QuickBooks Webhooks: Send Accounting Events to Sazabi
Webhook facts checked on the platform’s docs on Nov 8, 2026.
QuickBooks Online can call your endpoint when data changes in a connected company file. Sending those calls to Sazabi gives your team a record of which entities changed and when, searchable next to the logs from the services that depend on them.
What QuickBooks Online sends
Intuit's webhooks notify an app whenever data changes in a connected QuickBooks Online company, and they apply to every company connected to the app. Each delivery is a POST with a JSON body. The body is an array, and each element is one event notification for one company, which Intuit identifies by realm ID.
An element follows the CloudEvents shape. The fields in the docs are specversion, id, source, type, datacontenttype, time, intuitentityid, intuitaccountid and data. The type field names the entity and the event as namespace.entitytype.eventname.version. The data object holds extra name-value pairs and can be empty.
The payload tells you what changed, not the whole record. A notification names the entity, its ID and the company. To read an invoice or a customer you call the QuickBooks API with that ID.
Why send QuickBooks webhooks to Sazabi
Accounting sync jobs fail quietly. A customer edit reaches QuickBooks, your sync worker is down for an hour, and the mismatch surfaces at month end. If every notification is also a log record, you can ask whether QuickBooks announced the change that your worker never processed.
Sazabi's Webhook Events source stores each JSON payload as a log record under webhook.* attributes. Because Intuit sends an array, each element becomes its own record, so one delivery with three changes gives you three records. Search for an entity ID, then search your worker logs for the same ID.
A path suffix such as /quickbooks on the intake URL is stored as webhook.path, which lets you filter this source in one query.
Set up QuickBooks webhooks
Copy your intake URL from the Webhook Events source. It encodes your project key, so keep it private. Then, in the Intuit developer portal:
- Sign in, choose My Hub, then App dashboard. Open the app.
- Select Webhooks in the left navigation and choose Production for live apps or Development for sandbox testing.
- Enter the intake URL as the Endpoint URL.
- Open the Show webhooks dropdown, review the entities and operations and enable the ones you want.
- Select Save.
Production and development are separate sets, so repeat the steps for each. Intuit says the first notification can take up to five minutes. For testing, use the Development set with a sandbox company and change a record there.
The portal also shows a verifier token for each set. Intuit signs notifications with it in the intuit-signature header.
Example QuickBooks payload
This example follows the sample in the Intuit docs. It is abbreviated and illustrative.
[
{
"specversion": "1.0",
"id": "88cd52aa-33b6-4351-9aa4-47572edbd068",
"type": "qbo.account.created.v1",
"datacontenttype": "application/json",
"time": "2025-09-10T21:31:25.179851517Z",
"intuitentityid": "1234",
"intuitaccountid": "310687",
"data": {}
}
]In a Sazabi thread, search for the type string qbo.account.created.v1 or for the entity ID to find the record. Open one record first to see how the fields are laid out before you build saved queries.
What to watch for
- Slow acknowledgements. The endpoint has 3 seconds to return HTTP 200. Anything else is retried at 10, 20 and 30 seconds, then 5 and 20 minutes, then 2, 4 and 6 hours, and every 6 hours after that.
- Blocked ordering. Intuit says you may not receive later events until you acknowledge the first one. A failing endpoint can therefore create a gap, not only a delay.
- Out-of-order events. The
timefield is the source of truth for when something happened. - Missed events. Intuit recommends a ChangeDataCapture call for each entity, going back to the last processed notification, and optionally a daily one. Compare record counts with those results.
For other finance flows, see the PayPal and Square guides. Browse every source on the integrations page or check pricing.
QuickBooks webhook facts
Signatures: Sazabi doesn’t check QuickBooks signatures by default, so it doesn’t reject unsigned or forged requests. Signature verification is in early access: contact support to turn it on for your organization, then verify signatures on the Webhook Events source with the Custom HMAC option (header intuit-signature, SHA-256, base64), and Sazabi rejects a delivery that fails the check with a 401. Until it’s on, the intake URL is the only credential. It’s hard to guess, so keep it private, and rotate the project’s public key if it leaks.
- Events: Each notification carries a type in the format namespace.entitytype.eventname.version, such as qbo.account.created.v1. (QuickBooks docs, accessed Nov 8, 2026)
- Payload: Webhook notifications are POSTs with a JSON body that holds an array of CloudEvents-style event notifications. (QuickBooks docs, accessed Nov 8, 2026)
- Signing: Hash the payload with HMAC SHA256 using your app verifier token as the key and compare the result with the intuit-signature header. (QuickBooks docs, accessed Nov 8, 2026)
- Retries: Endpoints must return HTTP 200 within 3 seconds, and failed events are retried at 10s, 20s, 30s, 5m, 20m, 2h, 4h and 6h, then every 6 hours. (QuickBooks docs, accessed Nov 8, 2026)
Frequently Asked Questions
Does QuickBooks send the full invoice or customer in the webhook?
The notification names the changed entity and its ID, the QuickBooks company ID and the event type. The sample payload in the docs has an empty data object, so you read the full record through the API.
How long does QuickBooks wait for a response?
Your endpoint must return HTTP 200 within 3 seconds. After that the delivery counts as failed and QuickBooks retries it.
Do sandbox and production use the same webhook settings?
No. The developer portal keeps one set for production and a separate set for development and sandbox, so you configure each on its own.
Does Sazabi verify QuickBooks signatures?
Not by default, and it doesn’t reject unsigned requests. Signature verification is in early access: contact support to turn it on for your organization, then turn on Verify signatures on the Webhook Events source with the Custom HMAC option (header intuit-signature, SHA-256, base64), and Sazabi rejects a delivery that fails the check with a 401. Until it’s on, keep the intake URL private.
Sources
- Webhooks notify you when data changes in QuickBooks Online company files and apply to all companies connected to your app (accessed Nov 8, 2026)
- Endpoint setup for production and development, verifier token, intuit-signature header, notification fields and the example payload (accessed Nov 8, 2026)
- Three second response, retry intervals, CDC calls for missed events, ordering and concurrency guidance (accessed Nov 8, 2026)
- Webhook Events log source: JSON only, a JSON array becomes one event per element, payload under webhook.* attributes; signature verification with the Standard Webhooks and Custom HMAC options, and rejected deliveries (accessed Nov 8, 2026)