Before you design an integration, check this list. Each line names something the REST API does not do today, and links to the page that explains it or shows the way around it.
Changes and sync
- No webhooks. plnnrly does not push changes. Poll instead: Keeping a copy in sync.
- Permanent deletes leave no trace. Only archived records can be followed through
updated_at. Find permanent deletes with an id scan: Keeping a copy in sync. - No sandbox organisation. Every call works on real data. Start with a read-only token, then try writes with a narrower token on a test project: Getting started.
Writing
- No bulk endpoints. No operation takes a list of records: each
POSTcreates one record or runs one action, and eachPATCHorDELETEchanges one record. Send one request per record, eachPOSTwith its ownIdempotency-Key: Idempotency. - No PUT. Change a record with
PATCH, sending only the fields you change: Errors and retries. - Attachments and Drive files cannot be changed or deleted through the API once they are registered. Their collections only have
GETandPOST: Files: upload and download. - Uploads need a personal access token. An app that signs in with OAuth cannot upload, and neither can an MCP client: Files: upload and download.
Reading
- Includes are documented on collection reads only. For the related records of one record, read the related collection: Views and includes.
- No nested includes and no sparse fieldsets. An include is one level deep, and you choose fields with
view=summaryorview=detail: Views and includes. - Users are read-only, and roles, permissions and teams are not exposed. Manage people in plnnrly itself: How the data fits together.
- No currency field. Amounts are decimal strings without a currency: Data formats.
- Error messages are always in English, whatever language your organisation uses: Errors and retries.
Signing in
- An app that signs in with OAuth cannot delete anything through the REST API. No OAuth scope covers deletes, so deleting needs a personal access token: Sign in with OAuth.
- No OAuth for web apps on their own domain. OAuth sign-in accepts only loopback redirect addresses and a few known AI clients, so a web app cannot use its own
httpscallback: Sign in with OAuth. - No calls from a browser on another site. The API only allows browser requests from the plnnrly docs site. Call it from your own server instead: Authentication.
Versions and tools
- The document version is not a release marker yet.
info.versionin/openapi.jsondoes not change with each release. Follow the changelog instead: Headers and versioning. - No official SDK. Generate a client from
/openapi.json: Generating a client.