Welcome to the documentation for the Admin API. This documentation describes the functionality available only in the current versions of API methods. You can also review the documentation for all API methods for information about both current and deprecated API methods.
For governance and security purposes, Quip makes available a set of APIs to enable specific users to see all content within a Quip site and to take actions against that content.
This API requires that you have first followed the setup instructions for the Quip Automation API.
To call this API, the access token you use must be for a user who is an admin.
You must also have the admin API enabled for your quip instance. Ask your support representative if you would like this functionality enabled.
You can access Quip's APIs if your company uses any of these products:
Note: These Admin APIs are available only as add-on purchases: Events API and Governance API.
If you're a Virtual Private Cloud (VPC) customer, you can call Quip's APIs using URIs in which you replace: quip.com with customername.onquip.com or quip-customername.com.
For example, if your company is Acme and the URI is https://platform.quip.com/1/threads/edit-document, as a VPC customer, use one of these URIs instead depending on your company's assigned VPC URL:
Quip's APIs have rate limits to help ensure fair and reliable access to APIs for all of our customers.
When you call our APIs via integrations you build (including integrations using Process Builder and Flow), those calls are subject to our rate limits.
The Admin API is rate limited by number of requests per minute per user - with defaults of:
API responses include a few custom headers to help developers implement backoffs in their code. These headers are:
X-Ratelimit-Limit
: The number of requests per minute/hour the user can makeX-Ratelimit-Remaining
: The number of requests remaining this user can
make within the minute/hour. This number changes with each requestX-Ratelimit-Reset
: The UTC timestamp for when the rate limit resetsQuip's APIs are also subject to a per-company rate limit with a default of 600 requests per minute. The API responses include these custom headers to help developers implement backoffs in their code:
X-Company-RateLimit-Limit
: The number of requests per minute that your company can makeX-Company-RateLimit-Remaining
: The number of requests remaining for your company within the minuteX-Company-RateLimit-Reset
: The UTC timestamp for when the rate limit resetsX-Company-Retry-After
: The number of seconds after which your company can make API calls againWe recommend that you use the Automation API to automate user-level processes such as document copying and editing and to integrate Quip with your other systems. Use the Admin API for admin-level site-wide or security workflows such as activity monitoring or quarantining documents.
Quip's APIs integrate with Salesforce, Slack, Google Workspace, Github, Jira, Stripe, Dropbox, Box, Zendesk and more. You can connect nearly any application to Quip using our APIs, including your company's proprietary applications or systems. Browse our sample apps or download prebuilt apps on Salesforce AppExchange.
In the Quip Admin Console, create a placeholder user (not associated with an employee) or bot user for your integrations. That way, when you deprovision an employee's user account, the integration isn't affected. Additionally, this allows for a more clear separation of duties between an employee and an integration user.
Currently, there's no way for the API keys to change automatically. You can only create API keys manually.
All of your company's Admin and Automation API calls are counted in your rate limits, including calls you make via Process Builder and Flow. There are per-user and per-company rate limits for the Admin and Automation APIs.
If you need to call APIs more frequently than allowed by the Admin and Automation API rate limits, contact Quip Customer Support for help.
The responses in Quip's Admin and Automation APIs contain headers that provide information about your API usage.
Use the Events API to get information about Quip engagement. You can then feed that information into your engagement monitoring systems.
Consult our trusted partner for eDiscovery and eArchiving solutions at onna.com/quip.
You can export Quip documents or spreadsheets to PDF using the Create Export PDF Request API method.
Use the Get Recent Messages API method to retrieve the 25 most-recent comments in a Quip document. You can then export the response of your API call to your other systems.
The Disable User v1.1 or v2.0 API method allows you to deactivate a user account.
Read the release notes to find out about new Quip developer features. Subscribe to the Salesforce Developer newsletter to get developer news, tips, and best practices. You can also follow these social media channels: SalesforceDevs Twitter feed, SalesforceDevs LinkedIn page, SalesforceDevs Facebook page.
Ask other Quip developers on Salesforce Stack Exchange.
To improve the quality and performance of API methods, Quip periodically releases new versions and deprecates older versions. Examples of changes that sometimes require creating new versions are:
Versions are identified in the path for each API method. Examples:
We inform you in a release note at least one year before support for an API method ends. In addition, we update the reference documentation to identify the current and deprecated versions of an API method. Our REST APIs have two versions of reference documentation:
Update your integrations so that they point to the current version instead of a deprecated version before support for an API method ends. Example scenario:
As needed, for your integrations, you can download the OpenAPI Specification (OAS) files for current and all versions of each REST API.
Authentication gives you access to the Quip Admin and Automation APIs. You can build integrations that call our APIs. To access Quip's APIs, first create an API key. Then get an access token using the API key as described in Get Access to Quip's APIs. You can create additional API keys for your other integrations with the applicable scopes needed for the features in a specific integration. You can also get a personal access token to test our APIs.
Use an OAuth2-compatible mechanism for authentication. Quip's approach follows RFC 6749.
Our API endpoints accept authentication tokens as described in
RFC 6750.
