{
 "categories": [
  "fintech",
  "finance"
 ],
 "deployment": "saas",
 "evidence": [
  {
   "date": "2026-10-16",
   "fact": "homepage",
   "note": "The homepage presents the Qonto business account, finance management, and company creation.",
   "source": "https://qonto.com",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "name",
   "note": "The page uses the name Qonto for the business account.",
   "source": "https://qonto.com",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "vendor",
   "note": "The homepage says Qonto is a French company headquartered in Paris.",
   "source": "https://qonto.com",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "categories",
   "note": "The page describes a business account with transfers, cards, invoices, and finance management. Categories are fintech and finance.",
   "source": "https://qonto.com",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "license",
   "note": "The homepage invites visitors to open a business account. The opened pages do not show a free tier. The license is commercial.",
   "source": "https://qonto.com",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "deployment",
   "note": "The Business API gives remote access to Qonto's hosted financial features. OAuth is at oauth.qonto.com and the API host in the examples is thirdparty.qonto.com. Deployment is saas.",
   "source": "https://docs.qonto.com/get-started/business-api/overview.md",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "platforms",
   "note": "The API key is created in the Qonto web app. Platforms include web.",
   "source": "https://docs.qonto.com/get-started/business-api/authentication/api-key.md",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.api.exists",
   "note": "The overview says the Business API gives programmatic access to payments, cards, transactions, invoicing, and related features.",
   "source": "https://docs.qonto.com/get-started/business-api/overview.md",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.api.kinds[0]",
   "note": "The introduction says Qonto provides two collections of REST APIs and that JSON is returned in all API responses.",
   "source": "https://docs.qonto.com/get-started/general/introduction.md",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.api.auth[0]",
   "note": "The API key is Authorization set to the organization sign-in, a colon, and the secret key, without Base64. The example calls https://thirdparty.qonto.com/v2/organization.",
   "source": "https://docs.qonto.com/get-started/business-api/authentication/api-key.md",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.api.auth[1]",
   "note": "OAuth 2.0 authorization code starts at https://oauth.qonto.com/oauth2/auth. The access token is sent as Authorization Bearer and lasts 1 hour. offline_access adds a refresh token that lasts 90 days.",
   "source": "https://docs.qonto.com/get-started/business-api/authentication/oauth/oauth-flow.md",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.api.coverage",
   "note": "The endpoint table covers transactions, invoices, cards, transfers, webhooks, and other resources. Some writes are OAuth-only and some require SCA. The Business API overview says features depend on the price plan. Coverage is partial.",
   "source": "https://docs.qonto.com/get-started/business-api/authentication/introduction.md",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.api.docs",
   "note": "Opened as the current Business API overview.",
   "source": "https://docs.qonto.com/get-started/business-api/overview.md",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.mcp.first_party",
   "note": "docs.qonto.com documents the Qonto MCP server at https://mcp.qonto.com/mcp and says it uses OAuth from the same identity provider as the developer site.",
   "source": "https://docs.qonto.com/mcp/overview",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.mcp.verdict",
   "note": "The authentication page describes Qonto's own MCP server, the production URL, and the multi-organization URL. The verdict is official.",
   "source": "https://docs.qonto.com/mcp/authentication.md",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.cli.exists",
   "note": "Qonto documents the qonto CLI, installed from https://install.qonto.com/cli, as the Business API from the terminal.",
   "source": "https://docs.qonto.com/cli/overview.md",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.extensibility.webhooks",
   "note": "The endpoint table lists webhook subscriptions to list, create, get, update, and delete, with OAuth scope webhook. API key access is not marked for those rows.",
   "source": "https://docs.qonto.com/get-started/business-api/authentication/introduction.md",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.data_access.export[0]",
   "note": "The introduction says JSON is returned in all API responses, including errors.",
   "source": "https://docs.qonto.com/get-started/general/introduction.md",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "modalities.agent_docs.llms_txt",
   "note": "Opened the documentation index at llms.txt. It lists the Business API, MCP, and CLI pages.",
   "source": "https://docs.qonto.com/llms.txt",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "verdict.scores.api",
   "note": "A documented REST API with an API key, OAuth, JSON, and webhook subscriptions is practical. SCA, plan limits, and backend-only calls keep the score at 7.",
   "source": "https://docs.qonto.com/get-started/business-api/authentication/introduction.md",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "verdict.scores.mcp",
   "note": "An official server with account reads and vetted writes is a 7. Transfers, webhooks, terminals, and onboarding stay on the Business API, and some roles need an admin to enable MCP.",
   "source": "https://docs.qonto.com/mcp/overview",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "verdict.scores.cli",
