Account & provisioning
Sign up, get an API key, set your webhook URL, go live. Dashboard session, not your API key.
These calls use your dashboard session, not your API key. Your application
does not call them. You call them once, while setting QuotaStack up.
You will normally do all of this in the
dashboard. The calls are written down here
so you can automate the setup instead, if you would rather.
Nine of them are yours. Sign up, confirm your email, make and revoke API keys,
read and change your tenant settings, and rotate your
webhook signing secret.
Five of them belong to QuotaStack. Those approve, refuse, or pause your access
to the live environment. Your key cannot call
them, whatever it holds.
Every other page in this reference is the product API, which your application
does call, with your API key.
0 of 14 operations documented in full.
Start public self-serve signup.
POST/v1/admin/auth/signup
| Idempotency-Key | Required. Returns 422 without it. |
|---|
| Environment | Sandbox and Live |
|---|
| Auth | Dashboard session |
|---|
| Fires | No webhooks. |
|---|
Header parameters
| Field | Type | Meaning |
|---|
Idempotency-Keyrequired | string | Required idempotency key for this mutating admin/public operation. Reusing the same key with a different body returns 409 Conflict; successful 2xx and client 4xx responses are cached for 24 hours. |
Body parameters
| Field | Type | Meaning |
|---|
namerequired | string | |
emailrequired | string (email) | |
passwordrequired | string | |
company_namerequired | string | |
captcha_tokenoptional | string | |
Response fields
| Field | Type | Meaning |
|---|
messagerequired | string | |
Errors
400 — Malformed request. 409 — State conflict (e.g., duplicate resource, stale version). 422 — Request shape was valid but field validation failed.
Verify signup email and create an admin session.
POST/v1/admin/auth/verify-email
| Idempotency-Key | Not required for this operation. |
|---|
| Environment | Sandbox and Live |
|---|
| Auth | Dashboard session |
|---|
| Fires | No webhooks. |
|---|
Body parameters
| Field | Type | Meaning |
|---|
tokenrequired | string | |
Response fields
| Field | Type | Meaning |
|---|
userrequired | object | |
tenantrequired | object | |
tokenrequired | string | |
Resend signup email verification when available.
POST/v1/admin/auth/resend-verification
| Idempotency-Key | Required. Returns 422 without it. |
|---|
| Environment | Sandbox and Live |
|---|
| Auth | Dashboard session |
|---|
| Fires | No webhooks. |
|---|
Header parameters
| Field | Type | Meaning |
|---|
Idempotency-Keyrequired | string | Required idempotency key for this mutating admin/public operation. Reusing the same key with a different body returns 409 Conflict; successful 2xx and client 4xx responses are cached for 24 hours. |
Body parameters
| Field | Type | Meaning |
|---|
emailrequired | string (email) | |
Response fields
| Field | Type | Meaning |
|---|
messagerequired | string | |
Errors
409 — State conflict (e.g., duplicate resource, stale version). 422 — Request shape was valid but field validation failed.
List the tenant's API keys.
GET/v1/admin/api-keys
| Idempotency-Key | Not used. This is a read. |
|---|
| Environment | Sandbox and Live |
|---|
| Auth | Dashboard session |
|---|
| Fires | No webhooks. |
|---|
Response fields
| Field | Type | Meaning |
|---|
dataoptional | array | |
Errors
401 — Missing or invalid authentication.
Create a tenant API key from the admin dashboard.