In most cases, this means that when you call our API endpoints, you
can pass in an Authorization
header with content
"Bearer {{token}}". {{token}} is the value of an access token obtained
by following the steps described in
Get Access to Quip's APIs.
The only endpoints that don't require an Authorization header are these
Authentication endpoints:
Token Endpoint,
Authorization Endpoint,
Revoke a Token.
This table lists the URLs for Quip's Authentication endpoints that you can call when you build your integrations. In addition, this table describes available scopes for the Admin API. See the Domain Authentication section and the reference documentation linked to in this table for information about using the authentication endpoints.
Security Scheme Type | OAuth2 |
---|---|
authorizationCode OAuth Flow | Authorization URL: https://platform.quip.com/1/oauth/login Token URL: https://platform.quip.com/1/oauth/access_token Refresh URL: https://platform.quip.com/1/oauth/access_token Scopes:
|
Note: Before building applications, you must select your required scopes when you create the API keys. And ensure that your application users have the correct access to the content they'll use in your applications. For example, if users need to edit a Quip document using your application, they must have edit access on that document.
Here are some recommended practices to follow to protect your Quip data and improve your user experience:
USER_MANAGE
scope in the API key for that application.You can generate an access token that provides API access to your own, personal Quip account. This is useful for testing the API, automating tasks, or integrating with other services you use individually.
To generate a personal access token, visit this page: https://quip.com/dev/token
Whenever you generate a new token, all previous tokens are automatically invalidated.
Once you have a token, the easiest way to use it is via the Python Client Library, which makes most tasks a single line of code. All of the documentation below contains copy-and-paste Python code snippets to make it easier to get started.
To access to the Quip Admin and Automation APIs:
Note: These Admin APIs are available only as add-on purchases: Events API and Governance API.
To get access to the Quip Admin and Automation APIs, follow the process summarized in the diagram below. The process is described in detail in the Generate an OAuth Token section.
1. Create an API Key
a. In the Quip Admin Console create an API key and select the scopes that you need for the features in your integration.
b. Copy the client ID and client secret so you can use them to get an access token.
Note:
2. Get an Access Token
Use your preferred tool such as Postman or SoapUI to get an access token. This example uses Postman:
a. Create a request in Postman.
b. Click the Authorization tab.
c. From the Type dropdown list, select Oauth 2.0.
d. In the Configure New Token section, fill in the fields as described here:
https://platform.quip.com
https://platform.quip.com/1/oauth/login
If you're a
Virtual Private Cloud
(VPC) customer, use one of these URLs instead, depending on your
company's assigned VPC URL:https://platform.<customername>.onquip.com/1/oauth/login
orhttps://platform.quip-<customername>.com/1/oauth/login
https://platform.quip.com/1/oauth/access_token
If you're a VPC customer, use one of these URLs instead, depending
on your company's assigned VPC URL:https://platform.<customername>.onquip.com/1/oauth/access_token
orhttps://platform.quip-<customername>.com/1/oauth/access_token
e. Click Get New Access Token.
3. Get authorization from Quip
When prompted, use your admin email address and password to log into your Quip site and get an authorization token. This is required only the first time you get an access token.
4. Save the Token
In Postman, the token details are displayed. Click Use Token to save the provided token in your request and use it in your next API call.
Congratulations! You can now make Admin and Automation API calls. Follow these same instructions to get additional access tokens using API keys with the scopes required for the integrations you're building.
Note: Tokens expire every 30 days. Use the Token Endpoint to refresh your tokens before the 30-day expiration. That way your users have uninterrupted access to your integrations.
Now that you have access to our APIs, you can start building your integrations with Quip:
Questions? Ask the Quip developer community on Salesforce Stack Exchange.
Domain authentication is only available for Quip Enterprise administrators. To enable this for your company, contact us.
Domain authentication enables seamless integration for internal or pre-approved services at your company. Domain authentication is simply OAuth 2.0, but instead of end users individually approving access to each application, domain administrators pre-approve applications, and end users do not see additional authorization prompts during the OAuth authorization process.
To enable domain authentication for a third-party application:
/oauth/login
and the OAuth 2.0 token endpoint /oauth/access_token
.Returns the contents of specified blob from the thread.
ADMIN_READ
) thread_id required | string The ID of the thread that contains the desired blob. |
blob_id required | string The ID of the blob to return. |
company_id required | string The ID of the company to use. |
If-None-Match | string Header containing a 'blob_id'. If this ID matches the path parameter 'blob_id' and the blob exists, an HTTP status code 304 is returned. |
{- "error": "string",
- "error_code": 304,
- "error_description": "string"
}
Uploads an image or other blob to the given thread. Returns a url
that may be used in the content
field of
Edit Document
requests and an id
that may be used in the attachment
field of
Add a Message.
ADMIN_WRITE
) thread_id required | string The ID of the thread to add the blob to. |
blob required | string <binary> The image or blob binary. |
company_id required | string The ID of the company to use. |
{- "id": "DiPp1ZQyC8QUtvBT4vojzM",
- "url": "/blob/LeSAAAqaCfc/DiPp1ZQyC8QUtvBT4vojzM"
}
The member_ids parameter must contain a list of folder IDs and user IDs. Specified users will be added to the document and the thread will be added to the specified folders.
