quipteams REST API

Authentication

Every request is authenticated with an API key sent as a bearer token. Keys are issued by the quipteams team and are scoped to a single company. Live keys are prefixed qt_live_ and sandbox keys qt_sandbox_ (see Sandbox). Treat a key like a password - never expose it in client-side code.

curl https://app.quipteams.com/api/v1/quotes \
  -H "Authorization: Bearer qt_live_your_api_key"

Each key carries a set of scopes. An endpoint returns 403 FORBIDDEN if the key is missing the scope it requires.

Sandbox

Sandbox keys (qt_sandbox_) run against an isolated copy of your workspace, pre-seeded with realistic demo data: quotes, assets, device actions, employees, kits, roles, offices, and scheduling links. Every endpoint behaves exactly like production and uses the same base URL - only the key decides which world you are in. Writes persist until the sandbox is reset. Create sandbox keys (and reset the data) from the API tab of the admin panel; your first sandbox key provisions the sandbox automatically.

curl https://app.quipteams.com/api/v1/quotes \
  -H "Authorization: Bearer qt_sandbox_your_api_key"

What happens on a sandbox write:

• Quotes and device actions go through the real operational pipeline - a task appears on our staging boards (prefixed [SANDBOX]) just like a production order would.
• Webhook endpoints registered with a sandbox key receive real, signed deliveries for sandbox events - the recommended way to develop and test your integration.
• No emails or Slack messages are ever sent from sandbox activity.

Two behaviors differ from production by design. Status transitions in the sandbox are driven by the API itself (for example accepting or rejecting a quote item) - operational updates that normally come from our logistics team are not simulated. And because sandbox stock is not linked to the purchasing catalogue, POST /v1/equip always resolves to mode: "quoted" rather than assigning a stored device.

Rate limiting

Two sliding windows apply to every request: a per-IP limit of 60 requests/minute and a per-key limit (default 60 requests/minute). Some write endpoints set a tighter per-key limit. Every response includes x-ratelimit-limit, x-ratelimit-remaining, and x-ratelimit-reset; a 429 also includes retry-after (seconds).

Pagination & limits

List endpoints return a data array and a meta object, and paginate with keyset cursors: meta.has_more says whether another page exists, meta.next_cursor is an opaque cursor to pass back as ?cursor=, and meta.total is the total row count for the current filters (null when unknown). limit defaults to 25 (max 100). Sortable lists take sort with a - prefix for descending (e.g. -created_at); a field outside the endpoint's allowlist returns 400 VALIDATION_ERROR. GET /products is the exception - it is unpaginated and its meta carries available_filters instead.

{
  "data": [ /* ... */ ],
  "meta": { "has_more": true, "next_cursor": "eyJpZCI6Ii4uLiJ9", "total": 42 }
}

Errors

Errors use conventional HTTP status codes and a consistent body. The error.code is a stable string you can branch on; error.details carries structured context and is present only when set.

{
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "items must be a non-empty array"
  }
}

Webhook signatures

Register endpoints with the Webhooks API. When an event fires, quipteams POSTs a JSON body { id, type, created_at, data } to your URL with these headers: X-Quip-Event, X-Quip-Delivery-Id, and X-Quip-Signature. The signature is sha256=<hex>, an HMAC-SHA256 of the raw request body keyed on the endpoint's whsec_ secret (returned once, when you create the endpoint). Verify it before trusting a payload.

import { createHmac, timingSafeEqual } from 'crypto'

function verify(rawBody: string, header: string, secret: string): boolean {
  const expected = 'sha256=' + createHmac('sha256', secret).update(rawBody).digest('hex')
  const a = Buffer.from(expected)
  const b = Buffer.from(header)
  return a.length === b.length && timingSafeEqual(a, b)
}

You can subscribe to any of these events, or a wildcard:

Resources