Export API

The QuickInspect Export API is a read-only REST API that gives your own systems — BI dashboards, SAP, Power BI, CSRD reporting suites — direct access to your company's operational safety data.

• Base URL: https://api.quickinspect.me
• Machine-readable spec: /v1/openapi.json (OpenAPI 3.1 — import it into Postman, Insomnia, or your code generator)
• Availability: Enterprise plan. Ask your QuickInspect contact to enable API access for your company.

Authentication

Every request carries a per-company API key in the Authorization header:

curl https://api.quickinspect.me/v1/kpis \
  -H "Authorization: Bearer qi_live_your_key_here"

Company owners create and revoke keys in the app under Company Settings → API Access. A key is displayed exactly once at creation — QuickInspect stores only a cryptographic hash and cannot recover it. Treat keys like passwords: each one grants read access to all of the company records listed below. Revoking a key disables it immediately.

Endpoints

Endpoint	Data	Notes
GET /v1/incidents	Incident records	Filters: from, to (event date), status. Ascending by event date.
GET /v1/kpis	Pre-aggregated KPI rollup	Incidents, findings, inspections, assets, risk assessments, worked hours, locations. Month maps cover the most recent 24 months.
GET /v1/esrs-s1	ESRS S1-14 datapoints	year (default: current), format=json or format=csv. Same numbers as the in-app ESRS export.
GET /v1/audit-logs	Audit trail	Filters: from, to, class (privileged / operational). Descending by timestamp.
GET /v1/openapi.json	This API's spec	Public, no key required.

Full request/response schemas live in the OpenAPI document.

Pagination

List endpoints return at most limit records per page (default 100, maximum 500) plus an opaque cursor:

{
  "data": [ ... ],
  "next_page_token": "eyJ2IjoxLCJhIjoxNz..."
}

Pass next_page_token back as page_token to fetch the next page; null means you have everything. Tokens are opaque — don't parse or construct them.

All timestamps are ISO-8601 UTC; field names are stable snake_case.

Rate limits

Default limits are 60 requests/minute and 10,000 requests/day per key. Exceeding them returns 429 with a Retry-After header (seconds). Higher limits are available for Enterprise integrations — talk to your QuickInspect contact.

Errors

Errors use one envelope everywhere:

{ "error": { "code": "unauthorized", "message": "Invalid API key." } }

HTTP	code	Meaning
400	invalid_request	A query parameter is malformed.
401	unauthorized	Missing, malformed, unknown, or revoked key.
403	forbidden	API access is not enabled for the company.
404	not_found	Unknown endpoint, or no data exists yet (e.g. KPI rollup).
429	rate_limited	Rate limit or daily quota exceeded — honor Retry-After.
500	internal	Something went wrong on our side. Retry with backoff.

ESRS S1 CSV example

Sustainability teams can pull the ESRS S1-14 datapoints straight into a spreadsheet:

curl -o esrs_s1_2026.csv \
  "https://api.quickinspect.me/v1/esrs-s1?year=2026&format=csv" \
  -H "Authorization: Bearer qi_live_your_key_here"

The CSV carries one row per datapoint (work_related_fatalities, recordable_work_related_accidents, rate_of_recordable_work_related_accidents, days_lost_to_work_related_injuries, …) with ESRS references, units, and methodology notes — identical to the in-app ESRS export, so your API pull and your auditor's in-app export always agree.

Compliance notes

• Every API request is recorded in your company's audit trail (visible via GET /v1/audit-logs and the in-app Audit Trail viewer).
• Audit-log retention is 90 days for operational entries and 2 years for privileged entries — schedule periodic pulls if you need a longer horizon in your own systems.
• API keys are stored as SHA-256 hashes only; QuickInspect never persists the raw key.