   "note": "The official CLI prints JSON, accepts --jq, and can create invoices and manage cards. The overview says it cannot make transfers, and some writes wait for SCA. Score 6.",
   "source": "https://docs.qonto.com/cli/usage.md",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "freshness.watch[0].url",
   "note": "Opened and verified as the current Business API authentication introduction, including the endpoint access table.",
   "source": "https://docs.qonto.com/get-started/business-api/authentication/introduction.md",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "freshness.watch[1].url",
   "note": "Opened and verified as the current OAuth flow, including token lifetimes.",
   "source": "https://docs.qonto.com/get-started/business-api/authentication/oauth/oauth-flow.md",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "freshness.watch[2].url",
   "note": "Opened and verified as the current Qonto MCP overview, including the transfer gap.",
   "source": "https://docs.qonto.com/mcp/overview",
   "tier": "declared"
  },
  {
   "date": "2026-10-16",
   "fact": "freshness.watch[3].url",
   "note": "Opened and verified as the current Qonto documentation index.",
   "source": "https://docs.qonto.com/llms.txt",
   "tier": "declared"
  }
 ],
 "freshness": {
  "last_verified": "2026-10-16",
  "volatility": "high",
  "watch": [
   {
    "type": "docs",
    "url": "https://docs.qonto.com/get-started/business-api/authentication/introduction.md"
   },
   {
    "type": "docs",
    "url": "https://docs.qonto.com/get-started/business-api/authentication/oauth/oauth-flow.md"
   },
   {
    "type": "mcp",
    "url": "https://docs.qonto.com/mcp/overview"
   },
   {
    "type": "docs",
    "url": "https://docs.qonto.com/llms.txt"
   }
  ]
 },
 "homepage": "https://qonto.com",
 "id": "qonto",
 "license": "commercial",
 "modalities": {
  "agent_docs": {
   "llms_txt": true
  },
  "api": {
   "auth": [
    "api-key",
    "oauth2"
   ],
   "coverage": "partial",
   "docs": "https://docs.qonto.com/get-started/business-api/overview.md",
   "exists": true,
   "kinds": [
    "rest"
   ]
  },
  "cli": {
   "exists": true
  },
  "computer_use": {
   "issues": [],
   "viability": "unknown"
  },
  "data_access": {
   "export": [
    "json"
   ],
   "import": []
  },
  "extensibility": {
   "scripting": [],
   "webhooks": true
  },
  "integrations": {
   "make": "unknown",
   "n8n": "unknown",
   "power_automate": "unknown",
   "zapier": "unknown"
  },
  "mcp": {
   "first_party": true,
   "third_party": [],
   "verdict": "official"
  },
  "rpa": {
   "drivability": "unknown",
   "notes": "No repeatable UI probe was run. The API key is created in the Qonto web app under Integrations and Partnerships. The documented machine paths are the Business API, the hosted MCP server, and the qonto CLI. This record is the Qonto business account, not Pennylane.\n",
   "ui_stack": [
    "web-dom"
   ],
   "vendor_support": []
  },
  "sdk": {
   "exists": "unknown",
   "languages": [],
   "official": "unknown"
  }
 },
 "name": "Qonto",
 "platforms": [
  "web"
 ],
 "related": {
  "alternatives": [],
  "our_products": []
 },
 "schema_version": 1,
 "score_version": 1,
 "status": "active",
 "vendor": "Qonto",
 "verdict": {
  "best_path": "api",
  "scores": {
   "api": 7,
   "cli": 6,
   "computer_use": null,
   "integrations": null,
   "mcp": 7,
   "overall": 7,
   "rpa": null
  },
  "search": {
   "description": "Qonto documents an API key and OAuth for the Business API. The official MCP server and CLI omit SEPA and international transfers.",
   "title": "Qonto is automatable through its Business API"
  },
  "summary": "Qonto is automatable today through the Business API. The developer introduction says Qonto provides two REST API collections and that responses are JSON. API calls must use HTTPS and, except for the browser authorization URL, must come from a backend. Authentication is an API key or OAuth 2.0. The API key is the organization sign-in and secret key joined by a colon in the Authorization header, without Base64. OAuth is an authorization-code flow at https://oauth.qonto.com/oauth2/auth. The access token lasts 1 hour and is sent as Authorization Bearer. A refresh token lasts 90 days, requires the offline_access scope, and rotates on use. The authentication table lists transactions, statements, invoices, clients, cards, payment links, webhook subscriptions, SEPA beneficiaries, and international transfers, and it marks which of those accept an API key. Card creation and international transfers require OAuth, and several of those writes also require Strong Customer Authentication. The introduction says the API key is the simpler method when the endpoint allows it. The official MCP server at https://mcp.qonto.com/mcp uses OAuth on the same identity provider. One authorization is one organization. The multi-organization URL is https://mcp.qonto.com/multi-organization/mcp. The overview says the server can read transactions, statements, invoices, quotes, clients, cards, requests, and labels, and that it can draft invoices and manage cards. It says SEPA transfers from a beneficiary, international transfers, webhooks, terminals, and onboarding are not in the server. Owners, admins, and accountants can connect. Managers and employees need an owner or admin to enable MCP. The official qonto CLI signs in with browser OAuth, stores the session in the operating system credential store, and prints JSON when the output is piped or when --output json is set. The CLI overview says it cannot make SEPA, internal, or international transfers. Zapier, Make, Power Automate, and n8n were not opened. Computer-use viability is unassessed. The API scores 7. The MCP server scores 7. The CLI scores 6. The API is the best path because it documents transfer creation, which the MCP server and the CLI both leave out. An API key also covers many reads without a registered OAuth application.\n"
 }
}