quickbooks v1.0.0

The pack names a reference, never a secret. Installing a pack registers capabilities and makes them governable; registration is not connectivity. The credential is created at the provider and held in the client's own secret manager under the reference the pack names, and deployment testing is still required to show the credential path works and cannot be bypassed.

Reference

secret-ref-quickbooks-access-token

Custody

customer_vault

Injection

header (Authorization)

An OAuth2 access token for the QuickBooks Online Accounting API, held in the client's own secret manager under this reference. Intuit issues tokens through the OAuth2 authorization-code flow against the client's own developer app, and access tokens are short-lived (Intuit's SDK carries the access token and the refresh token as separate configuration): the refresh token and the app's client credentials stay with an external token process, which performs the refresh and stores the FRESH access token under this reference — the executor and the agent never see the refresh token, and this pack does not store one. The stored material must be the complete Authorization header value (scheme included: 'Bearer <access-token>'). Choose the least-privilege scope at Intuit that covers these endpoints (the accounting scope); if the connection is revoked or the refresh token lapses, the external process must re-authorize before this reference serves again. At execution time the resolved bearer material exists in the executor process's memory for the moment of injection only — the deployment owns the executor's memory, log and crash hygiene; the agent never receives it.

• quickbooks-company (api, financial): https://quickbooks.api.intuit.com/v3/company/REALM_ID

REALM_ID, CUSTOMER_ID, VENDOR_ID, INVOICE_ID and PAYMENT_ID are placeholders to replace before enabling. REALM_ID is Intuit's company id and scopes every path under /v3/company. The registered host is the production API host quickbooks.api.intuit.com; Intuit documents the sandbox host sandbox-quickbooks.api.intuit.com as the alternative base URL, and substituting it — with the egress allowlist kept in step — is a supported review outcome for a sandbox deployment. Every read registered here is a RECORD read on the entity's own path with its Id (the operation Intuit's SDK exposes as FindById); the reads are not collection reads. The collection surface is the query endpoint (GET /v3/company/{realmId}/query with a SQL-like select statement), and this pack does not register it: an open query endpoint would read any entity the credential can reach, which is a broader permission than the per-entity record reads a reviewer can see here. This pack also does not register the batch endpoint, change data capture (/cdc), reports, PDF download, or any update, delete or void operation. Invoice creation is NOT registered: the invoice write surface is a single shared POST to /v3/company/{realmId}/invoice, and Intuit's official QuickBooks V3 PHP SDK implements update as POST .../invoice?operation=update, delete as POST .../invoice?operation=delete and void as POST .../invoice?operation=void on that same path — with caller-controlled query and body values, registering 'create' on this route cannot be separated from update, void and delete (delete is irreversible at the R3 floor), and this pack registers no mechanism that restricts the query string or body. Invoice creation returns only when a demonstrable deployment-level restriction confines the route to creation, or as a capability that honestly declares every reachable effect at its floor. This pack does not register the invoice send operation (Intuit supports emailing an invoice; a send cannot be unsent and would carry the send action at R3) and does not register payment creation — and note what a payment is here: a QuickBooks Accounting API Payment entity records a payment received against invoices in the ledger, a bookkeeping record, not an instruction that moves funds; actual money movement happens through the business's bank and payment rails outside this API. Recording such a payment is still a financial write this pack leaves out. The developer.intuit.com entity reference pages require a JavaScript browser to render; this review verified the exact HTTP routes — the per-entity FindById GETs, the companyinfo route GET /v3/company/{realmId}/companyinfo/{realmId}, and the shared POST operation variants above — against the route construction in Intuit's official QuickBooks Online V3 PHP SDK source instead. AAES has not been certified by Intuit; the endpoints here are a reviewable default, not a vendor guarantee.

Draft review record dated 2026-09-21 · Reviewer: aaes-eng (an opaque id that resolves internally to the responsible reviewer)

• https://raw.githubusercontent.com/intuit/QuickBooks-V3-PHP-SDK/master/docs/_sources/quickstart.rst.txt (retrieved 2026-09-21)
• https://raw.githubusercontent.com/intuit/QuickBooks-V3-PHP-SDK/master/docs/_sources/configuration.rst.txt (retrieved 2026-09-21)
• https://raw.githubusercontent.com/intuit/QuickBooks-V3-PHP-SDK/master/src/DataService/DataService.php (retrieved 2026-09-21)
• https://raw.githubusercontent.com/intuit/QuickBooks-V3-PHP-SDK/master/src/Core/CoreConstants.php (retrieved 2026-09-21)

A pack review is not a vendor or examiner attestation. A retrieval date says when a source page was read; it does not by itself establish what the page said then. No pack is vendor-endorsed, and none has been connectivity-tested against a live vendor tenant.