Where the reviewed products stand
Compare documented control across the named products and routes. Open a review for its plan, region and agreement (this is a selected sample).
0–10 on both axes · Higher and further right means more documented control
Exact scores & review links (10)
| Vendor | Data access & portability | Build & act |
|---|---|---|
| QuickBooks Online ↗ | 7.5* | 5.4* |
| Xero ↗ | 8.3* | 6.0* |
| BILL ↗ | 6.7* | 4.7* |
| Sage Intacct ↗ | 5.6* | 6.1* |
| Campfire ↗ | 7.7* | 4.7* |
| QuickBooks Desktop ↗ | 8.2* | 4.6* |
| Zoho Books ↗ | 4.7* | 5.4* |
| FreshBooks ↗ | 7.6* | 5.6* |
| Wave ↗ | 4.7* | 2.2* |
| Permute ↗Publisher self-assessment | 8.0* | 7.1* |
Axes average three dimensions each: access, third-party access and exit horizontally; action, continuity and business logic vertically. Fixed 0–10 scale, midlines at 5 (overall grades use separate weights). * Some evidence is unresolved. Marker colors identify companies, not score bands. How to read the map ↗
Permute is included as a reference (it owns this site and is a publisher self-assessment). Its score is excluded from sample averages. Read the Permute review ↗
Reviews cover declared accounting objects and reports; a record export does not establish a complete ledger or configuration restore.
Compare the six dimensions
| Overall control | |
|---|---|
| Data access | |
| Third-party accessibility | |
| External action | |
| Continuity | |
| Data exit | |
| Business logic and customization | |
Product scopes, dates & reviews
QuickBooks Online
Accounting · Checked 2026-10-12
QuickBooks Online Accounting API / US Builder developer tier and an authorized customer company. Desktop, Payments and premium endpoints have separate contracts.
Read findings and sources ↗Xero
Accounting · Checked 2026-10-12
Xero Accounting API / unlisted Starter developer app for at most five customer-authorized organizations. Journals, certified distribution and Custom Connections are separate routes.
Read findings and sources ↗| Customer control | QuickBooks Online ↗ | Xero ↗ | BILL ↗ | Sage Intacct ↗ | Campfire ↗ | QuickBooks Desktop ↗ | Zoho Books ↗ | FreshBooks ↗ | Wave ↗ | Permute ↗ |
|---|---|---|---|---|---|---|---|---|---|---|
| Category | Accounting | Accounting | Accounting | Accounting | Accounting | Accounting | Accounting | Accounting | Accounting | Databases and data platforms |
| Overall control | ||||||||||
| Data access | ||||||||||
| Third-party accessibility | ||||||||||
| External action | ||||||||||
| Continuity | ||||||||||
| Data exit | ||||||||||
| Business logic and customization | ||||||||||
| Assessment scope | QuickBooks Online Accounting API / US Builder developer tier and an authorized customer company. Desktop, Payments and premium endpoints have separate contracts. | Xero Accounting API / unlisted Starter developer app for at most five customer-authorized organizations. Journals, certified distribution and Custom Connections are separate routes. | BILL / registered v3 AP/AR integrated application with developer key and organization session. Spend & Expense and ERP sync tokens have different authority. | Sage Intacct / licensed XML Web Services plus separately subscribed Platform Services customization. REST entitlements are not inferred from the XML route. | Campfire / customer API users, accounting collections and webhook event listing. Admin, clerk and view-only keys grant different write authority. | QuickBooks Desktop for Windows / customer-authorized SDK/Web Connector, qbXML query collections and local event subscriptions. Events differ between attended and unattended operation. | Zoho Books API v3 / OAuth-authorized organization invoices and automation webhooks; regional domains and organization grants remain explicit. | FreshBooks accounting REST / customer-authorized OAuth, invoices and webhook callbacks; Classic XML API and service-wide backup are excluded. | Wave accounting GraphQL public API / OAuth-authorized business invoices and customer creation; Wave mobile-money APIs are unrelated and excluded. | Permute hosted workspaces / scoped REST and TypeScript SDK access to connected query sources, file datasets, managed database records, operation code and custom apps. Signed enterprise contracts and upstream vendor rights remain separate; no live tenant migration or reliability test was performed. |
| Assessment checked | 2026-10-12 | 2026-10-12 | 2026-10-12 | 2026-10-12 | 2026-10-12 | 2026-10-12 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-12 |
| Read the findings | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ |
Scores are out of 10. * Incomplete evidence discounts verified capabilities (unknown answers stay unknown). Planned migration drives data exit. Scoring method ↗
Who can connect?
Yes No- Unknown
A check means the column applies to that route (customer credentials can still require provider approval). Report exports use the customer account without separate API credentials. Open a connection method for its authentication, requirements and last review date.
What each review covers
QuickBooks Online ↗
The Accounting API supports customer-authorized reads and writes, but production access, developer-workspace allowances and company-level throttles are separate gates.
QuickBooks Online Accounting API / US Builder developer tier and an authorized customer company. Desktop, Payments and premium endpoints have separate contracts.
Xero ↗
Xero has a no-charge entry developer tier, but connection count, daily limits and premium accounting data determine how far an integration can go.
Xero Accounting API / unlisted Starter developer app for at most five customer-authorized organizations. Journals, certified distribution and Custom Connections are separate routes.
BILL ↗
BILL separates organization sessions, sync tokens and partner keys. Its current developer agreement explicitly limits AI processing and application distribution.
BILL / registered v3 AP/AR integrated application with developer key and organization session. Spend & Expense and ERP sync tokens have different authority.
Sage Intacct ↗
Intacct has expressive operational queries and custom objects, but API access requires a developer license and customer subscriptions.
Sage Intacct / licensed XML Web Services plus separately subscribed Platform Services customization. REST entitlements are not inferred from the XML route.
Campfire ↗
Campfire lets customers create role-bound API users. Default history windows need attention when extracting accounting records.
Campfire / customer API users, accounting collections and webhook event listing. Admin, clerk and view-only keys grant different write authority.
QuickBooks Desktop ↗
QuickBooks Desktop connects through a local Windows bridge. Modified-time queries and deletion records help synchronization, but unattended event support is limited.
QuickBooks Desktop for Windows / customer-authorized SDK/Web Connector, qbXML query collections and local event subscriptions. Events differ between attended and unattended operation.
Zoho Books ↗
Zoho Books exposes organization-scoped invoices with read and write operations. Its API includes automation webhooks, while complete deletion history and replay remain unverified.
Zoho Books API v3 / OAuth-authorized organization invoices and automation webhooks; regional domains and organization grants remain explicit.
FreshBooks ↗
FreshBooks uses customer-authorized OAuth with rotating single-use refresh tokens. Invoice APIs and callbacks support external copies, but failures can disable webhook delivery.
FreshBooks accounting REST / customer-authorized OAuth, invoices and webhook callbacks; Classic XML API and service-wide backup are excluded.
Wave ↗
Wave’s accounting API returns business invoices through GraphQL and supports customer creation. Public examples establish selected accounting records, not a complete transaction-ledger export.
Wave accounting GraphQL public API / OAuth-authorized business invoices and customer creation; Wave mobile-money APIs are unrelated and excluded.
Permute ↗
Scoped APIs expose SQL reads, managed records and customer-authored operation code. Customer-built apps are supported, while complete workspace recovery, outbound CDC and minimum-plan access terms remain unresolved.
Permute hosted workspaces / scoped REST and TypeScript SDK access to connected query sources, file datasets, managed database records, operation code and custom apps. Signed enterprise contracts and upstream vendor rights remain separate; no live tenant migration or reliability test was performed.