Operational notes

• Rate limits: 120 requests/min per key by default. A 429 uses the standard error body and carries a Retry-After header — back off for that many seconds.
• Request ids: every response includes an X-Request-Id header. Quote it when contacting support about a specific call.
• Key rotation (zero downtime): issue a second key from Developer Settings, deploy it, then revoke the old key. Two live keys can coexist.
• Webhook secret rotation: register a second endpoint at your new URL (or the same URL — each registration gets its own secret), confirm deliveries verify, then delete the old endpoint.
• Auto-disable & recovery: an endpoint failing continuously is disabled automatically and a webhook_endpoint.disabled event is recorded (delivered to your other endpoints, and always readable via GET /events). Fix your receiver, catch up with GET /events?created_after=…, then call POST /webhook_endpoints/{id}/enable — your signing secret is untouched.
• Changing a route: cancel it and repost under the same external_ref (the ref is released on cancel). Post-acceptance changes made by the agency in the Quinable portal reach you as route.updated events.
• Changing a client: POST /clients/{id} (sending address re-geocodes), and POST /clients/{id}/archive at end of care.
• Retention: idempotency keys replay for 24 hours, then are pruned.