token, rolling window, 429 too_many_requests" }, { "label": "Amounts", "value": "Milliunits (1,000 = one unit of currency), plus _formatted and _currency fields since v1.82.0" }, { "label": "Bank connections", "value": "Plaid, MX and TrueLayer, read-only, through the YNAB app; the API reads the imported data" }, { "label": "Support", "value": "Email api@ynab.com, reply within up to a week, no detailed coding help" } ], "unitPrices": [ { "item": "YNAB subscription, monthly", "unit": "month", "usd": 14.99, "note": "API included" }, { "item": "YNAB subscription, annual", "unit": "month", "usd": 9.08, "note": "billed $109 a year, API included" } ], "provenance": { "legalEntity": "You Need A Budget LLC", "domain": "ynab.com", "domainRegistered": "2001-11-24", "endpointOnVendorDomain": true, "terms": "https://www.ynab.com/terms/", "privacy": "https://www.ynab.com/privacy-policy/", "statusPage": "https://ynabstatus.com", "changelog": "https://api.ynab.com/#changelog", "securityTxt": "valid", "checked": "2026-10-14", "notes": [ "The terms (last modified 9 April 2026) and the privacy policy (effective 20 April 2026) name You Need A Budget LLC d/b/a YNAB, governed by Utah law, with You Need A Budget UK Ltd of Cheltenham for UK and EEA open banking.", "API Terms of Service sit on api.ynab.com under Legal and work with the general terms and privacy policy.", "security.txt at api.ynab.com/.well-known/security.txt names Bugcrowd and security@ynab.com but has no Expires line, which RFC 9116 requires. www.ynab.com/.well-known/security.txt returned 404.", "RDAP at Verisign gives a registration date of 2001-11-24 for ynab.com.", "The status page at ynabstatus.com is a Statuspage site with a Public API component." ], "score": 92, "checks": [ { "check": "Legal entity named", "value": "You Need A Budget LLC", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "ynab.com, registered 2001-11-24 (24 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "api.ynab.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 5 of the 7 things a reader expects, and has 3 clauses that cost points", "points": 2.3, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects", "points": 10, "max": 10, "state": "ok" }, { "check": "Status page", "value": "ynabstatus.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://www.ynab.com/terms/", "state": "read", "readAt": "2026-10-14", "statedDate": "2026-04-09", "words": 7162, "points": 2.3, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Modified: April 9, 2026", "says": "Last updated 2026-04-09" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "…non-contractual disputes or claims), shall be governed by and construed in accordance with the internal laws of the State of Utah without giving effect to any choice or conflict of law provision or rule (unless otherwise required by law or if your state requires us to apply your state’s law, such as in California or N…", "says": "The law of the State of Utah" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": false }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "Failed Payments: If your payment method fails or your account is past due, we may suspend or terminate your access to the Services." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "Your continued use of the Services following the posting of revised Terms of Service means that you accept and agree to the changes.", "says": "Changes are posted, with no other notice named" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "If you do not meet all of these requirements, you must not access or use the Services." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "Use any robot, bot, spider, scraper, offline reader or other automatic device, process or means to access the Services for any purpose, including monitoring or copying any of the material on the Services.", "costsPoints": true }, { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "You shall not use our Services for competitive purposes, and our Services shall not be used by any of YNAB’s competitors or anyone affiliated with YNAB’s competitors.", "costsPoints": true }, { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "We reserve the right to withdraw or amend our Services, and any service or material we provide, in our sole discretion without notice.", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "We retain the right to: (1) take appropriate legal action for any illegal or unauthorized use of the Services and (2) terminate or suspend your access to all or part of the Services for any or no reason, including, without limitation, any violation of these Terms of Service." }, { "key": "terms.arbitration", "label": "Requires arbitration or waives class actions", "found": true, "quote": "Agreement to Arbitrate: Any legal