# YNAB > YNAB is a subscription budgeting app for people. Its REST API reads and edits a user's plans, accounts, categories, payees and transactions, with personal access tokens or OAuth for apps other users authorise. - Canonical: https://www.anchorterminal.com/tools/ynab - Markdown: https://www.anchorterminal.com/tools/ynab.md (~6,450 tokens) - Slim: https://www.anchorterminal.com/tools/ynab.min.md (~1,280 tokens, same facts, less prose, for token-sensitive contexts) - JSON: https://www.anchorterminal.com/tools/ynab.json (this page as data, same URL with Accept: application/json) - Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - Updated: 2026-10-14 ## Overview **Grade B · 65.1/100 · rank #351 of 1076 · #1 in Subscriptions, bills & personal finance · not agent-ready · confidence high** ## Assessment A public OpenAPI 3.1.1 file, a dated changelog and an OAuth read-only scope let an agent read and edit a person's own budget. Each token is limited to 200 requests an hour with no Retry-After, personal access tokens never expire and have no read-only option, and access always starts with a person signing up in a browser. ## Facts | Field | Value | | --- | --- | | Vendor | YNAB (https://www.ynab.com) | | Kind | HTTP API | | Category | Subscriptions, bills & personal finance (https://www.anchorterminal.com/categories/personal-finance) | | Transport | HTTP | | Endpoint | `https://api.ynab.com/v1` | | Auth | OAuth or key · Bearer token in the Authorization header. A personal access token is made in the web app under Account Settings, Developer Settings, after entering the password; it never expires and is revoked from the same page. OAuth apps use the implicit grant or the authorisation code grant with PKCE and state; access tokens last 2 hours and the code grant returns a refresh token. scope=read-only gives a token that gets 403 on writes. New OAuth apps are in Restricted Mode, limited to 25 users other than the owner, until a review that takes 2 to 4 weeks (https://api.ynab.com/). | | Pricing | Paid ($14.99 / mo) · The API comes with a YNAB subscription at no extra charge. $14.99 a month or $109 a year in US dollars, with a 34-day free trial that needs no card when signing up on ynab.com (app stores may ask for one) and a 365-day trial for college students (https://www.ynab.com/pricing). A lapsed subscription or expired trial returns 403.1 or 403.2 on every call (https://api.ynab.com/#errors). | | x402 | No · No x402, MPP or L402 in the API documentation, the OpenAPI file or the pricing page (checked 2026-10-14). | | Licence | Proprietary service; SDKs Apache-2.0 | | Tools exposed | 0 | | Packages | npm: `ynab`; pypi: `ynab`; rubygems: `ynab` | | Source | https://github.com/ynab/ynab-sdk-js | | Docs | https://api.ynab.com/ | | llms.txt | not found | | Last release | 2026-09-17 | | GitHub stars | 240 (as of 2026-10-14) | | npm downloads / week | 9,596 | | PyPI downloads / week | 2,299 | | Base URL | https://api.ynab.com/v1 (the old https://api.youneedabudget.com/v1 still answers) | | Write access | Create and update transactions, scheduled transactions, categories, category groups and payees; set a category's assigned amount for a month; create accounts; delete transactions and scheduled transactions | | Rate limit | 200 requests an hour per access token, rolling window, 429 too_many_requests | | Amounts | Milliunits (1,000 = one unit of currency), plus _formatted and _currency fields since v1.82.0 | | Bank connections | Plaid, MX and TrueLayer, read-only, through the YNAB app; the API reads the imported data | | Support | Email api@ynab.com, reply within up to a week, no detailed coding help | | Capabilities | finance.budgets, finance.transactions | | Tags | hosted, oauth, openapi, typescript, python, ruby, status-page, bug-bounty, security-txt, free-trial, no-card, read-only-mode, closed-source | | JSON | https://www.anchorterminal.com/api/v1/tools/ynab.json | ## Score breakdown (methodology v0.4, October 2026 research run) Assessed 2026-10-14 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: high. