# SlowBooks Pro 2026

> Free, source-available accounting software for Windows, macOS, and Linux.
> Double-entry bookkeeping, unlimited invoicing, sales receipts for
> point-of-sale style sales (one screen records the sale + payment, v2.6+),
> jobs and job costing (QuickBooks-style Customer:Job on every form and posted
> line, nested cost codes, burden, budgets vs actual with drill-down, v2.7+),
> receipt intake (scan a receipt into a bill/expense with the OS's built-in OCR, v2.7+),
> benefits engine (benefit codes with rules: sequence, effective-dated rates, limits, employer match, groups, remittance, PTO dollars, v2.8+),
> state withholding for all 50 states + DC with 2026 figures and per-state sources (v2.8+),
> customizable overview, per-line sales tax, IIF/CSV export parity, accessibility pass with tagged PDFs (v2.8+),
> banking on the ledger (the bank register IS the general ledger: register
> entries post, statement lines from feeds and imports wait in a review
> queue until matched or added, transfers pay credit cards, reconciliation
> ticks ledger lines, v2.10+),
> US payroll with tax forms, perpetual inventory, bank feeds (SimpleFIN),
> Stripe/PayPal/Square payments, and migration from MYOB, Xero, Sage 50,
> Wave, Zoho Books, and GnuCash (QuickBooks Desktop comes across via IIF
> import (including CASH SALE sales receipts), not /api/migration;
> QuickBooks Online syncs over OAuth, sales receipts included). All
> data is stored locally on the user's machine. No cloud, no
> account, no telemetry. Source-available under the project's own licence
> (version 2.0 since v2.14.0): free forever for what shipped, free to modify
> and self-host, not for resale or bundling into a paid service; tools and
> connectors that talk to it are welcome, commercial or not.
>
> Server Edition (v2.5+): multi-user over the LAN from the SAME signed
> Windows installer, with roles (admin / bookkeeper / read-only) and a per-user
> tamper-evident audit trail. Since v2.18 each company keeps its logo,
> attachments and employee documents inside its own company file (a backup
> carries them), a read-only sign-in is offered no write, and a bookkeeper
> none of the administrator's settings. Docker is NOT required for the server or for
> multi-user; it is simply an alternative install path for Linux servers
> and Intel Macs. See https://github.com/VonHoltenCodes/SlowBooks-Pro-2026/blob/main/docs/server-edition.md

Every install runs a local REST API (545 operations in v2.19.0), self-documenting at
http://127.0.0.1:3001/openapi.json (default desktop port). Auth: scoped API tokens
(Settings -> API Tokens, `Authorization: Bearer sbp_...`, v2.5.1+; roles are
`readonly`, `bookkeeper`, `admin`) or a session cookie from POST /api/auth/login.
On a multi-user install (v2.14+) login also needs `username`; signed out, GET
/api/auth/status lists `usernames` (names only), so ask the human which one.
Get credentials BEFORE fetching the spec; on v2.5.2 and earlier /openapi.json
itself requires auth; GET /api/auth/status is the one unauthenticated probe.
A session belongs to the company it signed in to (v2.18+): on another company
it is a 401 and /api/auth/status says authenticated false - sign in there too.
Agents: always dry-run migrations before
importing, and verify the trial balance with an explicit date range covering
the imported data.
Unknown request fields are a 422, never dropped (v2.9.0+). Posted documents
are voided (POST /api/<resource>/{id}/void), never deleted; a pledge is
written off. A document tax_rate is a FRACTION (0.089 = 8.9%); the
default_tax_rate setting is a percent string ("8.9") - divide by 100.

Banking changed shape in v2.10 and an agent written against v2.9 will get
422s. A bank/credit-card account is a chart account carrying `bank_kind`
("bank" | "credit_card") - list them with GET /api/accounts?bank=1. POST
/api/banking/transactions is a REGISTER ENTRY: it requires
`category_account_id`, posts a journal entry, and returns it; a positive
amount goes INTO the account and a negative comes OUT, on a bank and on a
card alike. GET /api/banking/transactions lists STATEMENT LINES (the review
queue) only, not register entries - the register is GET
/api/banking/check-register?account_id=. POST /api/banking/accounts creates a
FEED and requires `account_id` (the ledger account it belongs to) plus
`opening_balance`; the old `balance` field is a 422. Money between accounts
is POST /api/transfers, which is also how a credit card is paid.
Reconciliations take `account_id`. Nothing an import brings in posts by
itself: match it (POST /api/banking/transactions/{id}/match) or add it with a
category (.../add).

