Home / Accounting & Bookkeeping / One weekly question list per client for QuickBooks Online uncategorized transactions (answers go to the bookkeeper)

Accounting & Bookkeeping problem 2: Uncategorized transactions pile up waiting on the client

One weekly question list per client for QuickBooks Online uncategorized transactions (answers go to the bookkeeper)

Verified with mocksLast tested 2026-10-28 · pricing checked October 2026

Every Monday the workflow reads the client's QuickBooks Online company for expenses and deposits from the last 45 days that sit in Uncategorized Expense, Uncategorized Income or Ask My Accountant, and sends the client one plain-English list with a short answer form (a signed link, no login). Answers are emailed to the bookkeeper and added as a Karbon note on the client. It never changes anything in QuickBooks: the bookkeeper categorizes. A transaction is asked about at most 3 times, then the bookkeeper is told instead.

The problem

Every unexplained line holds up the month-end close and, later, the tax return. The figure below is a single practitioner's view quoted in a vendor report.

Background reading: A WISP for small tax and bookkeeping firms that use automations: what the Safeguards Rule asks of your tools

Who it's for

US bookkeepers and small firms doing monthly books in QuickBooks Online for clients who don't answer 'what was this?' emails.

Tools and monthly cost

ToolOfficial price
QuickBooks Online (your client's subscription; you connect through accountant access)Simple Start $38 / month, Essentials $85, Plus $140, Advanced $340 (list prices; intro discounts vary) pricing page
Intuit developer app (QuickBooks API)Builder tier: no fee; writes are unmetered and reads ('CorePlus' calls) are capped at 500,000 a month, then blocked until next month. These recipes make a few hundred reads a month pricing page
Resend (sends the emails)Free: 3,000 emails / month, 100 / day. Pro: $20 / month for 50,000 pricing page
Karbon (optional practice-management tool; its API needs the Business or Enterprise plan)Team $59 / user / month billed annually ($79 monthly, teams of 4+); Business $89 / user / month billed annually ($99 monthly). Business includes automatic client reminders pricing page
n8nCommunity Edition: free if you self-host (you pay for the server). n8n Cloud: from EUR 20 / month (Starter) or EUR 50 (Pro) pricing page

Example month: Illustrative arithmetic. Per client: 4 Monday runs of about 3 QuickBooks queries each plus a token refresh, 4 question emails and a few answer emails. For 25 clients that is about 300 read calls a month (Intuit's Builder tier allows 500,000) and about 200 emails, inside Resend's free tier. About $0 a month plus your n8n server; QuickBooks is the client's existing subscription.

Setup

  1. Read the 'Safeguards Rule, WISP, 7216 and Circular 230' section on the accounting hub first.
  2. QuickBooks: create an app at developer.intuit.com (Builder tier, no fee), add n8n's OAuth2 redirect URL, and create one n8n 'OAuth2 API' credential with Intuit's token URL and the com.intuit.quickbooks.accounting scope. Connect it once through your accountant user; n8n refreshes the 1-hour access token and stores the rotating refresh token itself. Set QBO_REALM_ID to the client's company ID and MSS_QBO_API to https://quickbooks.api.intuit.com/v3/company. Reads only; the workflow never writes to QuickBooks.
  3. One copy of the workflow per client company: set QBO_CLIENT_NAME, QBO_CLIENT_FIRST and QBO_CLIENT_EMAIL. QBO_SUSPENSE_ACCOUNTS lists the account names to ask about, QBO_LOOKBACK_DAYS (default 45) the window and A2_MAX_ASKS (default 3) the cap.
  4. Set A2_FORM_SECRET (a long random string) and A2_FORM_URL to the public address of the 'mss-a2-answers' webhook; the link carries a signature, so a changed link is refused. Set A2_BOOKKEEPER_EMAIL.
  5. Karbon (optional): in Settings > Connected Apps > API Applications (Business or Enterprise plan), copy the application ID and access key into KARBON_APP_ID and KARBON_ACCESS_KEY. By default the API only sees Public clients; Private or Hidden clients need an admin request to Karbon. Karbon requires both headers on every call; the workflow refuses to send them to any other host. KARBON_REQUEST_INTERVAL_MS paces calls and 429 replies wait for Retry-After. Set QBO_KARBON_CLIENT_KEY to the client's Karbon organization (or contact) key.
  6. Set CPA_FIRM_NAME, CPA_FIRM_SHORT, CPA_PHONE, CPA_ADDRESS, CPA_FROM_EMAIL, CPA_REPLY_TO, CPA_TZ and PARTNER_EMAIL from .env.example. Every client email is signed with your firm name, phone and address. Run n8n behind HTTPS with multi-factor authentication on the n8n login and on every connected account, keep execution logs short (Settings > n8n data pruning), and add n8n and its host to your WISP's list of service providers. The workflow also has a manual 'run now' webhook used by our tests. Delete it, or put it behind n8n's header authentication, before you go live.

Download

Download bookkeeping-uncategorized-transactions-questions.zip

Contains the n8n workflow, the mock data, the test runner with its last results, and the mock server we tested against. All keys in .env.example are fake.

