QQuilo Developers
Reference

Glossary A–Z

Every term used in the API and this guide, from Access to Zapier.

A#

  • Access — what a key may do: Read only (GET) or Read and write (GET, POST, PATCH, DELETE). Stored as the key's scopes read / write.
  • API — Application Programming Interface: the way programs talk to Quilo over HTTPS with JSON.
  • API key — a secret that identifies you to the API, created under Settings → API keys. See API keys.
  • Appointment — a visit, call or fitting with a start and optional end time. See Appointments.
  • Authorization header — the HTTP header that carries the key: Authorization: Bearer qk_….

B#

  • Backoff — waiting longer between retries (1 s, 2 s, 4 s…) after 429 or 5xx answers.
  • Base URL — $QUILO_URL/api/v1, the start of every endpoint.
  • Bearer token — a credential sent as Bearer <token>; your API key.
  • Brand — a shop or label inside a company. Every record belongs to one brand; get IDs from GET /me or GET /brands.

C#

  • Client — a person or business who buys from you. See Clients.
  • Company — a Quilo customer account (for example Dubai Jewellery GmbH). A key works in exactly one company.
  • CORS — the browser rule that lets pages call other sites. The Quilo API sends no CORS headers on purpose, so keys stay on servers.
  • created_at — when a record was created (UTC). Lists are sorted by it, newest first.
  • Cursor — the next_cursor value that fetches the next page of a list.
  • Custom order — a made-to-order piece moving through stages. See Custom orders.

D#

  • DELETE — the HTTP method that removes a record. Owners, admins and managers only.

E#

  • Endpoint — one URL plus method, such as POST /api/v1/clients.
  • Error type — the stable error.type value of an error, such as validation_failed. See Errors.
  • Expiry — the date after which a key stops working by itself.
  • external_code — your own number for a client (from a shop, POS or Lightspeed), useful to match records.

F#

  • Filter — a query parameter that narrows a list, such as ?status=todo. Unknown filters are refused.

G#

  • GET — the HTTP method that reads. The only method a read-only key may use.

H#

  • HTTPS — encrypted HTTP. The API works only over HTTPS.
  • has_more — true when a list has another page.

I#

  • ID — a record's unique identifier, a UUID like 6f1c2a90-3b4d-4e5f-8a7b-9c0d1e2f3a4b.
  • Idempotency-Key — a header that makes a POST safe to retry. See Idempotency.
  • Invoice — a bill with a Swiss QR-bill reference; read only in v1. See Invoices.
  • ISO 8601 — the date-time format the API uses: 2026-10-20T14:00:00+02:00.

J#

  • JSON — the text format of every request body and response.

K#

  • Key prefix — the public start of a key (qk_0123456789), shown in lists so you can tell keys apart.

L#

  • limit — page size of a list, 1 to 200 (default 50).

M#

  • Manager — a company role that can create, change and delete records but not manage the team or billing.
  • me — GET /api/v1/me, which shows who a key acts as. The first call to test a key.

N#

  • n8n — an automation tool; see the no-code guide.
  • next_cursor — the cursor for the next page, or null on the last page.
  • null — an empty value; send it to clear an optional field.

O#

  • object — the field on every record that names its type (client, sale…), or list for lists.
  • OpenAPI — the standard machine-readable API description; Quilo's is at /api/v1/openapi.json.
  • Owner — the company role with full rights, including billing and granting support access.

P#

  • Pagination — splitting long lists into pages with limit and cursor.
  • PATCH — the HTTP method that changes some fields of a record.
  • permission_denied — the error when the role, brand access or company state does not allow an action.
  • POST — the HTTP method that creates a record.

Q#

  • QR-bill — the Swiss payment slip; invoices carry its reference in qr_reference.
  • Quilo — the CRM and ERP for retail brands, by TeknoCare.

R#

  • Rate limit — at most 120 requests per minute per key. See Rate limits.
  • Read only — key access that allows only GET.
  • receipt_no — a sale's receipt or order number, unique per brand.
  • Request ID — req_…, in every response header and error; send it to support.
  • Revoke — switch a key off for good.
  • Role — owner, admin, manager or staff; decides what a person (and their keys) may do.
  • Rotation — replacing a key with a new one without downtime.
  • Row-level security — the database rules that decide which rows a person may see or change; they apply to every API request.

S#

  • Sale — a purchase by a client. See Sales.
  • Scope — technical name for a key's access (read, write).
  • SHA-256 — the fingerprint Quilo stores instead of your key.
  • Staff — a company role that can read and write records (possibly limited to some brands) but not delete.
  • Status code — the HTTP number of a response: 200, 201, 401, 422…

T#

  • Task — a to-do or follow-up, optionally linked to a client. See Tasks.
  • TeknoCare — the company that makes and runs Quilo.
  • Time zone — required on every date-time you send (Z, +02:00).

U#

  • updated_since — client filter that returns only clients changed since a time; the basis of syncing.
  • UTC — Coordinated Universal Time; all returned times are in UTC.
  • UUID — the 36-character ID format used for every record.

V#

  • validation_failed — the error when fields are missing or wrong; errors lists them.
  • Version — the v1 in /api/v1. See Versioning.

W#

  • Webhook — a call from Quilo to your server when something happens. Not available in API v1; use Quilo Automations to react to events.
  • Write access — key access that allows POST, PATCH and DELETE as well as GET.

X#

  • X-RateLimit-Limit / X-RateLimit-Remaining — response headers with the per-minute limit and what is left.
  • X-Request-Id — response header with the request ID.

Y#

  • YYYY-MM-DD — the date format for date fields, such as 2026-10-17.

Z#

  • Z — the "Zulu" suffix meaning UTC in a date-time: 2026-10-20T12:00:00Z.
  • Zapier — an automation tool; see the no-code guide.