Documentation

API reference

Authentication, the endpoints that exist today, and the error responses you should expect.

This reference covers two endpoints, because two endpoints exist. It will grow with the product rather than ahead of it.

Base address

All requestshttp

https://app.quberoute.com/api/v1

Authentication

A bearer token in the Authorization header. Keys look like qr_sk_live_… or qr_sk_test_… — the environment is in the key itself, so one pasted into the wrong configuration is obvious on sight, and a live key committed to a public repository is recognisable to automated scanners.

Every requestbash

curl https://app.quberoute.com/api/v1/app \
  -H "Authorization: Bearer qr_sk_live_YOUR_KEY"

A key belongs to one app and one environment and cannot be moved between them. The server reads both from the key row it just authenticated, never from the request — which is why the endpoint below takes no parameters at all.

Revocation takes effect on the very next request. Nothing is cached anywhere: not in memory, not in a session, not at the edge.

GET /api/v1/app

Returns the app the presented key belongs to.

Request and responsebash

curl https://app.quberoute.com/api/v1/app \
  -H "Authorization: Bearer qr_sk_live_YOUR_KEY"

200 OK
{
  "app": {
    "id": "0d6f1a3c-2f4b-4c8e-9a1d-7b2c6e5f0a11",
    "name": "Northwind Retail",
    "subdomainKey": "71k8c",
    "linkHost": "71k8c.qbrt.app"
  },
  "environment": "live"
}

GET /api/v1/apps/{appId}

The same data, addressed by identifier. It exists mainly to make the isolation rule explicit and testable: the identifier in the path is compared against the one on your key, and anything else is a 404.

Asking for an app that is not yoursbash

curl https://app.quberoute.com/api/v1/apps/SOMEONE_ELSES_ID \
  -H "Authorization: Bearer qr_sk_live_YOUR_KEY"

404 Not Found
{ "error": "not_found" }

404, not 403. “Forbidden” would confirm the app exists and belongs to somebody, which is enough to work out who our customers are. “Not found” says nothing.

Errors

401 — the key is missing, malformed, unknown or revoked. All four give the same answer, deliberately.
404 — the thing does not exist, or it is not yours. These are the same response, deliberately.

There is no rate limit on API key use today. There is one on key creation, and on everything in the dashboard.

Versioning

The version is in the path. v1 is the only version and it is not stable yet — the product is early, and pretending otherwise would be a promise we would have to break. Breaking changes will be in the changelog before they ship.

Not built yet. There is no endpoint for creating or listing links, because links are not built yet. That is the next thing, and it is the reason this reference is short.

Ask the documentation

It answers from these pages only, and links what it used. If the answer is not here it says so rather than guessing — then email [email protected].

← All documentation