suit, action, or proceeding arising out of, or related to, these Terms of Service or the Services shall be resolved exclusively through final and binding arbitration, rather than in court, except as set forth below." } ], "notes": [ { "date": "2026-10-14", "text": "Use is limited to personal, household or small business purposes, and a small business means one with 50 or fewer employees.", "quote": "A small business shall mean a business that has 50 or fewer employees." }, { "date": "2026-10-14", "text": "Any program that uses the YNAB API must show a warning that it is unsupported and require the user to acknowledge it before working.", "quote": "(a “OAuth App”) does so at the risk of its users and developers, and must display the following message at least once, and require the user to acknowledge before the application will function:" }, { "date": "2026-10-14", "text": "Subscriptions renew automatically at the end of each billing period at the then-current rate unless cancelled.", "quote": "Your subscription will automatically renew at the end of each billing period unless you cancel before the renewal date." } ] }, { "kind": "privacy", "url": "https://www.ynab.com/privacy-policy/", "state": "read", "readAt": "2026-10-14", "statedDate": "2026-04-09", "words": 7230, "points": 10, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Modified: April 9, 2026", "says": "Last updated 2026-04-09" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "✓ Generally, we use the information we collect about you to correspond with you, perform our agreements with you, carry out marketing and advertising activities, and perform our day-to-day business activities and operations." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We may record the course sessions for other participants in the cohort who are unable to attend a live session or want to watch it again, and keep the recording for 21 days.", "says": "Names a period of 21 days" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "We may use AI-powered tools, including chatbots provided by third-party service providers, to assist with initial responses, perform specific actions on your behalf with your consent, and connect you with human support specialists." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "we do perform typical targeted advertising in an effort to introduce more people to the many benefits of YNAB." }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "Where we rely on this basis, you may, depending on your jurisdiction, have the right to withdraw your consent at any time as described below." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have any questions or concerns about this Policy, please contact us at privacy@ynab.com.", "says": "privacy@ynab.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "For transfers of personal data from the UK, EEA, or Switzerland to the United States, we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses (and the UK Addendum, where applicable), to help protect your personal data.", "says": "Relies on standard contractual clauses" } ], "toKnow": [ { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "Nevertheless, our online advertising activities targeting prospective YNAB users may be considered to be a “sale” and/or “sharing/processing” for targeted advertising purposes under the broad definitions of those terms in state privacy laws." } ], "notes": [ { "date": "2026-10-14", "text": "YNAB may offer applications on third-party AI assistant platforms and receives the prompts users submit to them.", "quote": "We may make YNAB content and tools available through applications on third-party platforms, such as AI assistants or chatbots." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/ynab.json", "live": { "slug": "ynab", "probe": { "target": "https://api.ynab.com/v1", "method": "get", "lastAt": "2026-10-14T09:42:14.536615748Z", "lastOk": true, "lastStatus": 200, "lastMs": 317, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 320, "p95ms24h": 379, "samples24h": 17, "samples30d": 17, "days": [ { "date": "2026-10-14", "probes": 17, "ok": 17 } ] }, "vendorStatus": { "page": "https://ynabstatus.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-14T09:39:48.725692047Z" }, "updatedAt": "2026-10-14T09:42:14.536615748Z" } }, "verify": { "accepts": "a page on ynab.com or one of its subdomains, or the README of github.com/ynab/ynab-sdk-js", "badgeUrl": "https://www.anchorterminal.com/badges/ynab.svg", "body": { "slug": "ynab", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/ynab", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/ynab\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/ynab.svg\" alt=\"YNAB on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![YNAB on Anchor Terminal](https://www.anchorterminal.com/badges/ynab.svg)](https://www.anchorterminal.com/tools/ynab)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/ynab\"\u003eYNAB on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/ynab", "json": "https://www.anchorterminal.com/tools/ynab.