API reference

QuorateAPI

A REST API over your Quorate data. Build dashboards, integrations with finance systems, custom public portals, or anything else that benefits from programmatic access. JSON request and response bodies, HTTPS only, scoped API keys, signed webhook deliveries.
Ask about API accessSee pricing

API and webhooks on request; enabled per organisation.

Machine-readable spec

The complete OpenAPI 3.0 schema. Import it into Postman, Insomnia, openapi-generator, or any SDK toolchain. Versioned alongside the API.

openapi.json →
§01

Authentication

Every request must carry a Bearer token in the Authorization header. API keys are issued in the officer portal under Settings → API and are shown once at creation time. Copy them somewhere safe immediately. Keys start with the qrt_ prefix and are stored as SHA-256 hashes on our side; we cannot recover a lost key, only revoke and re-issue.

Each key carries a list of scopes: fine-grained read/write permissions per domain. Confidential (Part 2) documents require the elevated documents:read:confidential scope; without it the endpoint returns 404 on confidential rows so existence isn't leaked to non-cleared callers.

curl -H "Authorization: Bearer qrt_xxxxxxxxxxxxxxxx" \
     https://quorate.app/api/v1/meetings
§02

Rate limits

Two limits apply. Whichever trips first returns HTTP 429 with a Retry-After header and an x-ratelimit-* set.

  • Per IP: 300 requests per 60 seconds (proxy layer, covers everything under /api/).
  • Per key: 1,000 requests per 1 hour (application layer; aggregated across all IPs that use the same key).

If you have a use case that needs higher limits (overnight bulk export, replication into a warehouse, etc.) please get in touch. We lift caps on a per-tenant basis rather than charging for them.

§03

Available endpoints

Grouped by domain. Click through for request/response shapes, scope requirements, and per-endpoint examples. The full machine-readable schema is at https://quorate.app/api/v1/openapi.json.

Meetings

Read meeting metadata, agendas, and published minutes for any committee in your organisation.

3 endpoints · reference →

Decisions

Read the resolution log — every motion carried, including resolution number, text, and implementation status.

1 endpoint · reference →

Actions

Read and update the action log — items assigned at meetings, deadlines, and completion status.

2 endpoints · reference →

Members

Read the member directory — councillors, governors, trustees, or directors with their roles and wards.

1 endpoint · reference →

Documents

Read document metadata and obtain time-limited download URLs for files in S3.

1 endpoint · reference →

Calendar

Subscribe to an iCalendar (ICS) feed of public-facing meetings — drop the URL into Outlook, Google Calendar, or Apple Calendar.

1 endpoint · reference →

Webhooks

Register HTTPS endpoints to receive real-time events — meeting published, action completed, decision recorded, and more. Payloads are HMAC-SHA256 signed.

1 endpoint · reference →

§04

Webhooks

Register an HTTPS endpoint and Quorate will POST a JSON event to it whenever something relevant happens: a new meeting is created, minutes are published, an action is completed, and so on. Every payload is signed with HMAC-SHA256; the signature lives in the X-Quorate-Signature header and the secret is returned once at endpoint creation. Failed deliveries are retried up to 3 times (1 min, 5 min, 30 min); endpoints that fail 10 times consecutively are auto-disabled.

Available events

See /docs/api/webhooks for registration, signature verification, and a worked example.

§05

Code example (Node)

const res = await fetch('https://quorate.app/api/v1/meetings', {
  headers: { Authorization: `Bearer ${process.env.QUORATE_API_KEY}` },
});
if (!res.ok) throw new Error(`API error ${res.status}`);
const { data, page, limit } = await res.json();

Integrations

Need a feature that isn't here?

The v1 surface is the read-and-update path most integrators ask for. If you have a use case that needs more, such as bulk imports, write paths into other domains, OAuth or an SDK in your language, tell us.

Contact usSee pricing