What's in the API docs
Turnstile publishes a full reference for the public API (application programming interface) at Turnstile API reference. It covers authentication, versioning, and every resource area, including quotes, subscriptions, invoices, customers, contracts, and billable metrics.
Authentication and requests
Requests are authenticated with an API key, sent as an Authorization: Bearer header or an X-API-Key header. Include a Turnstile-Version header on every request so your integration keeps working as the API evolves. Every mutation (a request that creates or changes data) requires an Idempotency-Key header, so a retried request cannot create a duplicate.
Create an API key from Settings > API keys > +Create new key. You need the Manage API keys & webhooks permission to create or revoke keys. The default Owner, Admin, and Developer roles include it.
An API key can only do what its creator’s roles allow. For quotes, team members and roles, and webhooks, you cannot give a key a scope your own roles do not cover. Turnstile also checks again on every request. If the person who created a key later loses a permission, the key loses the matching access too.
Rate limits
Turnstile allows 100 requests per minute per API key, with a 1,000-requests-per-minute backstop across your account.
Note: Usage events have their own dedicated endpoint and are documented separately. See Adding usage via the Turnstile API.
Publishing quotes that need approval via the API
If a quote matches one of your organization’s quote approval rules, it cannot be published through the API.