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/ynab.md", "slim": "https://www.anchorterminal.com/tools/ynab.min.md" }, "markdown": "## Overview\n\n**Grade B · 65.1/100 · rank #351 of 1076 · #1 in Subscriptions, bills \u0026 personal finance · not agent-ready · confidence high**\n\n\n## Assessment\n\nA public OpenAPI 3.1.1 file, a dated changelog and an OAuth read-only scope let an agent read and edit a person's own budget. Each token is limited to 200 requests an hour with no Retry-After, personal access tokens never expire and have no read-only option, and access always starts with a person signing up in a browser.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | YNAB (https://www.ynab.com) |\n| Kind | HTTP API |\n| Category | Subscriptions, bills \u0026 personal finance (https://www.anchorterminal.com/categories/personal-finance) |\n| Transport | HTTP |\n| Endpoint | `https://api.ynab.com/v1` |\n| Auth | OAuth or key · Bearer token in the Authorization header. A personal access token is made in the web app under Account Settings, Developer Settings, after entering the password; it never expires and is revoked from the same page. OAuth apps use the implicit grant or the authorisation code grant with PKCE and state; access tokens last 2 hours and the code grant returns a refresh token. scope=read-only gives a token that gets 403 on writes. New OAuth apps are in Restricted Mode, limited to 25 users other than the owner, until a review that takes 2 to 4 weeks (https://api.ynab.com/). |\n| Pricing | Paid ($14.99 / mo) · The API comes with a YNAB subscription at no extra charge. $14.99 a month or $109 a year in US dollars, with a 34-day free trial that needs no card when signing up on ynab.com (app stores may ask for one) and a 365-day trial for college students (https://www.ynab.com/pricing). A lapsed subscription or expired trial returns 403.1 or 403.2 on every call (https://api.ynab.com/#errors). |\n| x402 | No · No x402, MPP or L402 in the API documentation, the OpenAPI file or the pricing page (checked 2026-10-14). |\n| Licence | Proprietary service; SDKs Apache-2.0 |\n| Tools exposed | 0 |\n| Packages | npm: `ynab`; pypi: `ynab`; rubygems: `ynab` |\n| Source | https://github.com/ynab/ynab-sdk-js |\n| Docs | https://api.ynab.com/ |\n| llms.txt | not found |\n| Last release | 2026-09-17 |\n| GitHub stars | 240 (as of 2026-10-14) |\n| npm downloads / week | 9,596 |\n| PyPI downloads / week | 2,299 |\n| Base URL | https://api.ynab.com/v1 (the old https://api.youneedabudget.com/v1 still answers) |\n| Write access | Create and update transactions, scheduled transactions, categories, category groups and payees; set a category's assigned amount for a month; create accounts; delete transactions and scheduled transactions |\n| Rate limit | 200 requests an hour per access token, rolling window, 429 too_many_requests |\n| Amounts | Milliunits (1,000 = one unit of currency), plus _formatted and _currency fields since v1.82.0 |\n| Bank connections | Plaid, MX and TrueLayer, read-only, through the YNAB app; the API reads the imported data |\n| Support | Email api@ynab.com, reply within up to a week, no detailed coding help |\n| Capabilities | finance.budgets, finance.transactions |\n| Tags | hosted, oauth, openapi, typescript, python, ruby, status-page, bug-bounty, security-txt, free-trial, no-card, read-only-mode, closed-source |\n| JSON | https://www.anchorterminal.com/api/v1/tools/ynab.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-14 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: high. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 82 | 16.4 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 77 | 12.5 |\n| Agent ergonomics | 13% | 16.2 | 71 | 11.5 |\n| Security \u0026 auth | 14% | 17.5 | 51 | 8.9 |\n| Payments \u0026 pricing | 10% | 12.5 | 30 | 3.8 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 62 | 5.4 |\n| Transparency \u0026 trust (editorial 57, provenance 92) | 7% | 8.8 | 75 | 6.6 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **65.1 → B** |\n\n### Why each score\n\n- Reliability 82: Statuspage at ynabstatus.com with a Public API component and incident history back to 2024 (20). No incident of any kind from 16 July to 14 October 2026; the last one touching the Public API was intermittent loading on 18 November 2025, about 3 hours (30). Rate limit of 200 requests an hour per access token, rolling window, documented (15). 