Test result

Every workflow was imported into n8n 2.45.4 and run end to end on our test machine. Karbon (API v3), TaxDome (public API v4, read-only), QuickBooks Online (Accounting API with OAuth 2.0), Google Sheets and the email sender (Resend) were replaced by a local mock server built from their official API docs: it checks the same request shapes, authentication headers and query syntax, pages results (Karbon @odata.nextLink, TaxDome cursors, QuickBooks STARTPOSITION), returns HTTP 429 with Retry-After, and expires the QuickBooks access token so n8n's real OAuth2 refresh runs. These recipes use no AI model; every decision is a written rule. Clients, firms and transactions are invented. Verified with mocks; no real client data was used, and nothing was sent to a real person or account.

6/6 scenarios passed (run 2026-10-28)

PASSQ1Monday: expired QuickBooks token refreshed by n8n's OAuth2 credential, one 429 retried, paged queries; ONE client email with the 5 suspense lines (split line only), old txn out, card number masked
PASSQ2Same week again: nothing
PASSQ3Form link: tampered token -> 403; real link -> form with 5 questions, bank memo HTML-escaped
PASSQ4Client answers 3 of 5: bookkeeper emailed, Karbon note on the client organization, thank-you page; QuickBooks untouched; posting twice does not resend
PASSQ5Next Monday: only the 2 unanswered + 1 new transaction are asked; answered ones are not
PASSQ6Lines recategorized in QuickBooks drop out; after 3 unanswered asks the bookkeeper is told instead of nagging the client again

Actual output from the test run

Scenario Q1: the Monday question list (invented transactions; card number masked, link token shortened). Names and numbers are invented.

Subject: 5 quick questions about your books

Hi Fern,

We couldn't tell what these transactions were for:

- Oct 28  $412.18 paid to AMZN Mktp US  "AMZN Mktp US*2K4"
- Nov 1  $2,400.00 received from (no name)  "Zelle from J SMITH"
- Nov 2  $1,250.00 paid to (no name)  "Check 4417"
- Nov 3  $180.00 paid to Staples  "Staples store 0042"
- Nov 4  $64.50 paid to Corner Cafe <b>  "<script>x</script> card *1111"

It takes a minute to answer here (no login needed; the link is just for you and expires in 60 days):
http://127.0.0.1:5678/webhook/mss-a2-answers?b=20261109-de2d8a3b&t=<signed-token>

Or just reply to this email. Please don't send receipts with card or account numbers by email - upload them to the portal instead.

Thanks,

Cedar Ledger CPAs
(555) 555-0140
40 Example St, Suite 3, Hartford, CT 06103

Verified with mocks

  • Monday: the QuickBooks access token had expired, n8n's own OAuth2 credential refreshed it (rotating refresh token) and retried; one 429 was retried; queries were paged; the client got one email with the 5 lines in suspense accounts (only the suspense line of a split transaction), an older transaction was left out and a card number was masked.
  • Same week again: nothing sent. Every QuickBooks query carries minorversion=75.
  • The answer form: a tampered link gets 403; the real link shows the 5 questions with bank memo text HTML-escaped.
  • The client answers 3 of 5: the bookkeeper is emailed, a Karbon note is added on the client's organization and the client sees a thank-you page; nothing is written to QuickBooks; posting the form twice doesn't send twice.
  • Next Monday only the 2 unanswered lines and 1 new one are asked. Lines recategorized in QuickBooks drop out; after 3 unanswered asks the bookkeeper is told instead of the client being asked again.
  • Verified with mocks; no real client data used.

Documented from official API docs only

Built to the vendor's documentation but not run against a live account. Check these on yours.

  • QuickBooks Online Accounting API query endpoint for Purchase, Deposit and Account (SQL-like query, STARTPOSITION / MAXRESULTS paging, minorversion 75) and Intuit's OAuth 2.0 token refresh (from Intuit's developer docs; not run against a live QuickBooks company).
  • Intuit's throttling (HTTP 429) and the Builder tier's 500,000 CorePlus read calls a month (from Intuit's developer docs).
  • Karbon Notes API (from Karbon's developer docs). Resend email API (from Resend's docs).

Limitations

  • It looks at expenses (Purchase) and deposits only, not journal entries, transfers or bank-feed items you haven't added yet ('For review'). Those still need the bank-feed screen.
  • It doesn't suggest a category. The bookkeeper decides, using the client's answer.
  • One workflow copy per client company (QuickBooks connects one company per credential).
  • Emails ask for documents through your client portal, never as attachments. Before client-supplied text goes into an email, a Karbon note or a work item, this recipe applies the same rule as our chase ladder, uncategorized-transactions, organizer and digest recipes: numbers written like an SSN or ITIN (123-45-6789 or 123 45 6789) or an EIN (12-3456789) are replaced with [removed], and any other unbroken run of 5 or more digits is cut to its last 4 (99887766 becomes *7766; an SSN typed without dashes shows as its last 4). Runs of 4 digits or fewer, such as years and form numbers, are left as they are. That is a safety net, not a guarantee: n8n's own execution log still keeps the unmasked rows it read (14 days by default). Keep those numbers out of the Google Sheet too.
  • Not legal or professional-standards advice, and not a compliance guarantee. Tax preparers are covered by the FTC Safeguards Rule (16 CFR 314), which asks for encryption in transit and at rest (314.4(c)(3)), multi-factor authentication for anyone accessing an information system (314.4(c)(5)) and oversight of service providers (314.4(f)); n8n, its server, Resend, Google and Karbon/TaxDome are service providers to list in your written information security plan (IRS Pub 4557 and 5708). Section 7216 limits how you use and disclose tax return information. Check with counsel and your state board before you turn this on.