API Reference

Webhooks

Register HTTPS endpoints to receive real-time events — meeting published, action completed, decision recorded, and more. Payloads are HMAC-SHA256 signed.

Base URL: https://quorate.app/api/v1

POST/webhooksscope: meetings:write

Register a webhook endpoint (max 5 active per organisation).

JSON body `{ "url": "https://…", "events": ["meeting.created", …], "description"?: "…" }`. The response includes a one-time `secret` used to verify HMAC signatures.

curl -X POST -H "Authorization: Bearer qrt_xxxxxxxxxxxxxxxx" \
     -H "Content-Type: application/json" \
     -d '{"url":"https://example.com/hook","events":["meeting.created"]}' \
     https://quorate.app/api/v1/webhooks

Available events

Subscribe to any subset of the events below. Each event is delivered as a JSON POST with headers X-Quorate-Signature (HMAC-SHA256 hex digest of the body, computed with the secret returned at registration), X-Quorate-Event, and X-Quorate-Delivery.

  • meeting.created
  • meeting.updated
  • meeting.cancelled
  • agenda.published
  • agenda.supplementary
  • pack.generated
  • minutes.published
  • minutes.approved
  • decision.created
  • decision.status_changed
  • action.created
  • action.completed
  • action.overdue
  • document.uploaded
  • document.published
  • planning.received
  • planning.responded
  • correspondence.received
  • member.added
  • member.removed

Verifying signatures (Node)

import { createHmac, timingSafeEqual } from 'node:crypto';

function verify(rawBody, signatureHeader, secret) {
  const expected = createHmac('sha256', secret).update(rawBody).digest('hex');
  const a = Buffer.from(expected, 'hex');
  const b = Buffer.from(signatureHeader, 'hex');
  return a.length === b.length && timingSafeEqual(a, b);
}

Reject any request where the signature doesn't match. Quorate retries delivery with a 1-minute, 5-minute, then 30-minute backoff; endpoints that fail 10 times in a row are disabled automatically and you'll receive an email.

More