429 too_many_requests is documented with \"wait awhile and try again\", but there's no Retry-After and the X-Rate-Limit header was removed in v1.73.0; import_id on created transactions matches retries instead of duplicating them (7 of 15). No SLA found (0). The API is generally available (10).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 77: Public OpenAPI 3.1.1 file, version 1.87.0, 44 operations (25). No llms.txt or Markdown docs for the API; api.ynab.com/llms.txt answers 401 and www.ynab.com/llms.txt describes the app (0). Tag and parameter descriptions say what each resource is and when to use the last-used and default plan aliases, and the docs say to request the most specific resource; little when-not-to-use guidance (14 of 20). Typed parameters with 15 enums, maxLength and required fields, few loose objects (12 of 15). An error table with ids such as 403.1 subscription_lapsed and 403.4 data_limit_reached, sample responses in the docs, few examples in the spec (11 of 15). Versioned spec and a dated changelog from v1.68.0 to v1.87.0 (15).\n- Agent ergonomics 71: Specific single-resource endpoints, since_date and until_date, a type filter (`uncategorized`, `unapproved`), and delta requests on nine resources; no field selection (17 of 25). No pagination on lists; date filters and delta requests stand in for it (12 of 20). Errors carry id, name and detail, with 403 split into five documented causes an agent can act on (17 of 20). Reads are safe to repeat and import_id prevents duplicate transactions, with 409 on conflicts and duplicate_import_ids in responses; no idempotency key for other writes (10 of 20). The last-used plan alias cuts a call, few required parameters, and official SDKs for JavaScript, Python and Ruby (15).\n- Security \u0026 auth 51: OAuth authorisation code grant with PKCE, state, 2-hour access tokens and refresh tokens, with one read-only scope; the implicit grant is still offered, and personal access tokens never expire and carry full access, though each is revocable. Tokens travel only in the Authorization header (22 of 30). The read-only scope returns 403 on writes, but personal access tokens have no read-only option and deletes need no confirmation (10 of 20). Responses include payee names and memos imported from banks; no guidance on treating them as untrusted (5 of 15). No per-call log or audit trail for API use found (0). security.txt with Bugcrowd and security@ynab.com but no Expires line, a public Bugcrowd bounty, and SOC 2 and ISO 27001 claimed only for the AWS infrastructure beneath Heroku (14 of 20).\n- Payments \u0026 pricing 30: No x402, MPP or L402 (0). Public plan prices, $14.99 a month or $109 a year, with the API included at no extra charge (10). 34-day free trial with no card when signing up on ynab.com (20). A person has to sign up in a browser and create a token or OAuth app in Developer Settings (0).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 62: Last API change v1.87.0 on 17 September 2026 (30). In the last 90 days only v1.87.0 and ynab Python 4.4.0 on 12 August 2026, two dated releases (0). Closed service with a dated changelog and email support at api@ynab.com that says replies may take up to a week; on the JavaScript SDK maintainers merge their own pull requests within days, but an issue opened on 1 August and a community pull request of 23 August have no reply (10 of 15). Three official SDKs, regenerated from the spec; the JavaScript SDK's 4.5.0 of 1 July 2026 predates v1.87.0 (12 of 15). Build and Test CI passing on main on 8 October 2026, Dependabot and Socket scans (10).\n- Transparency \u0026 trust 75: Closed service with API terms, general terms and a privacy policy; SDKs under Apache-2.0 (15). The privacy policy, effective 20 April 2026, gives retention periods (account data up to 24 months after a subscription or trial ends, support conversations up to 3 years, workshop recordings 21 days) and agrees with the security page on deletion; no DPA or subprocessor list found (20 of 30). Deprecated fields such as goal_target_month and debt_original_balance are dated in the changelog, and the old domain and /budgets paths still work; no written deprecation policy (12 of 20). Data is processed in the US with Standard Contractual Clauses for UK and EEA transfers, hosting on Heroku and AWS and the aggregators Plaid and MX are named, other subprocessors only by category (10 of 20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (11 items): https://www.anchorterminal.com/fixes/ynab.md (JSON https://www.anchorterminal.com/fixes/ynab.json)\n\n### What we couldn't check\n\n- unchecked: whether Developer Settings shows any per-token usage or last-used date, which the docs don't describe.\n- unchecked: whether YNAB holds its own SOC 2 or ISO 27001 report; the security page names only AWS's.