API reference

Get started

There are two ways in, depending on what you want to do.

Connect your own system

Most /api/v1 requests need two things: your Client ID as the client_id query parameter, and an access token in the Authorization: Bearer header. A token belongs to one company. These steps get you both.

1. Check you have access

   The API needs the API & Zapier add-on on your company, and you need access to your organisation’s settings. Open the API dashboard to check. If the add-on is missing, that page shows the pricing and a button to turn it on. Without it, requests return a 403 with addon_required.

2. Create an OAuth client

   In the API dashboard, choose Manage Integrations, open the OAuth Clients tab and choose New OAuth client. See each step with pictures. Fill in:

   Name

   A name you’ll recognise, such as the system you’re connecting.
   Redirect URIs

   The page in your system that people return to after allowing access. Step 3 has to send exactly the same address.
   Scopes

   What the connection is allowed to do. They’re all on to start with, so turn off what you don’t need. See what each one does.

   When you save, you get two values:

   Client ID

   Public. It goes on every request as client_id.
   Client Secret

   Private. Only use it from your server.

   Just testing from Postman or a script? Open the API Testing tab instead and choose Generate Credentials. You get a Client ID and an access token that work for 24 hours, so you can skip to step 5.

3. Ask for access

   Send the person connecting their account to this address in their browser:

   Browser addressCopy

   https://app.quote.cloud/api/oauth/authorize?response_type=code&client_id=<your client id>&redirect_uri=https://yourapp.example.com/callback&state=<random value>

   They sign in if they need to, choose a company and press Allow access. The company needs an active plan or a current trial. For state, use any random value and check it matches when they come back.

   QuoteCloud then returns them to your redirect URI with code and state added to the address. If they cancel, you get error=access_denied instead.

   Clients with no secret, such as mobile apps, must also send code_challenge and code_challenge_method=S256. Authorize OAuth client has every option.

4. Swap the code for a token

   Do this from your server, because it includes your client secret:

   TerminalCopy

   curl -X POST https://app.quote.cloud/api/oauth/accessToken \
     -d grant_type=authorization_code \
     -d code=<code from the redirect> \
     -d redirect_uri=https://yourapp.example.com/callback \
     -d client_id=<your client id> \
     -d client_secret=<your client secret>

   The response includes access_token, refresh_token and expires_in, which is how many seconds the access token lasts. Save all three.

5. Make your first request

   Put the access token in the header and your Client ID in the query string. 1234 is a document number from your account. Here’s where to find it.

   TerminalCopy

   curl "https://app.quote.cloud/api/v1/getDocumentStatus?client_id=<your client id>&document_id=1234" \
     -H "Authorization: Bearer <access token>"

6. Keep the connection going

   Before expires_in runs out, use the refresh token to get a new access token. You get a new refresh token each time, so save that as well.

   TerminalCopy

   curl -X POST https://app.quote.cloud/api/oauth/accessToken \
     -d grant_type=refresh_token \
     -d refresh_token=<refresh token> \
     -d client_id=<your client id> \
     -d client_secret=<your client secret>

Where to find IDs

Requests often ask for the ID of something in your account. Here’s where each one comes from.

Rate limits

120 requests a minute per company, shared across REST, Zapier and MCP.

On a 429, wait for the number of seconds in Retry-After before trying again. Your Zapier and other integrations draw on the same limit, so a busy Zap can leave less for you.

Scopes

Endpoints