FAQ

Who can use the API?#

Every active member of a company can create personal keys. An owner or admin can switch API access off for the whole company. Each key has its own rate limit.

Can I use one key for several companies?#

No. A key belongs to one company. Create one key in each company you work for.

What happens to my keys if I leave the company?#

They stop working at once (403 permission_denied). For integrations that must keep running, let an owner or admin create the key.

Can my admin see my keys?#

Owners and admins see the name, prefix, access, expiry and usage of every key in the company and can revoke them. Nobody can see the secret part of a key, not even you after creating it.

Can I call the API from my website's JavaScript?#

No. Anyone could read the key from the page. Call Quilo from your server (or a serverless function) and let your page talk to your server.

Are there webhooks?#

Not in v1. Use Quilo Automations to react to events inside Quilo, or poll with updated_since / created_since.

Can I create invoices through the API?#

Not in v1: invoices are read only (with their lines). Create them in Quilo, or tell us what you need — see Support.

Can I upload files or photos?#

Not in v1.

Is there a sandbox?#

Use a separate test company, or create test records with a tag such as api-test and delete them afterwards. A Read only key is a safe way to try everything that reads.

Do API changes show up in the activity log?#

Yes. Records created, changed or deleted through a key appear in Settings → Security & activity under the key owner's name, exactly as if they had done it in the app. Automations run for them too.

Where is the machine-readable description?#

$QUILO_URL/api/v1/openapi.json (OpenAPI 3.1, no key needed).

How do I report a security problem?#

Email support@teknocare.ch with the subject "Security".