Quorate API

Authentication

Every request must carry a Bearer token in the Authorization header. API keys are issued in the officer portal under Settings → API and are shown once at creation time — copy them somewhere safe immediately. Keys start with the qrt_ prefix and are stored as SHA-256 hashes on our side; we cannot recover a lost key, only revoke and re-issue.

Each key carries a list of scopes — fine-grained read/write permissions per domain. Confidential (Part 2) documents require the elevated documents:read:confidentialscope; without it the endpoint returns 404 on confidential rows so existence isn't leaked to non-cleared callers.

curl -H "Authorization: Bearer qrt_xxxxxxxxxxxxxxxx" \
     https://quorate.app/api/v1/meetings

Rate limits

Two limits apply. Whichever trips first returns HTTP 429 with a Retry-After header and an x-ratelimit-* set.

• Per IP: 300 requests per 60 seconds (proxy layer, covers everything under /api/).
• Per key: 1,000 requests per 1 hour (application layer; aggregated across all IPs that use the same key).

If you have a use case that needs higher limits (overnight bulk export, replication into a warehouse, etc.) please get in touch — we lift caps on a per-tenant basis rather than charging for them.

Available endpoints

Grouped by domain. Click through for request/response shapes, scope requirements, and per-endpoint examples. The full machine-readable schema is at https://quorate.app/api/v1/openapi.json.

Webhooks

Register an HTTPS endpoint and Quorate will POST a JSON event to it whenever something relevant happens — a new meeting is created, minutes are published, an action is completed, and so on. Every payload is signed with HMAC-SHA256; the signature lives in the X-Quorate-Signature header and the secret is returned once at endpoint creation. Failed deliveries are retried up to 3 times (1 min, 5 min, 30 min); endpoints that fail 10 times consecutively are auto-disabled.

Available events

• meeting.created
• meeting.updated
• meeting.cancelled
• agenda.published
• agenda.supplementary
• pack.generated
• minutes.published
• minutes.approved
• decision.created
• decision.status_changed
• action.created
• action.completed
• action.overdue
• document.uploaded
• document.published
• planning.received
• planning.responded
• correspondence.received
• member.added
• member.removed

See /docs/api/webhooks for registration, signature verification, and a worked example.

Code example (Node)

const res = await fetch('https://quorate.app/api/v1/meetings', {
  headers: { Authorization: `Bearer ${process.env.QUORATE_API_KEY}` },
});
if (!res.ok) throw new Error(`API error ${res.status}`);
const { data, page, limit } = await res.json();