Quinable Partner API — Timesheets (1.1.0)

The Quinable Partner API lets an agency's external systems (e.g. a scheduling tool) create clients and routes/visits in Quinable and receive lifecycle status by signed webhooks.

Authentication. Every request carries a per-agency secret key in the Authorization header (Bearer qk_live_…). The key's prefix is its mode: qk_live_ acts on real data; qk_test_ is a sandbox — test routes never reach caregivers and move no money.

Conventions. JSON bodies; money is integer cents; ids are opaque prefixed strings (route_123); times of day are HH:MM in the route's local timezone. POST endpoints accept an Idempotency-Key header (replayed for 24h, then pruned). List endpoints use cursor pagination (limit, starting_after). Errors use real HTTP status codes plus a typed body.

Operations. Default rate limit 120 requests/min per key; a 429 carries the typed error body and a Retry-After header. Every response includes an X-Request-Id — quote it in support requests. To rotate an API key with zero downtime, issue a second key, switch, then revoke the old one; to rotate a webhook signing secret, register a second endpoint (new secret), verify deliveries, then delete the old endpoint.