POST/v1/admin/api-keys
| Idempotency-Key | Required. Returns 422 without it. |
|---|
| Environment | Sandbox and Live |
|---|
| Auth | Dashboard session |
|---|
| Fires | No webhooks. |
|---|
Header parameters
| Field | Type | Meaning |
|---|
Idempotency-Keyrequired | string | Required idempotency key for this mutating admin/public operation. Reusing the same key with a different body returns 409 Conflict; successful 2xx and client 4xx responses are cached for 24 hours. |
Body parameters
| Field | Type | Meaning |
|---|
environmentrequired | string | Which environment this resource lives in. Determined by the API key prefix used (qs_live_… → live, qs_test_… → sandbox). |
nameoptional | string | |
scopesoptional | array | |
Response fields
| Field | Type | Meaning |
|---|
idoptional | string (uuid) | |
tenant_idoptional | string (uuid) | |
environmentoptional | string | Which environment this resource lives in. Determined by the API key prefix used (qs_live_… → live, qs_test_… → sandbox). |
key_prefixoptional | string | |
nameoptional | string | |
scopesoptional | array | |
created_atoptional | string (date-time) | |
keyoptional | string | |
Errors
403 — Authenticated but not permitted (insufficient scope). 409 — State conflict (e.g., duplicate resource, stale version). 422 — Request shape was valid but field validation failed.
Revoke a tenant API key from the admin dashboard.
POST/v1/admin/api-keys/{id}/revoke
| Idempotency-Key | Required. Returns 422 without it. |
|---|
| Environment | Sandbox and Live |
|---|
| Auth | Dashboard session |
|---|
| Fires | No webhooks. |
|---|
Header parameters
| Field | Type | Meaning |
|---|
Idempotency-Keyrequired | string | Required idempotency key for this mutating admin/public operation. Reusing the same key with a different body returns 409 Conflict; successful 2xx and client 4xx responses are cached for 24 hours. |
Path parameters
| Field | Type | Meaning |
|---|
idrequired | string (uuid) | |
Errors
403 — Authenticated but not permitted (insufficient scope). 404 — Resource not found. 409 — State conflict (e.g., duplicate resource, stale version). 422 — Request shape was valid but field validation failed.
Read the tenant's configuration.
GET/v1/admin/tenants/{tenant_id}/config
| Idempotency-Key | Not used. This is a read. |
|---|
| Environment | Sandbox and Live |
|---|
| Auth | Dashboard session |
|---|
| Fires | No webhooks. |
|---|
Path parameters
| Field | Type | Meaning |
|---|
tenant_idrequired | string (uuid) | |
Response fields
| Field | Type | Meaning |
|---|
tenant_idoptional | string (uuid) | |
webhook_urloptional | string | |
webhook_secret_setoptional | boolean | True when a webhook signing secret exists for this tenant. The secret itself is never returned here. To get a secret, call POST /v1/admin/tenants/{tenant_id}/webhook-secret/rotate. That endpoint returns the new secret one time. |
overage_policyoptional | string | |
default_currencyoptional | string | |
timezoneoptional | string | |
data_regionoptional | string | |
low_balance_threshold_mcoptional | integer (int64)0–∞ | Default threshold (millicredits) for credit.low_balance webhooks. 0 (default) disables low_balance for customers that inherit this value. Per-customer override via Customer.low_balance_threshold_mc. credit.exhausted is always on and ignores this field. |
credit_expiring_soon_hoursoptional | integer0–8760 | Lead time in hours for credit.expiring_soon webhooks (per credit block). 0 (default) disables the alert. Recommended: 72 for packs / annual grants. Maximum: 8760 (1 year). No per-customer override in Phase 1. |
updated_atoptional | string (date-time) | |
Errors
401 — Missing or invalid authentication. 403 — Authenticated but not permitted (insufficient scope). 404 — Resource not found.
Update the tenant's configuration (partial).
