# LeanLaw

> LeanLaw is legal billing and revenue-operations software for small and mid-sized law firms, built
> natively on QuickBooks Online. It covers time and expense tracking, matter management, trust/IOLTA
> accounting, flat-fee and contingency billing, invoicing, e-payments and LEDES output, and keeps a
> real-time two-way sync with QuickBooks Online.

Generated: 2026-08-25
Method: generated (LeanLaw publishes no llms.txt — /llms.txt returns 404 on platform.leanlaw.io and
www.leanlaw.co). Assembled by API Evangelist from LeanLaw's published OpenAPI, developer portal and
live OAuth discovery documents.

## API at a glance

- Base URL: https://api.leanlaw.io
- Path version: /v2/ (note: the OpenAPI `info.version` says "v1" — the path version is authoritative)
- OpenAPI 3.0.4: https://api.leanlaw.io/swagger/v1/swagger.json
- 18 paths, 35 operations, 74 schemas
- Auth: `Authorization: Bearer {apikey}` — a firm-scoped API key created in the LeanLaw UI under
  Settings > API. HTTPS is required.
- Optional headers: `x-leanlaw-userid` (act as a specific user), `x-leanlaw-partnerid` (partners)
- Every response carries `x-leanlaw-traceid`

## Conventions

- All responses are wrapped: `{"data": ...}`
- Lists paginate with `limit` and `offset`; the response carries `{"pagination": {"limit","offset","total"}}`
- Max page size: 1000
- `select=` expands or trims fields; a leading `-` excludes. Known values: contact, meta,
  customFields, ledesConfiguration. Example: `select=contact,-meta`
- PUT is SPARSE — only properties you send are changed. Omitting a field does not clear it.
- Success: 200 for GET/PUT/DELETE, 201 for POST
- Errors: 400 invalid request, 401 no key, 403 not authorized/invalid, 429 throttled, 500 server error
- There is NO idempotency key. Retrying a POST after a timeout or 429 can create a duplicate record.
- There are no rate-limit headers and no published limits; back off blindly on 429.

## Core concepts

- Clients own matters. Every matter belongs to exactly one client and has exactly one responsible user.
- Billable items are time entries, expenses and fixed fees. Each belongs to exactly one matter (and
  by extension its client), always has a date and description. Time entries always have a user;
  expenses and fixed fees optionally do.
- Internal ids are GUIDs (`clientId`, `matterId`, ...). A separate `reference` property carries the
  firm's own "Client ID"/"Matter ID" and may be absent. Do not confuse the two.
- Custom fields are firm-defined. `ListCustomFields` returns definitions; values arrive on records in
  a `customFields` array via `select=customFields`. Both are read-only through the API.
- LEDES codes (activity, task, expense) come from `GET /v2/codes`; per-matter LEDES requirements live
  in `MatterLedesConfiguration`.

## Operations

Clients: ListClients, CreateClient, GetClient, UpdateClient, DeleteClient, GetClientBalances
Matters: ListMatters, CreateMatter, GetMatter, UpdateMatter, DeleteMatter
Time entries: ListTimeEntries, CreateTimeEntry, GetTimeEntry, UpdateTimeEntry, DeleteTimeEntry
Expenses: ListExpenses, CreateExpense, GetExpense, UpdateExpense, DeleteExpense
Fixed fees: ListFixedFees, CreateFixedFee, GetFixedFee, UpdateFixedFee, DeleteFixedFee
Invoices: ListInvoices (read-only)
Users: ListUsers, UpdateUser (no create, no delete)
Practice areas: ListPracticeAreas, CreatePracticeArea, UpdatePracticeArea, DeletePracticeArea
Codes: GetCodes (LEDES)
Custom fields: ListCustomFields

## Things an agent must know before writing

- `CreateMatter` has an external side effect: for firms on the QuickBooks Online integration it also
  creates the client as a QuickBooks customer and the matter as a sub-customer. `DeleteMatter` is not
  documented as undoing that.
- Trust accounts and settlements are NOT in the API and are explicitly excluded from the agent surface.
- Invoices, client balances, billing codes and custom fields are read-only.
- Every entity except users has a DELETE, but no retention window, soft-delete or restore path is
  published — deletion should be treated as permanent.

## MCP

- Remote MCP server: https://api.leanlaw.io/mcp (use the URL exactly; a trailing slash fails)
- Status: private beta, enabled per firm on request via support@myleanlaw.com, then authorized per user
- Auth: OAuth 2.1 authorization code + PKCE against https://auth.myleanlaw.co/
- Scopes: read/write for clients, matters, time-entries, expenses, fixed-fees; read-only for invoices,
  balances, codes; plus read:*, write:*, offline_access, openid
- Claude Code: `claude mcp add --transport http leanlaw https://api.leanlaw.io/mcp`

## Documentation

- Developer portal: https://platform.leanlaw.io/start
- API reference: https://platform.leanlaw.io/api
- Authentication: https://platform.leanlaw.io/auth
- Request/response patterns: https://platform.leanlaw.io/patterns
- Concepts: https://platform.leanlaw.io/concepts
- OpenAPI: https://platform.leanlaw.io/openapi
- Agents / MCP: https://platform.leanlaw.io/agents
- Changelog: https://platform.leanlaw.io/changelog
- Support: https://support.leanlaw.co/
- Status: https://leanlaw.statuspage.io/

## Company

- Website: https://www.leanlaw.co/
- Pricing: https://www.leanlaw.co/pricing/ (Core $55/user/mo, Pro $75/user/mo, Contingency and Elite
  custom; 14-day trial, no card. No tier states whether API access is included.)
- Terms: https://www.leanlaw.co/terms/
- Privacy: https://www.leanlaw.co/privacy/
- SLA: https://www.leanlaw.co/service-level-agreement/
- GitHub: https://github.com/leanlaw
- Note: leanlaw.com is a DIFFERENT company (Lean Law Ventures). LeanLaw is leanlaw.co.

## Known gaps

- No SDK on any package registry; no llms.txt; no security.txt; no api-catalog
- No published rate limits and no rate-limit response headers
- No idempotency mechanism
- No 4xx/5xx responses in the OpenAPI and no error body schema
- No deprecation or sunset policy; no Sunset/Deprecation headers
- No published SOC 2 / ISO 27001 / HIPAA attestation or trust center
- Status page has no API or MCP component