API reference
ENDPOINT ARCHITECTURE.
A versioned contract for bringing data in, reading governed outputs, and connecting Qubit Notion to the systems your team already runs.
Event Collection
First-party event collection running in production. Consent aware, deduplicated across web and server, with identity resolution.
RESTful API
Read plans, campaigns, studies, findings and pixel rollups. Send server events and delivered actuals. Scoped credentials, cursor pagination and problem+json errors throughout.
GraphQL Gateway
A single introspectable endpoint is on the roadmap. It is not built, so there is nothing to integrate against yet.
Streaming Pipeline
Continuous delivery of events to your systems will arrive through signed webhooks first. There is no streaming endpoint today.
SECURITY_LAYER
AUTHENTICATION
curl https://api.qubitnotion.com/v1/plans \ -H "Authorization: Bearer $QN_API_KEY" \ -H "Content-Type: application/json"
Keys are scoped to one workspace and carry explicit read scopes. The key is shown once at creation and stored only as a hash. Workspace admins create and revoke their own keys inside the product.
OAuth for service integrations
Approved service integrations can exchange client credentials for short-lived access tokens. The token inherits the client's workspace and scopes, so an integration cannot cross into another organization or request data outside its grant.
THROUGHPUT_SPEC
RATE LIMITING
Beta limits
Every beta key runs on the same allowance while we learn what real usage looks like. Each response carries the standard rate limit headers, so your client can back off without guessing. Published tiers arrive with general availability, and nothing is unlimited.
MACHINE_CONTRACT
OPENAPI CONTRACT
Generated from the endpoints that exist
The OpenAPI 3.1 document is published at /api/v1/openapi and lists only what the server serves today: the key introspection endpoint, media plans, omni-channel campaigns, research studies, findings, daily pixel rollups and server-side event ingest. Errors follow RFC 9457 problem details, and a repeated write carries an Idempotency-Key so a retry cannot double-post.
Open the live reference to browse every endpoint, its scopes and a ready-to-run request, rendered from that same contract. Every failure is catalogued in the error catalogue, and machines can read /.well-known/qubitnotion for the base URL, scopes and limits in one fetch.
START_HERE
PICK YOUR JOB
Guides
Four end-to-end jobs: send server events, sync plans to a warehouse, receive study results, import spend actuals. Each one ends with a way to check it worked.
Playground
Run real read calls from the browser with a sandbox key and see the response and its rate-limit headers.
Limits
Burst and daily windows, the headers we send, what gets refunded and the payload ceilings per endpoint.
Status
Availability, server errors and 95th percentile response time, measured from the gateway's own request log over 24 hours, 7 days and 30 days.
Security
Key storage, scopes, rotation without downtime, automatic revocation of leaked keys and webhook signatures.
Prefer your own tool? Download the Postman collection or the Bruno collection, both generated from the published contract.
VERSION_CONTROL
API VERSIONS
v1 is the first version
The version is part of the request path, so an integration keeps working until you choose to move it. Changes inside a version are additive only. Retirement carries at least 90 days of notice and 12 months of runway, signalled in the response headers, with a migration guide from day one.
Read the full versioning policy, or follow the changelog (RSS) where additive changes are recorded even though they carry no version bump.