Skip to main content

Authentication

Send Authorization: Bearer <key> on every request. Keys start with qk_. A missing or invalid key returns HTTP 401 with error code unauthorized or invalid_key.

Response envelope

Every response, success or error, has the same shape:
All field names are snake_case. Unknown fields in requests are rejected.

Identifiers and references

References are opaque. Do not parse them; store them and pass them back. A property_ref is present only when the entity is a tax account that the property reader supports; it always equals the entity_ref. Decide by the presence of property_ref, not by the prefix.

Idempotency

Send a unique Idempotency-Key header (1–256 characters) on every request, including GETs. The key identifies one logical request: The API does not return the original response on replay, and a lost response cannot be recovered through the key. Use a new key for new work and keep responses you need. Retention: a completed request’s key is blocked for as long as the account exists; there is no expiry. A key whose request failed and was not charged is released and may be reused.

Pagination

get_catalog, traverse_relationships and search_properties return meta.next_cursor when more results exist. Pass it back as cursor (query parameter for GET, body field for POST) with the same other parameters. Cursors are signed, bound to your account and to the request they came from, and expire after 15 minutes. If the published data changes between pages, the next request returns HTTP 409 cursor_generation_changed; restart without a cursor.

Limits

Billing headers

Successful responses include your account position after the call: You are charged only when a paid operation completes with status ok or partial. Invalid requests, refused requests and Quoin-side failures are free. When welcome credit cannot cover a call and no card is saved, you receive HTTP 402 insufficient_balance. Suspended accounts cannot make calls.