API reference

Webhooks

Register HTTPS endpoints to receive real-time events — meeting published, action completed, decision recorded, and more. Payloads are HMAC-SHA256 signed.Base URL: https://quorate.app/api/v1

API and webhooks on request; enabled per organisation.

§01

Endpoints

POST

/webhooks

scope: meetings:write

Register a webhook endpoint (max 5 active per organisation).

JSON body `{ "url": "https://…", "events": ["meeting.created", …], "description"?: "…" }`. The response includes a one-time `signingSecret` used to verify HMAC signatures.

curl -X POST -H "Authorization: Bearer qrt_xxxxxxxxxxxxxxxx" \
     -H "Content-Type: application/json" \
     -d '{"url":"https://example.com/hook","events":["meeting.created"]}' \
     https://quorate.app/api/v1/webhooks
§02

Available events

Subscribe to any subset of the events below. Each event is delivered as a JSON POST with headers X-Quorate-Signature (HMAC-SHA256 hex digest of the body, computed with the secret returned at registration), X-Quorate-Event, and X-Quorate-Delivery.

Verifying signatures (Node)

import { createHmac, timingSafeEqual } from 'node:crypto';

function verify(rawBody, signatureHeader, secret) {
  const expected = createHmac('sha256', secret).update(rawBody).digest('hex');
  const a = Buffer.from(expected, 'hex');
  const b = Buffer.from(signatureHeader, 'hex');
  return a.length === b.length && timingSafeEqual(a, b);
}

Reject any request where the signature doesn't match. Quorate retries delivery with a 1-minute then 5-minute backoff (three total attempts); endpoints that fail 10 times in a row are disabled automatically and you'll receive an email.

§03

More