forquotez REST API and webhooks

What the API does

The API is for connecting forquotez to your own systems: a data warehouse, an internal dashboard, a billing tool or a provisioning script that should run when a quote is signed.

It has two parts. The REST API lets your code read data and make a small number of writes. Webhooks push a JSON payload to your server when something happens, so you do not have to poll.

All requests go to /api/v1 and return JSON. Each request needs a bearer token in the Authorization header. Tokens are created by an admin under Settings, in API and Webhooks. A token is shown once at creation, is limited to your organization's data, and can be revoked at any time.

The full endpoint reference, with request and response examples and signature verification code in PHP, Node.js and Python, is in the API documentation.

What syncs

That is 12 webhook events in total. Quotes and forms are read-only through the API: quotes are created in the runner, and forms in the quote builder.

Webhook delivery

Each delivery is an HTTPS POST with a JSON body containing the event name, a Unix timestamp and the event data. Three headers come with it:

• X-Forquotez-Signature: an HMAC-SHA256 of the request body, computed with your endpoint's signing secret.
• X-Forquotez-Timestamp: when the payload was generated.
• X-Forquotez-Event: the event name, for example quote.signed.

Recompute the HMAC on your side and compare it before trusting a payload.

Setup steps

1. Confirm your organization is on the Enterprise plan. The API and Webhooks section then appears under Settings.
2. As an admin, create an API token and give it a name that says what uses it. Copy the value immediately, because it is shown only once.
3. Make a test request to /api/v1/quotes with the header Authorization: Bearer followed by your token.
4. To receive webhooks, add an HTTPS endpoint URL in the same settings screen and select the events you want.
5. Copy the endpoint's signing secret and add signature verification to your receiver, using the examples in the API documentation.
6. Trigger an event, such as saving a quote, and confirm your server receives and verifies it.

Limits and plan requirements

• Plan: API access and webhooks are on the Enterprise plan only. See pricing. On other plans the API returns 403.
• Rate limit: 60 requests per minute. Past that the API returns 429 with a Retry-After header.
• Token scope: a token has read and write access to your organization's data. There are no per-resource scopes, so store tokens like passwords.
• Retries: a delivery that cannot reach your server, or times out, is attempted up to 3 times, on a backoff schedule of 10, 30 and 60 seconds. Your endpoint should answer with a 2xx status within 10 seconds. Any other response is recorded as a failure.
• Automatic disabling: after 10 consecutive failures an endpoint is disabled automatically. A successful delivery resets the count. Fix the receiver, then re-enable the endpoint in settings.
• Writes: the only write operations are creating a contact and updating a deal.

Prefer a ready-made connection? See the HubSpot integration or the full integrations list.