REST API
Authentication
Authenticate every request with an API key.
Send your key in the x-api-key header on every request:
curl "https://api.q4.sa/v1/companies/2222" \
-H "x-api-key: q4_live_8Jx2kQ4mN7pR1sT5vW9yZ3bC6dF0gH"The base URL is https://api.q4.sa/v1. Requests must use HTTPS.
Keys
- Live keys start with
q4_live_. Test keys start withq4_test_, return the same data, and share the account's daily quota. - Keys don't expire. Revoke one from your dashboard if it leaks; it stops working within a minute.
- Your plan sets how many keys you can create. Use one per app or environment so you can revoke them separately.
Keep keys on your server. Never ship them in a mobile app or browser code.
Errors
| Status | Code | Meaning |
|---|---|---|
| 401 | AUTH_REQUIRED | No x-api-key header. |
| 401 | INVALID_API_KEY | The key is wrong or revoked. |
| 403 | PLAN_LIMIT | Your plan doesn't include this endpoint or option. |
Versioning
The version is in the path (/v1). Within a version we only add things: new endpoints, new optional parameters and new response fields. Write your client to ignore fields it doesn't know. Breaking changes ship as /v2, with at least 12 months' notice for /v1.