Base URL: https://api.roofquery.com. Authenticate with Authorization: Bearer <your key> — except the four file routes, which take no key.
Copies this whole page as Markdown, so you can paste it into an assistant and have it write the integration. Nothing secret goes on the clipboard — your keys aren't included.
The four file routes take no API key. A completed report's PDF, XML,
ESX and diagrams can be fetched by anyone holding the order id — no
Authorization header, nothing to sign.
| Route | Key required |
|---|---|
/orders/:id/pdf | No |
/orders/:id/xml | No |
/orders/:id/esx | No |
/orders/:id/diagrams and each drawing | No |
| Everything else — ordering, status, balance, revisions | Yes |
# No -H "Authorization" anywhere. This is the whole request.
curl "https://api.roofquery.com/api/v1/reports/orders/rq_ord_8f3a21c9d4e07b16/pdf" -o report.pdfThis is what lets you hand a report to someone who has no business holding an API key — paste the link into an estimate, email it to a homeowner, embed it in your own portal. The alternative was proxying every download through your server just to attach a header.
The order id is the credential. It is
rq_ord_ plus 8 random bytes — 64 bits, not a sequence, not derived from the
address — so ids can't be guessed or walked. But a URL is not a token: it survives in
browser history, Referer headers, forwarded email and screenshots, in
places an Authorization header never reaches.
There is no expiry and no revocation. Once a link is out, it works for as long as the order exists. Treat a report URL the way you'd treat the report itself — it carries the property address and the full measurements.
Nothing behind these routes can be changed, nothing draws credit, and the response never
says whose account an order belongs to. An id that matches nothing returns
404 not_found.