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. "This run" is each category's share of the 100 points. | Category | Weight | This run | Score (0–100) | Points | | --- | --- | --- | --- | --- | | Reliability | 16% | 20 | 82 | 16.4 | | Performance | 10% | pending | pending | n/a | | Schema & documentation | 13% | 16.2 | 77 | 12.5 | | Agent ergonomics | 13% | 16.2 | 71 | 11.5 | | Security & auth | 14% | 17.5 | 51 | 8.9 | | Payments & pricing | 10% | 12.5 | 30 | 3.8 | | Task success | 10% | pending | pending | n/a | | Maintenance & community | 7% | 8.8 | 62 | 5.4 | | Transparency & trust (editorial 57, provenance 92) | 7% | 8.8 | 75 | 6.6 | | Negative events | up to −15 | up to −15 | none recorded | 0 | | **Total** | | | | **65.1 → B** | ### Why each score - Reliability 82: Statuspage at ynabstatus.com with a Public API component and incident history back to 2024 (20). No incident of any kind from 16 July to 14 October 2026; the last one touching the Public API was intermittent loading on 18 November 2025, about 3 hours (30). Rate limit of 200 requests an hour per access token, rolling window, documented (15). 429 too_many_requests is documented with "wait awhile and try again", but there's no Retry-After and the X-Rate-Limit header was removed in v1.73.0; import_id on created transactions matches retries instead of duplicating them (7 of 15). No SLA found (0). The API is generally available (10). - Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes. - Schema & documentation 77: Public OpenAPI 3.1.1 file, version 1.87.0, 44 operations (25). No llms.txt or Markdown docs for the API; api.ynab.com/llms.txt answers 401 and www.ynab.com/llms.txt describes the app (0). Tag and parameter descriptions say what each resource is and when to use the last-used and default plan aliases, and the docs say to request the most specific resource; little when-not-to-use guidance (14 of 20). Typed parameters with 15 enums, maxLength and required fields, few loose objects (12 of 15). An error table with ids such as 403.1 subscription_lapsed and 403.4 data_limit_reached, sample responses in the docs, few examples in the spec (11 of 15). Versioned spec and a dated changelog from v1.68.0 to v1.87.0 (15). - Agent ergonomics 71: Specific single-resource endpoints, since_date and until_date, a type filter (`uncategorized`, `unapproved`), and delta requests on nine resources; no field selection (17 of 25). No pagination on lists; date filters and delta requests stand in for it (12 of 20). Errors carry id, name and detail, with 403 split into five documented causes an agent can act on (17 of 20). Reads are safe to repeat and import_id prevents duplicate transactions, with 409 on conflicts and duplicate_import_ids in responses; no idempotency key for other writes (10 of 20). The last-used plan alias cuts a call, few required parameters, and official SDKs for JavaScript, Python and Ruby (15). - Security & auth 51: OAuth authorisation code grant with PKCE, state, 2-hour access tokens and refresh tokens, with one read-only scope; the implicit grant is still offered, and personal access tokens never expire and carry full access, though each is revocable. Tokens travel only in the Authorization header (22 of 30). The read-only scope returns 403 on writes, but personal access tokens have no read-only option and deletes need no confirmation (10 of 20). Responses include payee names and memos imported from banks; no guidance on treating them as untrusted (5 of 15). No per-call log or audit trail for API use found (0). security.txt with Bugcrowd and security@ynab.com but no Expires line, a public Bugcrowd bounty, and SOC 2 and ISO 27001 claimed only for the AWS infrastructure beneath Heroku (14 of 20). - Payments & pricing 30: No x402, MPP or L402 (0). Public plan prices, $14.99 a month or $109 a year, with the API included at no extra charge (10). 34-day free trial with no card when signing up on ynab.com (20). A person has to sign up in a browser and create a token or OAuth app in Developer Settings (0). - Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored. - Maintenance & community 62: Last API change v1.87.0 on 17 September 2026 (30). In the last 90 days only v1.87.0 and ynab Python 4.4.0 on 12 August 2026, two dated releases (0). Closed service with a dated changelog and email support at api@ynab.com that says replies may take up to a week; on the JavaScript SDK maintainers merge their own pull requests within days, but an issue opened on 1 August and a community pull request of 23 August have no reply (10 of 15). Three official SDKs, regenerated from the spec; the JavaScript SDK's 4.5.0 of 1 July 2026 predates v1.87.0 (12 of 15). Build and Test CI passing on main on 8 October 2026, Dependabot and Socket scans (10). - Transparency & trust 75: Closed service with API terms, general terms and a privacy policy; SDKs under Apache-2.0 (15). The privacy policy, effective 20 April 2026, gives retention periods (account data up to 24 months after a subscription or trial ends, support conversations up to 3 years, workshop recordings 21 days) and agrees with the security page