Sharing a report

The file routes take no API key. A completed report's PDF, XML, ESX (when the order includes it), diagrams and (for Rapid Squares) photo, and a storm report's PDFs and map, can be fetched by anyone holding the order id — no Authorization header, nothing to sign.

Route	Key required
/orders/:id/pdf	No
/orders/:id/xml	No
/orders/:id/esx	No
/orders/:id/photo (Rapid Squares)	No
/orders/:id/diagrams and each drawing	No
/orders/:id/pdf (GET and POST) and /orders/:id/map.png (Storm Reports)	No
Everything else — ordering, status, balance, revisions	Yes

# No -H "Authorization" anywhere. This is the whole request.
curl "https://api.roofquery.com/api/v1/reports/orders/rq_ord_8f3a21c9d4e07b16/pdf" -o report.pdf

This is what lets you hand a report to someone who has no business holding an API key — paste the link into an estimate, email it to a homeowner, embed it in your own portal. The alternative was proxying every download through your server just to attach a header.

The order id is the credential. It is rq_ord_ plus 8 random bytes — 64 bits, not a sequence, not derived from the address — so ids can't be guessed or walked. But a URL is not a token: it survives in browser history, Referer headers, forwarded email and screenshots, in places an Authorization header never reaches.

There is no expiry and no revocation. Once a link is out, it works for as long as the order exists. Treat a report URL the way you'd treat the report itself — it carries the property address and the full measurements.

Nothing behind these routes can be changed, nothing draws credit, and the response never says whose account an order belongs to. An id that matches nothing returns 404 not_found.