PATCH/v1/admin/tenants/{tenant_id}/config
| Idempotency-Key | Required. Returns 422 without it. |
|---|
| Environment | Sandbox and Live |
|---|
| Auth | Dashboard session |
|---|
| Fires | No webhooks. |
|---|
Header parameters
| Field | Type | Meaning |
|---|
Idempotency-Keyrequired | string | Required idempotency key for this mutating admin/public operation. Reusing the same key with a different body returns 409 Conflict; successful 2xx and client 4xx responses are cached for 24 hours. |
Path parameters
| Field | Type | Meaning |
|---|
tenant_idrequired | string (uuid) | |
Body parameters
| Field | Type | Meaning |
|---|
webhook_urloptional | string | |
overage_policyoptional | string | |
default_currencyoptional | string | |
timezoneoptional | string | |
low_balance_threshold_mcoptional | integer (int64)0–∞ | Millicredits. 0 = low_balance alerts off (default). |
credit_expiring_soon_hoursoptional | integer0–8760 | Hours before expires_at to emit credit.expiring_soon (0 = off). Recommended: 72. Maximum: 8760 (1 year). |
Response fields
| Field | Type | Meaning |
|---|
tenant_idoptional | string (uuid) | |
webhook_urloptional | string | |
webhook_secret_setoptional | boolean | True when a webhook signing secret exists for this tenant. The secret itself is never returned here. To get a secret, call POST /v1/admin/tenants/{tenant_id}/webhook-secret/rotate. That endpoint returns the new secret one time. |
overage_policyoptional | string | |
default_currencyoptional | string | |
timezoneoptional | string | |
data_regionoptional | string | |
low_balance_threshold_mcoptional | integer (int64)0–∞ | Default threshold (millicredits) for credit.low_balance webhooks. 0 (default) disables low_balance for customers that inherit this value. Per-customer override via Customer.low_balance_threshold_mc. credit.exhausted is always on and ignores this field. |
credit_expiring_soon_hoursoptional | integer0–8760 | Lead time in hours for credit.expiring_soon webhooks (per credit block). 0 (default) disables the alert. Recommended: 72 for packs / annual grants. Maximum: 8760 (1 year). No per-customer override in Phase 1. |
updated_atoptional | string (date-time) | |
Errors
401 — Missing or invalid authentication. 403 — Authenticated but not permitted (insufficient scope). 404 — Resource not found. 409 — State conflict (e.g., duplicate resource, stale version). 422 — Request shape was valid but field validation failed.
Rotate the tenant's webhook signing secret.
POST/v1/admin/tenants/{tenant_id}/webhook-secret/rotate
| Idempotency-Key | Required. Returns 422 without it. |
|---|
| Environment | Sandbox and Live |
|---|
| Auth | Dashboard session |
|---|
| Fires | No webhooks. |
|---|
Header parameters
| Field | Type | Meaning |
|---|
Idempotency-Keyrequired | string | Required idempotency key for this mutating admin/public operation. Reusing the same key with a different body returns 409 Conflict; successful 2xx and client 4xx responses are cached for 24 hours. |
Path parameters
| Field | Type | Meaning |
|---|
tenant_idrequired | string (uuid) | |
Response fields
| Field | Type | Meaning |
|---|
webhook_secretrequired | string | New base64 signing secret. Store it now — it is not shown again. |
Errors
401 — Missing or invalid authentication. 403 — Authenticated but not permitted (insufficient scope). 404 — Resource not found. 409 — State conflict (e.g., duplicate resource, stale version). 422 — Request shape was valid but field validation failed.
Approve live access for a tenant.
POST/v1/tenants/{id}/live-access/approve
| Idempotency-Key | Required. Returns 422 without it. |
|---|
| Environment | Sandbox and Live |
|---|
| Auth | Dashboard session |
|---|
| Fires | No webhooks. |
|---|
Header parameters
| Field | Type | Meaning |
|---|
Idempotency-Keyrequired | string | Required idempotency key for this mutating admin/public operation. Reusing the same key with a different body returns 409 Conflict; successful 2xx and client 4xx responses are cached for 24 hours. |
Path parameters
| Field | Type | Meaning |
|---|
idrequired | string (uuid) | |
Response fields
| Field | Type | Meaning |
|---|
tenant_idrequired | string (uuid) | |
live_access_statusrequired | string | |
reviewed_atoptional | string (date-time) | |
Errors
403 — Authenticated but not permitted (insufficient scope). 404 — Resource not found. 409 — State conflict (e.g., duplicate resource, stale version).
Reject live access for a tenant.