on deletion; no DPA or subprocessor list found (20 of 30). Deprecated fields such as goal_target_month and debt_original_balance are dated in the changelog, and the old domain and /budgets paths still work; no written deprecation policy (12 of 20). Data is processed in the US with Standard Contractual Clauses for UK and EEA transfers, hosting on Heroku and AWS and the aggregators Plaid and MX are named, other subprocessors only by category (10 of 20). Fix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (11 items): https://www.anchorterminal.com/fixes/ynab.md (JSON https://www.anchorterminal.com/fixes/ynab.json) ### What we couldn't check - unchecked: whether Developer Settings shows any per-token usage or last-used date, which the docs don't describe. - unchecked: whether YNAB holds its own SOC 2 or ISO 27001 report; the security page names only AWS's. - The JavaScript SDK repository shows a pull request bumping 4.4.0 to 4.5.0 on 19 August 2026, while npm dates 4.5.0 to 1 July 2026; the npm date is used. ### Sources - API documentation, auth, errors, rate limits, changelog and API terms: (seen 2026-10-14) - OpenAPI file: (seen 2026-10-14) - status page incidents: (seen 2026-10-14) - pricing: (seen 2026-10-14) - security page: (seen 2026-10-14) - privacy policy: (seen 2026-10-14) - terms of service: (seen 2026-10-14) - security.txt: (seen 2026-10-14) - JavaScript SDK repository, issues and CI: (seen 2026-10-14) - npm package: (seen 2026-10-14) - PyPI package: (seen 2026-10-14) - official MCP registry search: (seen 2026-10-14) ## Who's behind it (provenance 92/100, checked 2026-10-14) | Check | Finding | Points | | --- | --- | --- | | Legal entity named | You Need A Budget LLC | 20/20 | | Domain age | ynab.com, registered 2001-11-24 (24 years) | 15/15 | | Endpoint on the vendor's domain | api.ynab.com | 15/15 | | Terms of service | read, states 5 of the 7 things a reader expects, and has 3 clauses that cost points | 2.3/10 | | Privacy policy | read, states 8 of the 8 things a reader expects | 10/10 | | Status page | ynabstatus.com | 10/10 | | Changelog | published | 10/10 | | security.txt | valid | 10/10 | The terms (last modified 9 April 2026) and the privacy policy (effective 20 April 2026) name You Need A Budget LLC d/b/a YNAB, governed by Utah law, with You Need A Budget UK Ltd of Cheltenham for UK and EEA open banking. API Terms of Service sit on api.ynab.com under Legal and work with the general terms and privacy policy. security.txt at api.ynab.com/.well-known/security.txt names Bugcrowd and security@ynab.com but has no Expires line, which RFC 9116 requires. www.ynab.com/.well-known/security.txt returned 404. RDAP at Verisign gives a registration date of 2001-11-24 for ynab.com. The status page at ynabstatus.com is a Statuspage site with a Public API component. ### Terms and privacy, as read A reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice. **Terms of service** (https://www.ynab.com/terms/), read 2026-10-14, dated 2026-04-09, states 5 of the 7 things a reader expects. - To know. Restricts automated access (costs points). "Use any robot, bot, spider, scraper, offline reader or other automatic device, process or means to access the Services for any purpose, including monitoring or copying any of the material on the Services." - To know. Restricts benchmarking or competitive use (costs points). "You shall not use our Services for competitive purposes, and our Services shall not be used by any of YNAB’s competitors or anyone affiliated with YNAB’s competitors." - To know. Says the terms or the service can change without notice (costs points). "We reserve the right to withdraw or amend our Services, and any service or material we provide, in our sole discretion without notice." - To know. Says access can be ended without notice or for any reason. "We retain the right to: (1) take appropriate legal action for any illegal or unauthorized use of the Services and (2) terminate or suspend your access to all or part of the Services for any or no reason, including, without limitation, any violation of these Terms of Service." - To know. Requires arbitration or waives class actions. "Agreement to Arbitrate: Any legal suit, action, or proceeding arising out of, or related to, these Terms of Service or the Services shall be resolved exclusively through final and binding arbitration, rather than in court, except as set forth below." - Gives the date it was last updated. Last updated 2026-04-09. - Names the governing law or courts. The law of the State of Utah. - Not found in the text. States a limit on its liability. - Says