API

Last updated: July 2026

The Revenue Quality Engine public API is defined by an OpenAPI 3.1 contract. Access is currently in the experimental / partner tier. A full Developer Portal is on the roadmap.

Status. API endpoints are not open to self-serve today. Contact the team for partner access. This page will expand into full reference material as endpoints move from experimental to beta and GA.

Overview

Style	REST + JSON
Contract	OpenAPI 3.1 (single-file bundle)
Transport	HTTPS only (TLS 1.2+)
Base URL	`https://api.revenuequalityengine.com` (planned)
Content type	`application/json; charset=utf-8`

Authentication

Two mechanisms are supported:

Bearer JWT — user-scoped access, issued by RQE Auth. Include as Authorization: Bearer <token>.
API key — machine-to-machine access, scoped to a workspace and a role. Include as Authorization: Bearer <api_key>.

API keys can be revoked and rotated at any time. Every request is logged with the credential identifier (never the secret) for audit purposes.

Versioning

Two orthogonal axes, both declared in the contract root:

Axis	Field	Values
Contract SemVer	`info.version`	`0.x` pre-GA · `1.x` GA · `2.x` breaking
Release status	`x-release-status`	`experimental` · `beta` · `ga` · `deprecated`

Rules:

Snapshots per info.version are frozen and hashed. A published version is never mutated.
operationId is a stable public identifier. Renaming an existing operationId is a breaking change.
Operation-level x-release-status only appears when it differs from the root value.

Rate limits

Rate limits are enforced per API key and per workspace. Exact quotas are set by plan. When a limit is hit, the API responds with HTTP 429 and a Retry-After header. Idempotent retries (with Idempotency-Key header) are safe.

Errors

Errors follow a consistent envelope:

{
  "error": {
    "code": "resource_not_found",
    "message": "Client not found",
    "request_id": "req_01H7..."
  }
}

Client errors are 4xx; server errors are 5xx. The request_id is safe to share with support.

OpenAPI contract

The contract lives at openapi/root.yaml in the source repository. It bundles into a single file for tooling. Release status per operation is expressed via x-release-status. Governance rules are enforced by CI guards (snapshot immutability, operation-id immutability, release-status redundancy, ADR references).

SDK

A TypeScript SDK is generated from the OpenAPI contract and versioned alongside it. See sdk/ts/README.md in the source repository for usage. The SDK is the recommended way to consume the API from TypeScript / JavaScript environments.

What is coming

Public Developer Portal with searchable operation reference.
Self-serve API key issuance.
SDKs for additional languages driven by demand.
Webhook signature verification with rotating keys.