\n- The JavaScript SDK repository shows a pull request bumping 4.4.0 to 4.5.0 on 19 August 2026, while npm dates 4.5.0 to 1 July 2026; the npm date is used.\n\n### Sources\n\n- API documentation, auth, errors, rate limits, changelog and API terms: \u003chttps://api.ynab.com/\u003e (seen 2026-10-14)\n- OpenAPI file: \u003chttps://api.ynab.com/papi/open_api_spec.yaml\u003e (seen 2026-10-14)\n- status page incidents: \u003chttps://ynabstatus.com/api/v2/incidents.json\u003e (seen 2026-10-14)\n- pricing: \u003chttps://www.ynab.com/pricing\u003e (seen 2026-10-14)\n- security page: \u003chttps://www.ynab.com/security\u003e (seen 2026-10-14)\n- privacy policy: \u003chttps://www.ynab.com/privacy-policy/\u003e (seen 2026-10-14)\n- terms of service: \u003chttps://www.ynab.com/terms/\u003e (seen 2026-10-14)\n- security.txt: \u003chttps://api.ynab.com/.well-known/security.txt\u003e (seen 2026-10-14)\n- JavaScript SDK repository, issues and CI: \u003chttps://github.com/ynab/ynab-sdk-js\u003e (seen 2026-10-14)\n- npm package: \u003chttps://registry.npmjs.org/ynab\u003e (seen 2026-10-14)\n- PyPI package: \u003chttps://pypi.org/pypi/ynab/json\u003e (seen 2026-10-14)\n- official MCP registry search: \u003chttps://registry.modelcontextprotocol.io/v0.1/servers?search=ynab\u003e (seen 2026-10-14)\n\n## Who's behind it (provenance 92/100, checked 2026-10-14)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | You Need A Budget LLC | 20/20 |\n| Domain age | ynab.com, registered 2001-11-24 (24 years) | 15/15 |\n| Endpoint on the vendor's domain | api.ynab.com | 15/15 |\n| Terms of service | read, states 5 of the 7 things a reader expects, and has 3 clauses that cost points | 2.3/10 |\n| Privacy policy | read, states 8 of the 8 things a reader expects | 10/10 |\n| Status page | ynabstatus.com | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | valid | 10/10 |\n\nThe terms (last modified 9 April 2026) and the privacy policy (effective 20 April 2026) name You Need A Budget LLC d/b/a YNAB, governed by Utah law, with You Need A Budget UK Ltd of Cheltenham for UK and EEA open banking.\n\nAPI Terms of Service sit on api.ynab.com under Legal and work with the general terms and privacy policy.\n\nsecurity.txt at api.ynab.com/.well-known/security.txt names Bugcrowd and security@ynab.com but has no Expires line, which RFC 9116 requires. www.ynab.com/.well-known/security.txt returned 404.\n\nRDAP at Verisign gives a registration date of 2001-11-24 for ynab.com.\n\nThe status page at ynabstatus.com is a Statuspage site with a Public API component.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://www.ynab.com/terms/), read 2026-10-14, dated 2026-04-09, states 5 of the 7 things a reader expects.\n\n- To know. Restricts automated access (costs points). \"Use any robot, bot, spider, scraper, offline reader or other automatic device, process or means to access the Services for any purpose, including monitoring or copying any of the material on the Services.\"\n- To know. Restricts benchmarking or competitive use (costs points). \"You shall not use our Services for competitive purposes, and our Services shall not be used by any of YNAB’s competitors or anyone affiliated with YNAB’s competitors.\"\n- To know. Says the terms or the service can change without notice (costs points). \"We reserve the right to withdraw or amend our Services, and any service or material we provide, in our sole discretion without notice.\"\n- To know. Says access can be ended without notice or for any reason. \"We retain the right to: (1) take appropriate legal action for any illegal or unauthorized use of the Services and (2) terminate or suspend your access to all or part of the Services for any or no reason, including, without limitation, any violation of these Terms of Service.\"\n- To know. Requires arbitration or waives class actions. \"Agreement to Arbitrate: Any legal suit, action, or proceeding arising out of, or related to, these Terms of Service or the Services shall be resolved exclusively through final and binding arbitration, rather than in court, except as set forth below.\"\n- Gives the date it was last updated. Last updated 2026-04-09.\n- Names the governing law or courts. The law of the State of Utah.\n- Not found in the text. States a limit on its liability.\n- Says how changes to the terms are announced. Changes are posted, with no other notice named.\n- Not found in the text. Refers to a service level or uptime commitment.\n- Also in the text (2026-10-14). Use is limited to personal, household or small business purposes, and a small business means one with 50 or fewer employees. \"A small business shall mean a business that has 50 or fewer employees.