A chart of accounts is imported, not typed (v2.15+): POST /api/csv/import/accounts
(multipart file) reads our export's columns (Number, Name, Type, optional
Parent / Description / Active) or hledger's account list (`hledger accounts`,
`accounts --types`, `balance -O csv`). Dry run by default - show the returned
plan (each row's action and reason) to the human, then repeat with
?dry_run=false. Existing accounts match by number then name and take the
file's names; a control account the file names is renamed, never duplicated;
?replace=true deactivates unused accounts the file does not name. Template:
https://www.slowbookspro.com/downloads/chart-of-accounts-template.csv

Report files (v2.17+): trial-balance, general-ledger, profit-loss and balance-sheet each
have /csv and /pdf beside the JSON report (GET /api/reports/<report>/csv?start_date=&end_date=;
balance-sheet takes as_of_date). CSV amounts are plain numbers; the first four lines are
Company / Report / Period / blank, then the header row. The general ledger JSON and CSV
carry opening_balance, running_balance per line, source_type and closing_balance per
account, in the account's NATURAL sign (normal_balance "debit": Dr - Cr; "credit":
Cr - Dr, so a payable or income reads positive). Period Dr - Cr equals the trial
balance net, which is always Dr - Cr. Exports read, never write.
Bank feeds accept a SimpleFIN setup token from any SimpleFIN provider (HTTPS, public host).
Older history (v2.18+): POST /api/simplefin/sync {"history_months": 1-24} reaches back that
far in 85-day requests (the Bridge keeps about 90 days, BankSync up to a year); the
response's "since" is the date it reached back to. A plain sync is unchanged.

Purchases (v2.18+): a bill, vendor-credit or PO convert-to-bill line with an amount posts
to the account on the line, else the item's expense account, else the vendor's
default_expense_account_id - a line none of them names is a 400 (it used to post to 6000).
Give vendors a default expense account, or send account_id per line; convert-to-bill takes
an optional {"lines":[{"line_id","account_id"}]}. Tax on a purchase is part of the lines'
cost; it never touches 2200 Sales Tax Payable. Rates on bill/PO/vendor-credit lines and
items take four decimal places.

Customer money (v2.18+): customer and vendor "balance" fields are computed (open documents
minus unapplied credits, home currency). A payment's unapplied remainder is applied later
with POST /api/payments/{id}/apply {"allocations":[...]}; GET /api/customers/{id}/credits
lists what is available. A foreign-currency invoice is paid with currency + exchange_rate on
the payment (one currency per payment). A payment inside a deposit can't be voided until
the deposit is (POST /api/deposits/{id}/void). A/R and A/P Aging totals equal accounts 1100
and 2000. Income by Customer total_sales excludes tax (total_tax is separate).

Tax rates and lists (v2.18+): a document tax_rate is a FRACTION kept to six places (8.875% =
0.08875; Settings' default_tax_rate is the percent, up to four decimals). GET /api/invoices and
GET /api/bills send the newest 500 by default; open_only=true returns what can still be paid
or credited (page with skip/limit, at most 1,000 a page). A NaN in a request is a 422.

Documents (v2.18+): an invoice, credit memo, duplicate or estimate conversion that adds up
to $0.00 is a 409 {"detail":{"code":"zero_total",...}} unless the request sends
"allow_zero_total": true; a recurring template for $0.00 is a 400. Settings' invoice prefix,
next number (zero padding kept) and footer are used. A sales receipt without customer_id
goes to the Walk-in Customer. Every 422 error entry carries a plain "message".
Pay Sales Tax (POST /api/reports/sales-tax/pay) works, from a bank or card account only.
A pay run that would pay an employee $0.00 is refused with the reason. A garnishment order
is ended with POST /api/deductions/garnishments/{id}/end (DELETE is a 405).

