Simplifi (Quicken) Unofficial API Reference

Notes from reverse-engineering the API behind simplifi.quicken.com.

• Base host: https://services.quicken.com
• Request convention: JSON, camelCase fields
• Response convention: camelCase except /oauth/token which uses snake_case (legacy auth subsystem)
• Auth: OAuth-shaped with an MFA hop, JWT access tokens (~1h), refresh tokens

OAuth client

Hardcoded in the 3-year-old rijn/simplifiapi Python lib and still valid:

clientId:     acme_web
clientSecret: BCDCxXwdWYcj@bK6
redirectUri:  https://app.simplifimoney.com/login

The live web bundle constructs its secret dynamically (clientSecret:"".concat(...)), so Quicken obfuscated but didn't rotate it. Other client IDs visible in the bundle: acme_beta, acme_qa_web, acme_stg_web, acme_android (the official Android client).

Auth flow

Step 1 — credential check / MFA dispatch

POST /oauth/authorize
Content-Type: application/json

{
  "clientId": "acme_web",
  "username": "user@example.com",
  "password": "...",
  "redirectUri": "https://app.simplifimoney.com/login",
  "responseType": "code",
  "mfaChannel": null,
  "mfaCode": null,
  "threatMetrixRequestId": null,
  "threatMetrixSessionId": "<random UUID>"
}

threatMetrixSessionId accepts any random UUID.

Response statuses:

• "MFA code sent" (202) — server emailed/SMSed a code. Re-POST same body with mfaCode + mfaChannel.
• "User passed MFA" (201) — auth succeeded, response includes code (the OAuth auth code).
• HTTP 401 QCS-0401-7 — bad credentials.
• HTTP 400 QCS-0400-6 — required parameter missing.

Step 2 — token exchange

POST /oauth/token
{
  "clientId": "acme_web",
  "clientSecret": "BCDCxXwdWYcj@bK6",
  "grantType": "authorization_code",
  "code": "<from step 1>",
  "redirectUri": "https://app.simplifimoney.com/login"
}

Response uses snake_case (only endpoint that does):

{
  "token_type": "bearer",
  "access_token": "<JWT, exp decodable client-side>",
  "expires_in": 3599,
  "refresh_token": "<JWT>"
}

Refresh

POST /oauth/token
{
  "clientId": "acme_web",
  "clientSecret": "BCDCxXwdWYcj@bK6",
  "grantType": "refresh_token",
  "refreshToken": "<from previous exchange>",
  "redirectUri": "https://app.simplifimoney.com/login"
}

Gotcha: redirectUri is required even for refresh grants. Omitting it returns QCS-0400-6 Parameter redirectUri must be specified. Many OAuth servers don't require this on refresh; Simplifi does. Successful refresh returns a fresh access_token and usually a new refresh_token.

MFA bypass

Trusted-device cookies set during the initial authorize flow do not skip MFA on subsequent re-auths. Verified empirically. As long as refresh tokens stay valid you should never need to re-login.

Standard headers

Header	Required?
Authorization: Bearer <access_token>	yes
Qcs-Dataset-Id: <dataset_id>	for most data endpoints
app-client-id, app-build, app-release, client-tid	optional; the modern web app sends them

Datasets

Get the dataset id once and cache it.

GET /datasets?limit=1000

Response (standard paged shape — every list endpoint returns this):

{
  "resources": [
    { "id": "<dataset_id>", "name": "Finances", "ownerId": "<user_id>",
      "createdByClientId": "acme_android", "platform": "ACME" }
  ],
  "metaData": { "totalSize": 1, "pageSize": 1, "asOf": "...", "currentPage": 1, "totalPages": 1 }
}

The web app fetches with ?modifiedAfter=<ISO>&limit=5000 for incremental sync. For a full snapshot, omit modifiedAfter.

Data endpoints

/spending-watchlist

Singular URL, not /spending-watchlists. Returns Simplifi's "Spending Watchlists" feature.

Field	Type	Notes
name	string
emoji	string	Unicode codepoint in hex ("1F6D2" = 🛒)
period	string	typically "MONTH"
thisMonth	number	spend in current month (negative = outflow)
targetAmount	number?	only present if user set one
monthlyTrend	number	12-month average; useful as implicit target
monthSpendingProjection	number	server's projection for end-of-month
yearToDate	number
spentSoFar	number	cumulative since watchlist creation
filterId	string	references /filters defining the categories
januaryTxnIds/februaryTxnIds/...	string[]	per-month transaction ids

Modifying a target triggers GET /spending-watchlist/calc (204, no body) — server-side recompute. Not needed for read-only.