\"\n- Also in the text (2026-10-14). Any program that uses the YNAB API must show a warning that it is unsupported and require the user to acknowledge it before working. \"(a “OAuth App”) does so at the risk of its users and developers, and must display the following message at least once, and require the user to acknowledge before the application will function:\"\n- Also in the text (2026-10-14). Subscriptions renew automatically at the end of each billing period at the then-current rate unless cancelled. \"Your subscription will automatically renew at the end of each billing period unless you cancel before the renewal date.\"\n\n**Privacy policy** (https://www.ynab.com/privacy-policy/), read 2026-10-14, dated 2026-04-09, states 8 of the 8 things a reader expects.\n\n- To know. Says it sells personal data or shares it for advertising. \"Nevertheless, our online advertising activities targeting prospective YNAB users may be considered to be a “sale” and/or “sharing/processing” for targeted advertising purposes under the broad definitions of those terms in state privacy laws.\"\n- Gives the date it was last updated. Last updated 2026-04-09.\n- Says how long data is kept. Names a period of 21 days.\n- Gives a privacy contact. privacy@ynab.com.\n- Says where data is transferred or stored. Relies on standard contractual clauses.\n- Also in the text (2026-10-14). YNAB may offer applications on third-party AI assistant platforms and receives the prompts users submit to them. \"We may make YNAB content and tools available through applications on third-party platforms, such as AI assistants or chatbots.\"\n\n## Live (updated 2026-10-14 09:42 UTC)\n\n- Right now: up, HTTP 200, 317 ms, checked 2026-10-14 09:42 UTC (get on `https://api.ynab.com/v1`)\n- Uptime 24h 100.0% (17 probes) · 30 days 100.0% (17 probes) · p50 320 ms · p95 379 ms\n- Vendor status page: none, All Systems Operational\n- Always current: https://www.anchorterminal.com/api/v1/live/ynab.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Prices\n\n| Item | Price | Unit | Note |\n| --- | --- | --- | --- |\n| YNAB subscription, monthly | $14.99 | per month (plan) | API included |\n| YNAB subscription, annual | $9.08 | per month (plan) | billed $109 a year, API included |\n\nAcross all listings: https://www.anchorterminal.com/prices/index.md\n\n## Strengths\n\n- Public OpenAPI 3.1.1 file at api.ynab.com/papi/open_api_spec.yaml, version 1.87.0, with 44 operations\n- OAuth authorisation code grant with PKCE, refresh tokens and a read-only scope that returns 403 on writes\n- Delta requests with last_knowledge_of_server on nine resources return only what changed\n- Dated API changelog with 21 versions since February 2024, the latest on 17 September 2026\n- Official SDKs for JavaScript, Python and Ruby under Apache-2.0, with CI passing on the JavaScript SDK\n\n## Weaknesses\n\n- Each access token is limited to 200 requests an hour in a rolling window, and 429 responses carry no Retry-After\n- Personal access tokens don't expire and can't be limited to reading\n- No list pagination, so a full transaction list depends on date filters and delta requests\n- Getting access needs a person to sign up and create a token or OAuth app in the web app\n- No llms.txt or Markdown version of the API docs; the site's llms.txt is a product description\n\n## Before you call it (notes for agents)\n\n1. Use last-used in place of plan_id until you have listed plans with GET /v1/plans\n2. Store server_knowledge and send it back as last_knowledge_of_server to stay inside 200 requests an hour\n3. Read and write amounts in milliunits, or read the _currency fields added in v1.82.0\n4. Set import_id on transactions you create so a retried POST is matched instead of duplicated\n5. Request scope=read-only on OAuth when the task only reads the budget\n\n## Connect\n\nInstall:\n\n```bash\nnpm install ynab\n```\n\nFirst request:\n\n```bash\ncurl -H \"Authorization: Bearer \u003cACCESS_TOKEN\u003e\" https://api.ynab.com/v1/plans\n```\n\nThrough letme (picks today, calling later): https://letme.dev/ynab (letme picks it for finance.budgets, the top-graded tool for the job, letme picks it for finance.transactions, the top-graded tool for the job). letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Snoop | F | 26.7 | 1027 | finance.budgets, finance.transactions | no | https://www.anchorterminal.com/tools/snoop.md |\n| Quicken Simplifi | F | 20.7 | 1037 | finance.budgets, finance.transactions | no | https://www.anchorterminal.com/tools/quicken-simplifi.md |\n| Emma | F | 17.4 | 1044 | finance.budgets, finance.transactions | no | https://www.anchorterminal.com/tools/emma.md |\n| Rocket Money | F | 17 | 1046 | finance.budgets, finance.transactions | no | https://www.anchorterminal.com/tools/rocket-money.md |\n| Copilot Money | F | 16.3 | 1049 | finance.budgets, finance.transactions | no | https://www.anchorterminal.com/tools/copilot-money.md |\n| PocketGuard | F | 14.6 | 1053 | finance.budgets, finance.transactions | no | https://www.anchorterminal.com/tools/pocketguard.