Documentation & Resources

Overview

The That Is A Q API is a RESTful API that enables you to build applications, automate workflows, and integrate with our platform. All API requests must be made over HTTPS, and all responses are returned as JSON.

🔐

Authentication

OAuth 2.0 and API key authentication with scoped access control.

Read docs →

🔗

REST Endpoints

Complete reference for all API endpoints, parameters, and response schemas.

View endpoints →

📦

SDKs & Libraries

Official client libraries for JavaScript, Python, Go, Ruby, and more.

Browse SDKs →

📊

Rate Limits

Understand request limits, tier quotas, and best practices for efficiency.

Learn more →

Quick Start

Get up and running with the That Is A Q API in under 5 minutes. Here's how to make your first API call.

1

Install the SDK

Install the official JavaScript/TypeScript SDK using your preferred package manager.

Bash

npm install @thatisaq/sdk

# or with yarn
yarn add @thatisaq/sdk

# or with pnpm
pnpm add @thatisaq/sdk
                                

2

Configure Your API Key

Set your API key as an environment variable or configure it directly in your SDK client.

                                    Environment
                                    
# .env file
THATISAQ_API_KEY=qa_live_sk_...your_key_here
THATISAQ_ENV=production

3

Make Your First Request

Initialize the client and make your first API call to fetch resources.

                                    JavaScript
                                    
                                

import { QClient } from '@thatisaq/sdk';

const q = new QClient({
  apiKey: process.env.THATISAQ_API_KEY,
  environment: 'production',
  timeout: 30000
});

// Fetch all projects
const projects = await q.projects.list();
console.log(projects);  // → [Project, Project, ...]
                                

API Endpoints

Projects

Create, retrieve, update, and delete projects within your organization.

GET /api/v2/projects

List all projects. Supports pagination and filtering by status, team, and tags.

POST /api/v2/projects

Create a new project. Returns the created project object with all default configurations.

GET /api/v2/projects/:id

Retrieve a specific project by its unique identifier.

PUT /api/v2/projects/:id

Update project settings, metadata, or configuration. Partial updates supported.

DELETE /api/v2/projects/:id

Permanently delete a project. This action is irreversible.

Members

Manage team members and their roles within your organization.

GET /api/v2/members

List all members of the organization.

POST /api/v2/members

Invite a new member to the organization.

Authentication

The That Is A Q API supports two authentication methods: API Keys for server-to-server communication and OAuth 2.0 for user-authenticated requests.

⚠️

Security Notice: Never expose your API keys in client-side code. Use environment variables and server-side proxies for all sensitive operations.

API Key Authentication

Include your API key in the Authorization header of every request:

                        HTTP
                        
                    

GET /api/v2/projects HTTP/1.1
Host: api.thatisaq.com
Authorization: Bearer qa_live_sk_abc123...
Content-Type: application/json
X-Q-Request-ID: req_unique_id_123
                    

OAuth 2.0 Flow

                        JavaScript
                        
                    

const authUrl = q.auth.getOAuthUrl({
  redirectUri: 'https://yourapp.com/callback',
  scopes: ['projects:read', 'projects:write'],
  state: Math.random().toString(36)
});

// After OAuth callback, exchange code for token
const tokens = await q.auth.exchangeCode({
  code: query.code,
  redirectUri: 'https://yourapp.com/callback'
});
                    

SDKs & Libraries

Official client libraries available for the most popular programming languages. All SDKs follow the same conventions and are maintained by the That Is A Q team.

🟨

@thatisaq/sdk

JavaScript / TypeScript SDK. Full type safety, tree-shaking support, and Node.js + browser compatible.

View on npm →

🐍

thatisaq-python

Python SDK with async/await support. Available on PyPI. Compatible with Python 3.8+.

View on PyPI →

🐹

go-thatisaq

Go SDK with context support, goroutine safety, and automatic retry logic.

View on GitHub →

💎

thatisaq-ruby

Ruby gem with Rails integration, ActiveModel serialization, and i18n support.

View on RubyGems →

Error Codes

The API uses standard HTTP status codes and returns detailed error objects in the response body.

HTTP Code	SDK Error	Description	Action
`200`	—	Success	Process response normally
`400`	`BadRequestError`	Invalid request parameters	Check request body & query params
`401`	`AuthenticationError`	Invalid or expired API key	Regenerate your API key
`403`	`PermissionError`	Insufficient permissions	Verify OAuth scopes
`404`	`NotFoundError`	Resource not found	Check resource ID
`429`	`RateLimitError`	Rate limit exceeded	Implement exponential backoff
`500`	`InternalServerError`	Server-side error	Contact support

Error Response Format

                        JSON
                        
                    

{
  "error": {
    "code": "rate_limit_exceeded",
    "message": "Too many requests. Please retry after 120s.",
    "documentation_url": "https://docs.thatisaq.com/errors/rate_limit",
    "request_id": "req_abc123xyz",
    "retry_after": 120
  }
}
                    

Webhooks

Subscribe to events to receive real-time notifications when resources change. Webhooks are signed using HMAC-SHA256 for verification.

✅

Webhooks are now GA! Available on all plans starting from v2.4.0. Previously beta-only.

Available Events

📦
project.created Triggered when a new project is created in the organization.
✏️
project.updated Triggered when project metadata or configuration is modified.
🗑️
project.deleted Triggered when a project is permanently deleted.
👤
member.invited Triggered when a new member is invited to the organization.
🔑
key.rotated Triggered when an API key is rotated or revoked.

Verifying Webhook Signatures

                        JavaScript
                        
                    

import { createHmac } from 'crypto';

function verifyWebhook(payload, signature, secret) {
  const expected = createHmac('sha256', secret)
    .update(payload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}
                    

Pagination

Lists that return multiple resources support cursor-based pagination. Include the after parameter to fetch the next page.

                        JavaScript
                        
                    

// First page
const result = await q.projects.list({
  limit: 25,
  sort: 'created_at:desc'
});

// Next page using the cursor
if (result.pagination.has_more) {
  const nextPage = await q.projects.list({
    after: result.pagination.next_cursor,
    limit: 25
  });
}
                    

Rate Limiting

API requests are rate-limited based on your plan tier. Check the X-RateLimit-* headers in responses to track your usage.

Plan	Requests/min	Burst Limit	Monthly Quota
Starter	`60`	`100`	`10K`
Growth	`300`	`500`	`100K`
Enterprise	`Unlimited`	`2000`	`Unlimited`

Changelog

2.4

Webhooks GA + Batch Operations

Webhooks are now generally available. New batch endpoints for bulk updates. Improved SDK error handling. TypeScript declaration files are now bundled.

2.3

OAuth 2.0 Refresh Tokens

Added refresh token support for OAuth flows. New pagination helpers. Go SDK added. Bug fixes for webhook retry logic.

2.2

Rate Limit Headers

Rate limit headers added to all responses. Ruby SDK released. Improved webhook signature verification.

2.0

Major API Redesign

Complete API v2 with new authentication model, updated resource schemas, and breaking changes from v1.x. Migration guide available.

🚀

Ready to build? Jump into our Quick Start Guide or browse the Code Examples for real-world integration patterns.