As most people suggested, using the PHP SDK is going to be the easier way for integrating QuickBooks Online with PHP: https://github.com/intuit/QuickBooks-V3-PHP-SDK
However, using plain PHP cURL is also possible, but a few concepts you need to understand before making the API call:
1) OAuth 1.0 protocol
It is what most developer get confused of. QuickBooks Online use OAuth 1.0 as authorization protocol. You need to spend sometime to understand how it worked. For documentation, you can read it here: https://developer.intuit.com/docs/0100_quickbooks_online/0100_essentials/000500_authentication_and_authorization/connect_from_within_your_app
However, I suggest you play with the OAuth playground, it gives you a feeling for how it looked like when you implement it: https://appcenter.intuit.com/Playground/OAuth/IA/ (fill your Consumer key and secrets, click on Connect to Quickbooks Button)
During the process, it will return something called: RealmID. That is the companyid in QBO, put it on the URL.
2) The base URL
When you create an app at developer.intuit.com, under keys tab, you will see Development Keys and Production Keys. The corresponding keys at the right side is what you need to fill for the {baseurl} part(For example, besides development keys, there is place called "Accounting Sandbox Url" : "sandbox-quickbooks.api.intuit.com"). For each API entity endpoint, refer to the documentation: https://developer.intuit.com/docs/api/accounting/customer
3) Authorization header
You are unlikely to implement it by yourself for OAuth 1.0. Twitter has a good link for how to use the Access Token and Access Token secrets from step 1) to generate signature: https://dev.twitter.com/oauth/overview/creating-signatures
You will put the signature as part of the authorization header.
If you are using POSTMAN, they have OAuth 1.0 as authorization protocol available for you. Here is an example
<?php
$curl = curl_init();
curl_setopt_array($curl, array(
CURLOPT_URL => "https://sandbox-quickbooks.api.intuit.com/v3/company/193514340994122/account/1",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => array(
"authorization: OAuth oauth_consumer_key=\"qyprdDjYtPpiEpbwFQZuUoAjubpVqm\",oauth_token=\"lvprdfblXv4LqNVhIv2WH2JebiSZgNs9POiEoCJxMwEhqbgc\",oauth_signature_method=\"HMAC-SHA1\",oauth_timestamp=\"1494441064\",oauth_nonce=\"cfh0b7\",oauth_version=\"1.0\",oauth_signature=\"KqpN9ximPGWnWJBaXg1Vs9urJLY%3D\"",
"cache-control: no-cache",
"postman-token: 7c570691-c6cd-a706-67a0-984c5ddb1e6a"
),
));
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}