Authentication
Which endpoints are public, which need an API key, and how keys are issued.
Public endpoints
GET /api/v1/catalog, GET /api/v1/catalog/{id}, GET /api/v1/demand, the static feeds and the LLM guides need no authentication. They return public fields only.
API keys
Endpoints that act for a lab, POST /api/v1/requests and POST /api/v1/samples/{id}, and the NDA-only fields of a listing, need an API key.
- Keys are issued to verified lab accounts from the dashboard. The dashboard opens after launch; until then, ask us for access.
- Send the key as a bearer token:
curl -X POST https://quarrydata.ai/api/v1/requests \
-H "Authorization: Bearer $QUARRY_API_KEY" \
-H "Content-Type: application/json" \
-d @request.json
- Keys belong to your organisation. Rotate them from the dashboard, and revoke any you suspect are exposed.
Errors
| Status | error.code | Meaning |
|---|---|---|
| 401 | unauthorized | No key, or the key isn't valid |
| 403 | forbidden | The key is valid but can't do this, such as a sample without an accepted NDA |
| 429 | rate_limited | Too many requests; retry after the time in the Retry-After header |
Rate limits
Limits apply per key and, for public endpoints, per IP. Current limits are published here before keys are issued.