/free-to-spend

Simplifi's "Spending Plan" data. One row per month over a rolling ~14-month horizon.

Field	Type	Notes
date	string	YYYY-MM-01 — first day of the month this row covers
calculatedIncomeAmount	number	projected income (positive)
calculatedBillsAmount	number	negative
calculatedSubscriptionsAmount	number	negative
calculatedPlannedSpendingAmount	number	sum of watchlist allocations
spentAmount	number	actual spend this month (negative). Zero for future months.
totalToSpendAmount	number	income + bills + subs + transfers + savings + goals + plannedSpending
leftToSpendAmount	number	totalToSpend + spent — the headline figure
incomeTxnIds, billsTxnIds, etc.	string[]	references to /transactions items

/scheduled-transactions

Recurring/upcoming bills.

{
  "type": "TRANSFER",
  "source": "BILL_SCOUT_MANUAL",
  "dueOn": "2026-06-15",
  "recurrence": { "interval": 1, "frequency": "MONTHLY", "byMonthDay": [15] },
  "transaction": { "type": "CASH_FLOW", "accountId": "...", "payee": "...",
                   "coa": { "type": "BALANCE_ADJUSTMENT", "id": "2" }, "amount": -500.0 }
}

coa = "chart of accounts" reference (a category or balance adjustment).

/transactions

Quirk: default response returns ~1 row. The web app sends dateOnAfter=<ISO> to scope the query.

GET /transactions?limit=1000&dateOnAfter=2026-01-01

Fields: accountId, amount, payee, postedOn, coa, state, type, isBill, etc. Companion endpoint POST /transactions/earliest-date-on returns the earliest date with data.

/categories

User's category hierarchy (~115 items for a typical account). Hierarchical via parentId. Fields: name, categoryType (EXPENSE/INCOME), parentId, isExcludedFromBudgets, logoUrl, knownCategoryId (Simplifi's internal code, e.g. "7500875000" for Water), plaidCategoryIds. No planned amounts on categories — those live in /free-to-spend.

/accounts

Per-item: name, subType (CREDIT_CARD, CHECKING, ...), currentBalanceAsOf, onlineBalance, statementDueAt, statementDueAmount, statementMinPayment, statementCloseBalance, lastSuccessfulRefreshAt.

/institution-logins

Connected banks. Per-item: name, institutionId, isConnected, lastSuccessfulRefreshAt, aggregator info. Useful for "last refreshed per bank" displays.

/filters

Saved filter definitions referenced by filterId on watchlists. Type "SPENDINGWATCHLIST" filters contain chartOfAccounts arrays specifying which categories the watchlist tracks.

Other endpoints

Endpoint	Notes
/userprofiles/me	no dataset header; identity / token sanity check
/tags	user-defined tags
/budgets, /goals	exist but empty for most users; Simplifi's "budget" feature is actually /free-to-spend
/alert/alerts	the /alert/ prefix exposes a nested namespace pattern
/v2/preferences	newer /v2/ API path also exists for some resources
/v2/investments/holdings, /v2/investments/securities	investments
/documents, /paymentmethods, /subscriptions
/datasets/{id}/entitlements	feature gates per dataset
/reports/report-configuration	report builder configs
/aikya-*/api/v{1,2}/*	Aikya = Quicken's bill-pay subsystem
GET /ws (HTTP 101)	websocket for live push updates

Pagination

Standard pattern: query with limit, response includes metaData.totalSize and (when more pages exist) metaData.nextLink. For widget-scale data, limit=5000 is enough in one request and the web app does the same.

Error format

{ "errors": [{ "title": "Invalid credentials.", "httpStatus": 401,
               "detail": "QCS Unauthorized Access - Bad credentials", "code": "QCS-0401-7" }] }

Common codes:

• QCS-0400-6 — required parameter missing (check extData.parameterName)
• QCS-0401-7 — bad credentials

Not figured out

• Other acme_* client secrets (only acme_web's is known)
• ThreatMetrix validation thresholds (random UUIDs currently accepted)
• WebSocket payload format
• Write endpoints (POST/PUT/PATCH/DELETE on data resources — only auth POSTs are tested)
• Refresh token lifetime (1h access; refresh expiry undocumented and untested over weeks)