how changes to the terms are announced. Changes are posted, with no other notice named. - Not found in the text. Refers to a service level or uptime commitment. - Also in the text (2026-10-14). Use is limited to personal, household or small business purposes, and a small business means one with 50 or fewer employees. "A small business shall mean a business that has 50 or fewer employees." - Also in the text (2026-10-14). Any program that uses the YNAB API must show a warning that it is unsupported and require the user to acknowledge it before working. "(a “OAuth App”) does so at the risk of its users and developers, and must display the following message at least once, and require the user to acknowledge before the application will function:" - Also in the text (2026-10-14). Subscriptions renew automatically at the end of each billing period at the then-current rate unless cancelled. "Your subscription will automatically renew at the end of each billing period unless you cancel before the renewal date." **Privacy policy** (https://www.ynab.com/privacy-policy/), read 2026-10-14, dated 2026-04-09, states 8 of the 8 things a reader expects. - To know. Says it sells personal data or shares it for advertising. "Nevertheless, our online advertising activities targeting prospective YNAB users may be considered to be a “sale” and/or “sharing/processing” for targeted advertising purposes under the broad definitions of those terms in state privacy laws." - Gives the date it was last updated. Last updated 2026-04-09. - Says how long data is kept. Names a period of 21 days. - Gives a privacy contact. privacy@ynab.com. - Says where data is transferred or stored. Relies on standard contractual clauses. - Also in the text (2026-10-14). YNAB may offer applications on third-party AI assistant platforms and receives the prompts users submit to them. "We may make YNAB content and tools available through applications on third-party platforms, such as AI assistants or chatbots." ## Live (updated 2026-10-14 09:42 UTC) - Right now: up, HTTP 200, 317 ms, checked 2026-10-14 09:42 UTC (get on `https://api.ynab.com/v1`) - Uptime 24h 100.0% (17 probes) · 30 days 100.0% (17 probes) · p50 320 ms · p95 379 ms - Vendor status page: none, All Systems Operational - Always current: https://www.anchorterminal.com/api/v1/live/ynab.json ## Probe metrics Not measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score. ## Prices | Item | Price | Unit | Note | | --- | --- | --- | --- | | YNAB subscription, monthly | $14.99 | per month (plan) | API included | | YNAB subscription, annual | $9.08 | per month (plan) | billed $109 a year, API included | Across all listings: https://www.anchorterminal.com/prices/index.md ## Strengths - Public OpenAPI 3.1.1 file at api.ynab.com/papi/open_api_spec.yaml, version 1.87.0, with 44 operations - OAuth authorisation code grant with PKCE, refresh tokens and a read-only scope that returns 403 on writes - Delta requests with last_knowledge_of_server on nine resources return only what changed - Dated API changelog with 21 versions since February 2024, the latest on 17 September 2026 - Official SDKs for JavaScript, Python and Ruby under Apache-2.0, with CI passing on the JavaScript SDK ## Weaknesses - Each access token is limited to 200 requests an hour in a rolling window, and 429 responses carry no Retry-After - Personal access tokens don't expire and can't be limited to reading - No list pagination, so a full transaction list depends on date filters and delta requests - Getting access needs a person to sign up and create a token or OAuth app in the web app - No llms.txt or Markdown version of the API docs; the site's llms.txt is a product description ## Before you call it (notes for agents) 1. Use last-used in place of plan_id until you have listed plans with GET /v1/plans 2. Store server_knowledge and send it back as last_knowledge_of_server to stay inside 200 requests an hour 3. Read and write amounts in milliunits, or read the _currency fields added in v1.82.0 4. Set import_id on transactions you create so a retried POST is matched instead of duplicated 5. Request scope=read-only on OAuth when the task only reads the budget ## Connect Install: ```bash npm install ynab ``` First request: ```bash curl -H "Authorization: Bearer " https://api.ynab.com/v1/plans ``` Through letme (picks today, calling later): https://letme.dev/ynab (letme picks it for finance.budgets, the top-graded tool for the job, letme picks it for finance.transactions, the top-graded tool for the job). letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md ## Similar tools Ranked by shared capabilities, then score. Same-category tools with no shared capability key are listed last. | Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown | | --- | --- | --- | --- | --- | --- | --- | | Snoop | F | 26.7 | 1027 | finance.budgets, finance.transactions | no | https://www.anchorterminal.com/tools/snoop.md | | Quicken Simplifi | F | 20.7 | 1037 | finance.budgets, finance.transactions | no | https://www.anchorterminal.com/tools/quicken-simplifi.md | | Emma | F | 17.4 | 1044 | finance.budgets, finance.transactions | no | https://www.anchorterminal.com/tools/emma.md | | Rocket Money | F | 17 | 1046 | finance.budgets, finance.transactions | no | https://www.anchorterminal.com/tools/rocket-money.md | | Copilot Money | F | 16.3 | 1049 | finance.budgets, finance.transactions | no | https://www.anchorterminal.com/tools/copilot-money.md | | PocketGuard | F | 14.6 | 1053 | finance.budgets, finance.transactions | no | https://www.anchorterminal.com/tools/pocketguard.md | ## Panel reviews (0) Reviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): . Desk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md ## Notable - OpenAPI 3.1.1 file, version 1.87.0, with 44 operations (28 GET, 7 POST, 5 PATCH, 2 PUT, 2 DELETE) across user, plans, accounts, categories, payees, months, money movements, transactions and scheduled transactions (source: ) - v1.79.0 on 5 March 2026 renamed budgets to plans in every path and response key. The old /budgets paths still work with the old key names but are no longer documented (source: ) - Rate limit of 200 requests an hour per access token in a rolling window; v1.73.0 on 29 January 2025 removed the X-Rate-Limit header from 429 responses (source: ) - Transactions listings default since_date to one year ago since v1.85.0 on 27 May 2026, so older history needs an explicit since_date (source: ) - No official MCP server. The docs list community MCP servers such as avenir-mcp under Works with YNAB third party, which YNAB says it doesn't support; the official MCP registry has only community entries (source: ) - Bank connections come from Plaid and MX, and TrueLayer for Europe per the status page. The API can trigger an import with POST /plans/{plan_id}/transactions/import but never sees bank credentials (source: ) - The API terms forbid requesting or storing users' bank credentials and require OAuth apps to state they are not affiliated with YNAB. The general terms forbid any robot, bot, spider or scraper to access the services, outside the API (source: ) - #1 of 10 in Best subscription, bill and budgeting tools for AI agents: https://www.anchorterminal.com/best/personal-finance/index.md - All 43 personal finance comparisons: https://www.anchorterminal.com/compare/personal-finance/index.md ## Compare - [Copilot Money vs YNAB](https://www.anchorterminal.com/compare/copilot-money-vs-ynab.md): F 16.3 vs B 65.1 - [Emma vs YNAB](https://www.anchorterminal.com/compare/emma-vs-ynab.md): F 17.4 vs B 65.1 - [Hiatus vs YNAB](https://www.anchorterminal.com/compare/hiatus-vs-ynab.md): F 14.3 vs B 65.1 - [PocketGuard vs YNAB](https://www.anchorterminal.com/compare/pocketguard-vs-ynab.md): F 14.6 vs B 65.1 - [Quicken Simplifi vs YNAB](https://www.anchorterminal.com/compare/quicken-simplifi-vs-ynab.md): F 20.7 vs B 65.1 - [Rocket Money vs YNAB](https://www.anchorterminal.com/compare/rocket-money-vs-ynab.md): F 17 vs B 65.1 - [Snoop vs YNAB](https://www.anchorterminal.com/compare/snoop-vs-ynab.md): F 26.7 vs B 65.1 - [Plum vs YNAB](https://www.anchorterminal.com/compare/plum-vs-ynab.md): F 27.4 vs B 65.1 ## Verify this listing For the vendor. The badge or a plain link to this page verifies the listing, from a page on ynab.com or one of its subdomains, or the README of github.com/ynab/ynab-sdk-js. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{"slug": "ynab", "url": "…"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify HTML badge: ```html YNAB on Anchor Terminal ``` Markdown badge, for a README: ```markdown [![YNAB on Anchor Terminal](https://www.anchorterminal.com/badges/ynab.svg)](https://www.anchorterminal.com/tools/ynab) ``` Plain link: ```html YNAB on Anchor Terminal ``` ## Share this listing For the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say YNAB is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score. - Dark: https://www.anchorterminal.com/assets/share/ynab-dark.png - Light: https://www.anchorterminal.com/assets/share/ynab-light.png - Create a video and download its frames: https://www.anchorterminal.com/assets/listing-video/index.html?listing=ynab