QuickBooks

Twin of the QuickBooks Online Accounting API.


Covers	`sandbox-quickbooks.api.intuit.com`, `oauth.platform.intuit.com`, `appcenter.intuit.com`, `developer.api.intuit.com`
Auth	Intuit OAuth 2.0 bearer, Basic on the token endpoints
Webhooks	Yes
Operations	70

Coverage

Customers, vendors, items, accounts and preferences; estimates, invoices, credit memos, payments, sales receipts and refunds; purchase orders, bills and vendor credits; journal entries, deposits and transfers; plus query, batch, reports, change data capture and signed webhooks. Card processing is out of scope. Intuit spreads one integration across four hosts, one each for consent, token exchange, revocation and the API itself, and all four are served here.

minorversion is accepted and ignored. 75, 1, 76, a non-integer and no value at all return byte-identical data, so you cannot use it to pin a dialect.

Credentials

Accounting routes take Authorization: Bearer. Only tokens the twin minted work, so run your own connect flow against it or read a seeded token from /veris/data. See Credentials. The token and revoke endpoints instead take HTTP Basic with your client id and secret, the way Intuit’s do.

The realmId in the path is not a credential but a binding. If it does not match the company the token was issued for, you get a 401 with fault code 120.

Vendor specific details

The Accept header decides the format, and the default is XML. You get JSON only if application/json appears in it, so a client that omits the header gets XML and a JSON parser failure.
Errors arrive with HTTP 200. A /query with no query, a /cdc missing its parameters and a bad report date all answer 200 with a Fault body, and so do failed items inside a batch.
There is no PUT. POST /entity carrying an Id is the update, it needs the record’s current SyncToken or you get a 400 5010 stale object error, and it overwrites the whole record unless you send "sparse": true. Any writable field you leave out of a non-sparse update is cleared.
The query language is a narrow subset. No OR, only SELECT *, SELECT count(*) or SELECT Id, clauses only in WHERE, ORDERBY, STARTPOSITION, MAXRESULTS order, and POST /query takes a text body, never JSON.

Its own notes

Once a sandbox is running, this twin serves its own operating notes at {control_url}/veris/manual: the credentials it accepts, the API versions it serves, and the fault statuses you can arm against it. They are generated from the same source as its behaviour, so they cannot drift.