Developers
The API comes with your plan, with an MCP endpoint for your own AI.
Create a key for your company in Financial IQ, choose what it can touch, and point your code or your AI at it. Sending anything to a customer goes through an approval.
Included in Business Pro and Autopilot.
What it costs: nothing on top of your plan.
Keys, the MCP endpoint and webhooks are part of Business Pro and Autopilot.
Business Pro
£19 a month plus VAT
Business API, MCP endpoint and webhooks included.
Autopilot
£99 a month plus VAT
Everything in Business Pro, API included.
Personal API
Included for the person paying for a business plan
On Personal on its own, £4.99 a month.
Xero charges £5 a month plus VAT per custom connection (developer.xero.com/custom-development). The Financial IQ API is included in Business Pro and Autopilot.
Sending an invoice takes four calls, and one of them is an approval.
Your code or your agent can prepare all the work. A customer hears nothing until an approval request has been approved and a separate call delivers it. Issuing an invoice is its own call: it posts to your ledger, VAT and stock, and needs only the invoices permission.
- 1DraftPOST …/invoicesCreates a draft invoice. Nothing is posted.
- 2Request to sendPOST …/invoices/{id}/sendCreates an approval request. No email goes out.
- 3ApprovePOST …/approval-requests/{id}/approveA person approves it, or a key assigned as the approver.
- 4DeliverPOST …/invoices/{id}/send/executeSends it, only once the approval request is approved.
Keep approval_workflow off an agent’s keyRequesting a send and delivering it both need the approval_workflow permission. A key without it can draft and issue, and can’t reach a customer. Don’t give approval_workflow to an agent’s key.
Filing needs a signed-in personVAT, Corporation Tax, Companies House and payroll submissions are handed to a signed-in person to finish. No permission allows payments or live filing.
What you can reach
Business routes take a company key. Personal routes take a person’s own token. The guide also lists what sits outside v1 today.
Sales
- Customers
- Invoices, quotes and credit notes
- Payments and payment links
Purchases
- Suppliers
- Purchase invoices and purchase orders
- Supplier payment runs
- Expense claims
Banking
- Bank accounts
- Statement lines
- Reconciliations
Ledger
- Chart of accounts
- Journals and fixed assets
- Projects, funds and cost centres
- Accounting periods
Reports
- Summary, profit and loss, trial balance
- Balance sheet, cash flow, general ledger
- Aged debtors and creditors
- Cashflow forecasting
People and company
- Payroll, CIS and P11D (read)
- Directors and shareholders
- Share classes and dividends
Records and control
- Documents
- Approval requests
- Audit logs and evidence bundles
Personal
- Summary and position
- Net worth, cash flow, budget and goal reports
- Accounts, assets and liabilities
- Budgets, categories, goals and transactions
Built for agents
Claude Code and other MCP clients that let you set a header connect with your key. Claude.ai and ChatGPT connect to Personal records by signing in.
An MCP endpoint
POST JSON-RPC to https://api.financialiq.co.uk/v1/agent/mcp: initialize, tools/list and tools/call. One tool, financial_iq_api_request, calls a documented route, and that route's permission, idempotency and approval rules still apply.
Discovery before work
GET /v1/agent/capabilities says what the key can do and which actions are blocked. GET /v1/agent/mcp-tools lists tool descriptors with the permission and approval each needs. Neither reads the books.
Retries that don't duplicate
Send an Idempotency-Key on writes that create business effects. Repeat the same key and body and you get the stored response back, so a retried request doesn't make a second invoice.
Limits you can plan around
60 requests a minute and 1,000 an hour for each key or token by default. Past that you get a 429 with Retry-After. Lists page with limit and offset until has_more is false.
Webhooks for what changed
Register an HTTPS endpoint under /v1/webhooks and pick the events, or * for all of them. The signing secret is shown once, when you create or rotate it.
- business.invoice.created
- business.invoice.updated
- business.invoice.issued
- business.invoice.voided
- business.quote.updated
- business.purchase_invoice.voided
- business.expense_claim.voided
- business.credit_note.issued
- business.credit_note.cancelled
- business.approval.created
- agent.action.requires_approval
What’s live today
- Business API keysLiveCompany-scoped, with the permissions you pick.
- MCP endpointLiveJSON-RPC at /v1/agent/mcp, with the x-api-key header for business.
- WebhooksLiveSigned events for invoices, quotes, credit notes and approvals.
- SandboxLiveA test company and a key, by email, for 30 days.
- Personal API tokensLiveCreated under API access in Personal, with the scopes you choose.
- Connect Claude.ai or ChatGPT by signing inLiveAdd the MCP address as a custom connector and sign in when it asks. For Personal records.
There are no SDKs yet. Use the OpenAPI spec with the client generator you prefer.
Try it on a test company first.
Enter your email and we send you a link. Open it and your sandbox key is shown once, with a Business company of test data for 30 days. It runs on a separate test system with no live banking, filing or payments. Lost the key? The recovery link issues a new one.
Common questions
Is the API really included?
Yes. It comes with Business Pro and Autopilot, with the MCP endpoint and webhooks, at no extra charge. The person paying for a business plan gets the Personal API too. On Personal on its own, the Personal API is £4.99 a month.
How do I authenticate?
Business routes take a company key in the x-api-key header (fiq_live_ keys). Personal routes take a token in Authorization: Bearer (fiq_usr_ tokens), made under API access in Personal or by signing in from Claude.ai or ChatGPT. Business keys can't reach Personal routes. Keep keys and tokens in a server-side secret store, out of browser code and out of prompts.
What are the rate limits?
60 requests a minute and 1,000 an hour for each key or token, unless a tighter limit is set on the key. When you run out you get a 429 with a Retry-After header. Retry 429s and 5xx errors with backoff, and keep the same Idempotency-Key when you retry a write.
What can an agent do without approval?
Whatever its key's permissions allow, short of reaching a customer. It can read, draft and, with the invoices permission, issue. Sending an invoice needs an approval request, an approval and a separate delivery call, and both the request and the delivery need the approval_workflow permission. Don't give approval_workflow to an agent's key. VAT, Corporation Tax, Companies House and payroll submissions are handed to a signed-in person, and no permission allows payments or live filing.
How is the API versioned?
Every response carries the version, v1-2026-07 today. Our policy is that breaking changes ship under a new version and v1 routes stay backward compatible. If a route is ever withdrawn, we publish its replacement and a sunset date first.
I'm a partner without a Financial IQ account. Can I build?
Yes. Start in the sandbox with a test company. When a client who uses Financial IQ wants your integration, their owner or admin creates a key for it. If you're building for clients who don't use Financial IQ yet, tell us about it through the partner form.
- Building for clients who don’t use Financial IQ yet? Tell us about it.