QuickBooks documents its own worst behaviour. Read that part first.
QuickBooks Online allows 500 requests a minute per company, batches of 30, and webhooks verified by HMAC. It also silently overwrites read-only fields with no error, blocks webhook delivery behind an unacknowledged event, and offers a query language with no OR and no joins. All of that is in Intuit’s own documentation.
What QuickBooks Online publishes about its API
Documentation
Yes — developer.intuit.com, plus a separate knowledge base at help.developer.intuit.com Intuit developer, fetched 1 September 2026.
Authentication
OAuth 2.0 authorisation code grant. Tokens are scoped to a realmId, which is the company. Send the authorisation code exactly once — Intuit warns that multiple exchange requests may invalidate the tokens. Intuit OAuth 2.0, fetched 1 September 2026.
Token lifetimes
Access tokens are valid for 60 minutes. Refresh tokens have a rolling 100-day expiry and a five-year hard expiry. Always store the newest refresh token from the most recent response. Intuit OAuth 2.0, fetched 1 September 2026.
Rate limits
500 requests per minute per realm, 10 concurrent requests per second per realm and app, and 40 batch requests per minute per realm. Intuit API call limits, fetched 1 September 2026.
When you exceed one
HTTP 429. Worth knowing that 429 does not appear in Intuit’s own HTTP status code reference, and no Retry-After or rate-limit header is documented. Intuit error codes, fetched 1 September 2026.
Pagination
Offset-based, inside the query language: STARTPOSITION and MAXRESULTS. Default 100 rows, maximum 1,000. SELECT COUNT(*) sizes the loop first. Intuit data queries, fetched 1 September 2026.
Webhooks
Yes, delivered as CloudEvents-style notifications. Production and sandbox are configured separately. Intuit webhooks, fetched 1 September 2026.
Event verification
HMAC-SHA256 of the raw payload keyed with your verifier token, base64 encoded, compared to the intuit-signature header. Intuit webhooks, fetched 1 September 2026.
Retry behaviour
Respond 200 within 3 seconds. Retries run at 10s, 20s, 30s, 5m, 20m, 2h, 4h, 6h and then every 6 hours. Until you acknowledge one event you may receive none of the later ones. Intuit webhook best practices, fetched 1 September 2026.
Bulk operations
30 payloads per batch request, 40 batch requests per minute per realm. Execution order is not guaranteed and items cannot depend on each other — a customer created in a batch is not available to an invoice in the same batch. Intuit batch, fetched 1 September 2026.
Test environment
Up to 10 sandbox companies, valid and active for two years, created automatically with a developer profile. Region is fixed at creation and cannot be changed. Intuit sandboxes, fetched 1 September 2026.
Data location
QuickBooks Online does not publish where the data is stored.
Cost of API access
No separate charge for API access is published.
Every line above is QuickBooks Online’s own documentation, fetched 1 September 2026, linked so you can check it yourself. 2 of the 13 fields are not published at all — those are marked, and they are the ones that cost you time. The full capability register puts this beside the other eight.
What the QuickBooks Online API does and does not allow
Intuit’s ledger. Smaller share of the Australian trade market than Xero or MYOB, and the best-documented of the three.
Everything in the strip above is QuickBooks Online’s own published documentation, fetched 1 September 2026 and linked to the page it came from. We have not paraphrased it into something friendlier, because the exact wording is what you need when a limit bites at four in the afternoon.
What follows is what those facts mean for a build — the constraints that change a design decision rather than the ones that are merely true. If you want the same treatment for the other eight systems side by side, that is the capability register. If you want to know whether we have built against both sides of a particular pairing, the integration checker answers that specific question.
The silent overwrite, and why it belongs at the top of this page
Intuit’s documentation contains a sentence that should be printed and pinned above every QuickBooks integration: any value supplied in a read-only attribute is transient and will be overwritten by QuickBooks data services, and no error is returned.
Read that again as an operator rather than a developer. Your automation posts a record. The API returns success. Some of the fields you sent are not there. Nothing anywhere says so. You find out weeks later when a report does not reconcile, and the first four places you look are all in your own code.
The defensive pattern is simple and non-negotiable: read back what you wrote, compare it to what you sent, and alert on the difference. It costs an extra call against a 500-a-minute budget, which is cheap. We do this on every QuickBooks write path, and we would tell you to do it even if you built it yourself.
Reporting, and the query language that will not do it
QuickBooks has a SQL-like query language that looks familiar enough to be misleading. There is no OR in a WHERE clause. There are no joins. There is no GROUP BY, no projection, no expression evaluation, and the ID field supports only equals and IN — not greater-than, not LIKE.
So anything that looks like a report is assembled on your side out of several queries, capped at 1,000 rows each with a 100-row default. That is a design constraint with a cost, and it is the honest reason a "simple dashboard on top of QuickBooks" is rarely simple.
