Quipu

Getting credentials

1. In Quipu, create the API credentials for your account (see the API reference at quipuapp.github.io/api-v1-docs).
2. You receive a client id and client secret. Quipu's API uses the client-credentials grant, so there is no browser consent step for your own account's data. The token request is sent with HTTP Basic credentials and the fixed scope ecommerce, which Quipu requires on every token request (without it: 400 invalid_scope); the adapter sends both. Tokens last 2 hours.
3. Set QUIPU_CLIENT_ID and QUIPU_CLIENT_SECRET. AnythingMCP fetches and refreshes the access token on its own.

JSON:API, not plain JSON. Quipu follows the JSON:API specification: rows arrive as {"data": [{"id": …, "type": "invoices", "attributes": {…}, "relationships": {…}}]}. The interesting fields are inside attributes, and relationships are ids that need an include to resolve. This is why include appears on the tools below.

The Accept header is application/vnd.quipu.v1+json, Quipu's versioned media type, required on every call; with the generic JSON:API type application/vnd.api+json every path answers 404. The adapter sends it.

Issued vs received. Quipu keeps both in /invoices, told apart by filter[kind]: quipu_list_invoices asks for income (what you issue), quipu_list_expenses for expenses (supplier invoices you record). Tickets, paysheets and additional incomes are separate book entries; quipu_list_book_entries lists everything together. Dates are filtered by period (2026Q1, 2026-09), not by a from/to range. Invoices and expenses both carry the Spanish tax fields — IVA and IRPF retention — separately from the totals.

Paging is page[number] and page[size] (max 100, default 25), with total_pages, current_page and total_results in the response's meta.pagination_info. The API allows 5 requests per 5 seconds.

Checked against the published spec, not yet a live tenant. Paths, headers and filter names follow Quipu's OpenAPI document, and every route used here answers 401 (exists) without a token. The reference writes paths with an account prefix (/{owner_slug}/contacts); the adapter uses the unprefixed form, which Quipu also routes. If a live token gets 404 where the docs say the resource exists, the account prefix is the first thing to try.

Cloud reachability: getquipu.com is public with a valid certificate.