POST/v1/tenants/{id}/live-access/reject
| Idempotency-Key | Required. Returns 422 without it. |
|---|
| Environment | Sandbox and Live |
|---|
| Auth | Dashboard session |
|---|
| Fires | No webhooks. |
|---|
Header parameters
| Field | Type | Meaning |
|---|
Idempotency-Keyrequired | string | Required idempotency key for this mutating admin/public operation. Reusing the same key with a different body returns 409 Conflict; successful 2xx and client 4xx responses are cached for 24 hours. |
Path parameters
| Field | Type | Meaning |
|---|
idrequired | string (uuid) | |
Body parameters
| Field | Type | Meaning |
|---|
reasonrequired | string | |
Response fields
| Field | Type | Meaning |
|---|
tenant_idrequired | string (uuid) | |
live_access_statusrequired | string | |
Errors
403 — Authenticated but not permitted (insufficient scope). 404 — Resource not found. 409 — State conflict (e.g., duplicate resource, stale version).
Suspend live access for a tenant.
POST/v1/tenants/{id}/live-access/suspend
| Idempotency-Key | Required. Returns 422 without it. |
|---|
| Environment | Sandbox and Live |
|---|
| Auth | Dashboard session |
|---|
| Fires | No webhooks. |
|---|
Header parameters
| Field | Type | Meaning |
|---|
Idempotency-Keyrequired | string | Required idempotency key for this mutating admin/public operation. Reusing the same key with a different body returns 409 Conflict; successful 2xx and client 4xx responses are cached for 24 hours. |
Path parameters
| Field | Type | Meaning |
|---|
idrequired | string (uuid) | |
Body parameters
| Field | Type | Meaning |
|---|
reasonrequired | string | |
Response fields
| Field | Type | Meaning |
|---|
tenant_idrequired | string (uuid) | |
live_access_statusrequired | string | |
Errors
403 — Authenticated but not permitted (insufficient scope). 404 — Resource not found. 409 — State conflict (e.g., duplicate resource, stale version).
Suspend sandbox access for a tenant.
POST/v1/tenants/{id}/sandbox-access/suspend
| Idempotency-Key | Required. Returns 422 without it. |
|---|
| Environment | Sandbox and Live |
|---|
| Auth | Dashboard session |
|---|
| Fires | No webhooks. |
|---|
Header parameters
| Field | Type | Meaning |
|---|
Idempotency-Keyrequired | string | Required idempotency key for this mutating admin/public operation. Reusing the same key with a different body returns 409 Conflict; successful 2xx and client 4xx responses are cached for 24 hours. |
Path parameters
| Field | Type | Meaning |
|---|
idrequired | string (uuid) | |
Body parameters
| Field | Type | Meaning |
|---|
reasonrequired | string | |
Response fields
| Field | Type | Meaning |
|---|
tenant_idrequired | string (uuid) | |
sandbox_access_statusrequired | string | |
Errors
403 — Authenticated but not permitted (insufficient scope). 404 — Resource not found. 409 — State conflict (e.g., duplicate resource, stale version).
Enable sandbox access for a tenant.
POST/v1/tenants/{id}/sandbox-access/enable
| Idempotency-Key | Required. Returns 422 without it. |
|---|
| Environment | Sandbox and Live |
|---|
| Auth | Dashboard session |
|---|
| Fires | No webhooks. |
|---|
Header parameters
| Field | Type | Meaning |
|---|
Idempotency-Keyrequired | string | Required idempotency key for this mutating admin/public operation. Reusing the same key with a different body returns 409 Conflict; successful 2xx and client 4xx responses are cached for 24 hours. |
Path parameters
| Field | Type | Meaning |
|---|
idrequired | string (uuid) | |
Response fields
| Field | Type | Meaning |
|---|
tenant_idrequired | string (uuid) | |
sandbox_access_statusrequired | string | |
Errors
403 — Authenticated but not permitted (insufficient scope). 404 — Resource not found. 409 — State conflict (e.g., duplicate resource, stale version).
● raw markdown ·
account.md ↗ — this is exactly what an agent fetches
Loading…