Where QuickBooks is genuinely strong is change tracking. The ChangeDataCapture endpoint gives you a real delta pull with a 30-day look-back, which is the documented recovery path when webhooks have been down. Thirty days is your outage budget — longer than that and you are doing a full re-sync. Worth knowing before you promise anyone an uptime figure.
Idempotency is built inA requestid on every call and QuickBooks returns the original response instead of doing it twice. Intuit strongly recommends it and so do we — though how long a key is honoured is not published.
Batch is 30 and unorderedItems cannot depend on each other. A customer created in a batch is not available to an invoice in the same batch, so writes come in dependency waves.
Closed periods reject writesError 6200. Any backdated automation needs a rule for what happens when the bookkeeper has already locked the month.
Rate limits and what breaks at scale
Five hundred requests a minute per company, ten concurrent per second, forty batch requests a minute. Those are generous numbers by the standards of this register — roughly eight times Xero’s per-minute allowance — and they are rarely the binding constraint.
The binding constraint is the webhook queue. Intuit documents that you may not receive subsequent events until you correctly acknowledge the first one, and that your endpoint must respond 200 within three seconds. That is not a queue that drains around a failure; it is a queue that stops. One slow deploy, one endpoint hiccup, and you are not behind — you are stopped, and you stay stopped until you catch up.
It is also worth knowing that 429 does not appear in Intuit’s own HTTP status code reference even though the throttling article says it is returned, and that the enforcement of the concurrent and batch limits was switched on, off, and on again across 2024. Design as though the documented limits are real, because as of November 2024 they are.
What QuickBooks Online’s documentation supports — and the caveat on each. Source: QuickBooks Online developer documentation, fetched 1 September 2026.
QuickBooks Online
Read records on demand
●Yes500 a minute per company. 1,000 rows maximum per query, 100 by default.
Write records in
◐PartlyWrites succeed, but read-only fields are silently overwritten with no error returned. Read back and compare.
Know the moment something changes
◐PartlyWebhooks exist, but delivery blocks behind any unacknowledged event and you have 3 seconds to respond.
Verify an event came from them
●YesHMAC-SHA256 of the raw payload against your verifier token, in intuit-signature.
Recover after an outage
◐PartlyChangeDataCapture looks back 30 days, 1,000 objects per request. Longer than that is a full re-sync.
Bulk load history
◐Partly30 payloads per batch, 40 batches a minute, unordered, and items cannot depend on each other.
Keep data in Australia
–Not assessedIntuit does not publish data location in the developer documentation.
What QuickBooks Online does not publish
2 of the thirteen fields we track are simply absent from QuickBooks Online’s documentation: where your client’s data physically sits and whether API access itself costs anything.
This is the part of an integration page that competitors leave out, and it is the part that costs money. An undocumented rate limit is not an academic gap — it means the first time you find the ceiling is in production, on someone else’s business, usually on the busiest day of their month.
We are not going to fill these in with figures from a forum thread. Numbers circulate for most of them, and some are probably right, but we cannot show you where they came from and neither can the person who posted them. When we have measured QuickBooks Online properly under load, those figures will appear here with the date we measured them and the conditions we measured them under. Not before.
What we have built, and what we have not measured
We have implemented against QuickBooks Online in production. That is a real fact and it is also a limited one — it tells you we have solved this system's problems before, and it does not tell you how fast, how reliably, or at what volume.
The honest position is this. Everything on this page above the line is the vendor's published documentation, which we fetched, dated and linked rather than paraphrased. Nothing on this page is a Kindra measurement, because our measured register is not finished and publishing half of it dressed up as all of it would make this page less useful, not more.
What we would do on an engagement is measure the specific things that matter for your build — the endpoints you depend on, at your volume, with your data — and hand you those numbers whether or not they suit us. If they say the integration is harder than we quoted, you get told that too. Start with a Leak Check, or read how we work first if you would rather know the shape of it before talking to anyone.
Objections
Isn’t QuickBooks Online enough on its own?
Very often, yes — and if it is, we will say so and there is no engagement. QuickBooks Online is a mature product that solves the problem it was built for. Integration work is only worth paying for when the cost sits between systems: the same information being typed into QuickBooks Online and then into something else, or a decision waiting because two systems disagree. If everything you need lives inside QuickBooks Online, buy the plan that fits and spend the money elsewhere.
What happens when they change their API?
They will. Three of the nine systems in our register shipped a breaking or cost-changing update in the last twelve months. What matters is not preventing that — nobody can — but whether the integration was built so the change is a contained fix rather than a rebuild, and whether anyone is watching for the deprecation notice. You own the code either way, so you are never stuck with us to get it fixed.
Book a free Leak Check
20 minutes. We find where the money's going. No pitch.