ADMIN_MANAGE
) thread_id required | string The ID or secret path of the thread to get information about. You can pass in either of these identifiers:
|
member_ids required | string A comma-separated list of folder IDs and user IDs. We add each user individually to the thread. We add the thread to each of the specified folder IDs. If you pass in a folder ID, use either of these folder identifiers:
The Note: For better performance, it’s recommended that you add no more than 1,000 items to a folder. There’s a maximum limit of 4,000 items per folder. Items include documents, spreadsheets, and subfolders. When your API call exceeds the suggested limit of 1,000 items, a warning message is returned in the API response. When your API call exceeds the maximum limit of 4,000 items, the request isn’t executed and the 400 error code is returned. For more information, see Folder Limits. |
{- "thread": {
- "id": "AVN9AAeqq5w",
- "author_id": "LJa9EAtQi98",
- "owning_company_id": "IMbAcASGu56",
- "thread_class": "document",
- "created_usec": 1519926805974011,
- "updated_usec": 1558224928731511,
- "title": "❗️ very important cat pics ❗️",
- "type": "document",
- "is_deleted": false,
- "is_template": false,
- "document_id": "KSRABARYWW9"
}, - "user_ids": [
- "UTUAEAiZl6B"
], - "shared_folder_ids": [
- "RKa9OAiGmsC"
], - "expanded_user_ids": [
- "PZF9EA0i0ef",
- "dHe9EABHRsb",
- "EHY9EAokwO3"
], - "invited_user_emails": [ ],
- "access_levels": {
- "PZF9EA0i0ef": {
- "access_level": "OWN"
}, - "dHe9EABHRsb": {
- "access_level": "VIEW"
}, - "EHY9EAokwO3": {
- "access_level": "EDIT"
}
}, - "html": "..."
}
Makes a copy of the document specified by the thread_id
argument.
The source document can also be treated as a template. To use the
source document as a template, the values
query argument must
contain a valid JSON dictionary that consists of string keys and
whose values are either string, numbers or other dictionaries. The
endpoint will scan the document for a text pattern like:
[[varname]]
where varname consists of a series of alphanumeric characters and underscores (_). It will then look up 'varname' in the values dictionary and replace the pattern with its value.
In addition, patterns can contain one or more dots (.) like:
[[varname1.varname2]]
In this case, the endpoint will separate the string into 'varname1'
and 'varname2'. If it finds varname1 in the first dictionary, it
will expect that value to be another dictionary and will then use
varname2 to look for another value. For example, if values
has the
following JSON representation:
{ "user": { "name": "Arnie", "age": "34" }}
The template variable [[user.name]]
will be substituted with
'Arnie'.
If the key specified in the template variable can't be found in the
values
dictionary, then the template variable pattern is left
unchanged in the document.
ADMIN_READ
ADMIN_WRITE
) Content-Type | string Example: application/x-www-form-urlencoded |
thread_id required | string The ID or secret path of the document to be copied:
|
values | string If you want to make a copy of a template and fill it in with your specified content, pass a JSON dictionary into this field. In the JSON dictionary, the keys must be strings and the values must be either strings or dictionaries. Keys can contain only the characters A-Z, a-z, 0-9, .(period) and _(underscore). For example:
|
member_ids | string Comma-separated list of user IDs of people who can access the new
thread. If you don't pass in |
folder_ids | string Comma-separated list of identifiers of the folders you want to add
the new thread to. If you don't pass in
Note: For better performance, it’s recommended that you add no more than 1,000 items to a folder. There’s a maximum limit of 4,000 items per folder. Items include documents, spreadsheets, and subfolders. When your API call exceeds the suggested limit of 1,000 items, a warning message is returned in the API response. When your API call exceeds the maximum limit of 4,000 items, the request isn’t executed and the 400 error code is returned. For more information, see Folder Limits. |
title | string The name of the new thread. The title is used as the first line of a document.
We recommend that you pass in a |
copy_annotations | boolean Default: false Determines whether to copy comments in the original thread to the new thread. Possible values are:
|
{- "thread": {
- "id": "AVN9AAeqq5w",
- "author_id": "LJa9EAtQi98",
- "owning_company_id": "IMbAcASGu56",
- "thread_class": "document",
- "created_usec": 1519926805974011,
- "updated_usec": 1558224928731511,
- "title": "❗️ very important cat pics ❗️",
- "type": "document",
- "is_deleted": false,
- "is_template": false,
- "document_id": "KSRABARYWW9"
}, - "user_ids": [
- "UTUAEAiZl6B"
], - "shared_folder_ids": [
- "RKa9OAiGmsC"
], - "expanded_user_ids": [
- "PZF9EA0i0ef",
- "dHe9EABHRsb",
- "EHY9EAokwO3"
], - "invited_user_emails": [ ],
- "access_levels": {
- "PZF9EA0i0ef": {
- "access_level": "OWN"
}, - "dHe9EABHRsb": {
- "access_level": "VIEW"
}, - "EHY9EAokwO3": {
- "access_level": "EDIT"
}
}, - "html": "..."
}