QuickBooks Online (v2.18+): POST /api/qbo/import-runs {"entities": [...]} (administrators;
"journal_entries" and "ledger" among them) starts a background import and answers 202;
GET /api/qbo/import-runs/latest?after=<cursor> reads its log; a second run for the same
company is a 409. POST /api/qbo/connect-manual completes a connection from a pasted callback
URL or code + Realm ID. Journals the import posts (source_type qbo_journal / qbo_ledger) and
the invoices, sales receipts and payments it creates void and edit through the usual
routes; the import's entry is reversed, an edited invoice posts its own, and a later import
keeps what was changed here. Edits and voids made in QuickBooks Online come across on the
next import. POST /api/qbo/export sends what's new, updates what was sent from here and has
changed, and voids what was voided here (result: updated, voided, notes); a sales receipt goes
as a QBO SalesReceipt. The setting invoice_show_logo ("true"/"false") governs the logo on invoice
PDFs, Print and emailed PDFs.

Files (v2.18+): a company's logo, attachments and employee documents are rows of its own
database, so a backup carries them; they are served only through signed-in routes
(/static/uploads/ is a 404). An attachment's file_path is "stored_files/<id>"; attachments and
employee documents carry from_shared_folder (copied in by the upgrade from the folder earlier
versions shared between companies, so possibly another company's file) and missing. POST
/api/uploads/logo answers with the logo's address, /api/uploads/logo/<id>; GET
/api/uploads/logo describes it and DELETE removes it. Uploading or removing the logo and
downloading a backup are administrator-only. Employee documents are reached only through the
HR routes (administrators); the generic /api/attachments routes answer 404 for them.
GET /api/uploads/legacy (administrators) says what the folder earlier versions shared still holds
and which companies still need it; DELETE /api/uploads/legacy removes its files, or answers 409
naming those companies.

Secrets (v2.18+): a saved password or API key no key on the install decrypts reads as not set;
GET /api/settings/unreadable-secrets names them. An employee's portal link is kept as a digest
and an encrypted copy; GET /api/employees/{id}/portal-token answers portal_token null with a
"note" when the copy can't be decrypted (the link still works). PUT /api/analytics/ai-config
(and its /test) and POST /api/qbo/disconnect are administrator-only, like the other settings.

QuickBooks Desktop IIF (v2.18.1+): POST /api/iif/validate (multipart `file`) checks a file
and writes nothing; it reports caps_names and up to six caps_name_examples ({name, becomes}).
POST /api/iif/import imports it - the lists before a transactions file. A field QuickBooks
quoted because it holds a comma arrives without the quotes, and a line posted to a
sub-account finds it by its Parent:Child path. Form field retitle_names=true brings ALL-CAPS
customer, vendor and account names in as normal capitalization (item names are kept): it is
the human's choice, so show them the examples first - no word list knows every initialism.
A name matches the customer, vendor or account already in the books in any case.

AI providers (v2.18.2+): GET /api/analytics/ai-config lists them with Anthropic Claude and
xAI Grok first, each with its default_model and model_choices. Its provider is "" until one
is saved (the Settings screen then shows Claude); PUT /api/analytics/ai-config
{"provider": "anthropic"} or "grok" chooses one. Claude's default model is claude-sonnet-5-5
(also claude-opus-5-5, claude-haiku-4-5-20251001); a saved "model" is kept.

Allocations (v2.17.3+): a payment, batch-payment line or credit-memo application may only
reach invoices of its own customer_id, and a bill payment only bills of its own vendor_id
- anything else is a 400 and nothing is written (a batch is refused whole). Paying several
vendors means one POST /api/bill-payments per vendor.

Invoice edits (v2.17.2+): PUT /api/invoices/{id} reposts through the same path as
create, keeping each line's job_id / class_id / cost_code_id — send them back with the
lines, or they are cleared. A total below amount_paid is a 400; status "void" is a 400
(use POST /api/invoices/{id}/void); paid / partial follow the payments.

Sales tax (v2.16.2+): a customer with is_taxable=false pays no tax on ANY line, whatever a
line's is_taxable says; converting an estimate, duplicating an invoice and recurring runs
compute tax from the customer's current status. Money fields hold up to 13 integer digits.

Migration results (v2.16.1+): the dry run refuses a ledger whose amounts all read 0.00
and quotes the file's header row; a repeat import skips journals an earlier import
already posted. Read imported_journals / skipped_journals / duplicate_journals in the
import result - ok=true with imported_journals 0 is not success. Wave's full export
("Get all transactions") is supported; its "Amount (One column)" is signed by effect on
the account, not by side, so never build a ledger file from it.