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- OpenAPI 3.1.1 file, version 1.87.0, with 44 operations (28 GET, 7 POST, 5 PATCH, 2 PUT, 2 DELETE) across user, plans, accounts, categories, payees, months, money movements, transactions and scheduled transactions (source: \u003chttps://api.ynab.com/papi/open_api_spec.yaml\u003e)\n- v1.79.0 on 5 March 2026 renamed budgets to plans in every path and response key. The old /budgets paths still work with the old key names but are no longer documented (source: \u003chttps://api.ynab.com/#changelog\u003e)\n- Rate limit of 200 requests an hour per access token in a rolling window; v1.73.0 on 29 January 2025 removed the X-Rate-Limit header from 429 responses (source: \u003chttps://api.ynab.com/#rate-limiting\u003e)\n- Transactions listings default since_date to one year ago since v1.85.0 on 27 May 2026, so older history needs an explicit since_date (source: \u003chttps://api.ynab.com/#changelog\u003e)\n- No official MCP server. The docs list community MCP servers such as avenir-mcp under Works with YNAB third party, which YNAB says it doesn't support; the official MCP registry has only community entries (source: \u003chttps://registry.modelcontextprotocol.io/v0.1/servers?search=ynab\u003e)\n- Bank connections come from Plaid and MX, and TrueLayer for Europe per the status page. The API can trigger an import with POST /plans/{plan_id}/transactions/import but never sees bank credentials (source: \u003chttps://www.ynab.com/security, https://ynabstatus.com\u003e)\n- The API terms forbid requesting or storing users' bank credentials and require OAuth apps to state they are not affiliated with YNAB. The general terms forbid any robot, bot, spider or scraper to access the services, outside the API (source: \u003chttps://api.ynab.com/#terms, https://www.ynab.com/terms/\u003e)\n\n- #1 of 10 in Best subscription, bill and budgeting tools for AI agents: https://www.anchorterminal.com/best/personal-finance/index.md\n- All 43 personal finance comparisons: https://www.anchorterminal.com/compare/personal-finance/index.md\n\n## Compare\n\n- [Copilot Money vs YNAB](https://www.anchorterminal.com/compare/copilot-money-vs-ynab.md): F 16.3 vs B 65.1\n- [Emma vs YNAB](https://www.anchorterminal.com/compare/emma-vs-ynab.md): F 17.4 vs B 65.1\n- [Hiatus vs YNAB](https://www.anchorterminal.com/compare/hiatus-vs-ynab.md): F 14.3 vs B 65.1\n- [PocketGuard vs YNAB](https://www.anchorterminal.com/compare/pocketguard-vs-ynab.md): F 14.6 vs B 65.1\n- [Quicken Simplifi vs YNAB](https://www.anchorterminal.com/compare/quicken-simplifi-vs-ynab.md): F 20.7 vs B 65.1\n- [Rocket Money vs YNAB](https://www.anchorterminal.com/compare/rocket-money-vs-ynab.md): F 17 vs B 65.1\n- [Snoop vs YNAB](https://www.anchorterminal.com/compare/snoop-vs-ynab.md): F 26.7 vs B 65.1\n- [Plum vs YNAB](https://www.anchorterminal.com/compare/plum-vs-ynab.md): F 27.4 vs B 65.1\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on ynab.com or one of its subdomains, or the README of github.com/ynab/ynab-sdk-js. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"ynab\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/ynab\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/ynab.svg\" alt=\"YNAB on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![YNAB on Anchor Terminal](https://www.anchorterminal.com/badges/ynab.svg)](https://www.anchorterminal.com/tools/ynab)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/ynab\"\u003eYNAB on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say YNAB is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/ynab-dark.png\n- Light: https://www.anchorterminal.com/assets/share/ynab-light.png\n- Create a video and download its frames: https://www.anchorterminal.com/assets/listing-video/index.html?listing=ynab\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Subscriptions, bills \u0026 personal finance", "url": "https://www.anchorterminal.com/categories/personal-finance" }, { "name": "YNAB", "url": "" } ], "description": "YNAB is a subscription budgeting app for people. Its REST API reads and edits a user's plans, accounts, categories, payees and transactions, with personal access tokens or OAuth for apps other users authorise.", "facts": [ "rank #351 of 1076", "OAuth or key auth", "0 desk reviews" ], "h1": "YNAB", "image": "https://www.anchorterminal.com/assets/og/tools-ynab.png", "path": "/tools/ynab", "published": "2026-10-01", "section": "tools", "title": "YNAB review (2026): pricing, alternatives and grade B", "toc": null, "updated": "2026-10-14", "url": "https://www.anchorterminal.com/tools/ynab" }, "tokens": { "markdown": 6450, "slim": 1280 }, "version": 1 }