Quickstart: First API Call

This guide gets you to a successful API call in under 10 minutes.

Prerequisites

• A tenant ID and service account credentials
• curl and jq installed

Step 1: Get an access token

export SERVICE_ID="your-service-id"
export SERVICE_SECRET="your-service-secret"

ACCESS_TOKEN=$(curl -sS -X POST \
  -H "Authorization: Bearer $SERVICE_SECRET" \
  -H "Content-Type: application/json" \
  -d "{\"serviceId\": \"$SERVICE_ID\", \"audience\": \"internal-service\"}" \
  https://api.qnsp.cuilabs.io/auth/service-token \
  | jq -r '.accessToken')

echo $ACCESS_TOKEN

Step 2: Make an authenticated request

export TENANT_ID="your-tenant-uuid"

curl -sS \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  "https://api.qnsp.cuilabs.io/proxy/kms/v1/keys?tenantId=$TENANT_ID" \
  | jq

Step 3: Check health endpoints

Health endpoints are public and bypass bot protection for GET/HEAD requests:

# Check all services health
curl -sS https://api.qnsp.cuilabs.io/proxy/health | jq

# Check specific service health
curl -sS https://api.qnsp.cuilabs.io/proxy/platform/health | jq
curl -sS https://api.qnsp.cuilabs.io/proxy/billing/health | jq

The /proxy/health endpoint returns the health status of all services:

{
  "status": "healthy",
  "services": {
    "platform-api": {"status": "healthy", "latencyMs": 3},
    "auth-service": {"status": "healthy", "latencyMs": 5},
    ...
  }
}

Common pitfalls

• Missing tenant: Returns 400 BAD_REQUEST — include tenantId query parameter
• Expired token: Returns 401 UNAUTHORIZED — request a new token and retry
• Wrong audience: Returns 403 FORBIDDEN — check token audience matches endpoint requirements