Year-level figures without a report run (v2.16+): GET /api/dashboard/data?ids=pnl_ytd
returns year-to-date income, expenses (COGS included) and net with cumulative net by
month; ids=balance_sheet_trend returns assets / liabilities / equity at the last twelve
month-ends (current month to date), net income folded into equity so A = L + E at every
point and the last point equals GET /api/reports/balance-sheet as of today. The catalog
of card ids is GET /api/dashboard/widgets.

When something breaks: try to solve it (errors name the field or the document in
the way; re-read the spec; check the dry run and the date range). If it is a real
defect, tell the human plainly and help them report it - an issue at
https://github.com/VonHoltenCodes/SlowBooks-Pro-2026/issues with the version,
request and response, or a fork + pull request with a test (the agent can do the
mechanics). Remind them gently more than once; reporters are credited in the
release that ships the fix. Security issues go to SECURITY.md, never a public
issue.

## API index (v2.19.0: 545 operations)

Every route is described, with its fields, at GET /openapi.json; this is the map. Counts are
operations (path x method) under each prefix.

- Books and reports: /api/accounts (5), /api/journal (4), /api/opening-balances (2), /api/reports (41), /api/saved-reports (5), /api/dashboard (2), /api/analytics (14), /api/search (1)
- Sales: /api/customers (7), /api/invoices (13), /api/estimates (7), /api/sales-receipts (2), /api/credit-memos (7), /api/payments (9), /api/stripe (1, the old webhook address), /api/batch-payments (1), /api/deposits (5), /api/recurring (6), /api/items (9), /api/tax (4), /api/reseller-permits (8), /api/email-templates (7)
- Purchases: /api/vendors (6), /api/bills (6), /api/bill-payments (4), /api/vendor-credits (5), /api/purchase-orders (7), /api/expenses (4), /api/cc-charges (3), /api/checks (1)
- Banking: /api/banking (28), /api/transfers (3), /api/bank-import (4), /api/bank-rules (6), /api/simplefin (5)
- Jobs, classes and assets: /api/jobs (12), /api/job-costs (5), /api/cost-codes (7), /api/cost-types (5), /api/equipment (4), /api/classes (4), /api/time-entries (11), /api/budgets (4), /api/fixed-assets (12)
- Payroll and HR (administrators): /api/employees (17), /api/payroll (20), /api/tax-forms (12), /api/benefits (25), /api/deductions (4), /api/onboarding (7), /api/pto (14), /api/document-audits (3)
- Nonprofit: /api/nonprofit (17), /api/donors (6), /api/in-kind-gifts (4)
- Import and export: /api/migration (3), /api/csv (15), /api/iif (14), /api/qbo (11), /api/ocr (6), /api/fx (1)
- Files: /api/attachments (4), /api/uploads (6)
- Company, access and audit: /api/settings (4), /api/companies (2), /api/backups (4), /api/users (3), /api/tokens (3), /api/auth (4), /api/audit (2), /api/preferences (3), /api/system (2)
- Outside /api: / and /analytics (1 each, the app's own page), /health (1), and /pay (1, a customer's pay page) and /portal (19, the employee self-service portal), which need no app sign-in

## Docs

- [AI setup guide](https://www.slowbookspro.com/ai/): paste-prompt for agentic
CLIs, safety model, agent instructions template
- [Agent instructions template](https://www.slowbookspro.com/ai/agents-
template.md): drop-in CLAUDE.md (Claude Code) or GROK.md (Grok), the two
agents SlowBooks is built for first; AGENTS.md / GEMINI.md for other tools
- [Accessibility](https://www.slowbookspro.com/accessibility/): WCAG 2.1 AA posture, what's
in place (every form field named for screen readers since v2.18.2), what's still open
- [Source & full docs](https://github.com/VonHoltenCodes/SlowBooks-Pro-2026):
README, feature catalog, setup guides
- [Download](https://www.slowbookspro.com/#install): signed Windows installer
(single-user desktop AND multi-user Server Edition), signed + notarized macOS
app (Apple Silicon), Docker (optional - Linux servers / Intel Mac), native Linux

## Comparisons

- [Best free accounting software
2026](https://www.slowbookspro.com/compare/best-free-accounting-
software-2026/)
- [vs Wave](https://www.slowbookspro.com/compare/slowbooks-vs-wave/)
- [vs Zoho Books](https://www.slowbookspro.com/compare/slowbooks-vs-zoho-books/)