API Overview

RabbitQA exposes a REST API through a single API gateway. The gateway authenticates every request, checks that your workspace is entitled to the module you are calling, and forwards the call to the service that owns the resource.

Base URL

There is one host per environment, and the path prefix selects the backing service.

Environment	API host
Production	https://api.rabbitqa.com
UAT	https://api-uat.rabbitqa.com

warning

The API host is not the application host. app.rabbitqa.com and uat.rabbitqa.com serve the web application; API calls sent there will not reach the gateway.

Gateway prefixes

Each prefix is owned by a different service. There is no generic /v1/** prefix.

Prefix	Owner	Covers
/api/v1/auth/**	Organization	Login, refresh, logout, signup, password reset, workspace switch
/api/v1/users/**, /companies/**, /roles/**, /permissions/**, /teams/**, /workspaces/**, /module-access/**, /scm/**	Organization	Identity, tenancy and access control
/api/v1/notifications/**, /notification-events/**, /notification-settings/**	Organization	Notifications
/api/v1/credits/**, /admin-credits/**, /credit-approvals/**	Organization	Credits and billing
/tmt/company/api/v1/**	Test Management	TestPilot, CaseWriter, Analyzer, Smart PBI, SmartRequest, DataCrate, Accessibility, FileHub
/tmt/api/v1/**	Test Management	Cross-company endpoints, including /tmt/api/v1/public/download/**
/autorunner/api/v1/**	AutoRunner	Automation projects, scenarios, plans, runs, schedules
/df/api/**, /df/wd/**, /df/ws/**	Device Farm	MobileHub and BrowserHub devices, sessions and WebDriver
/healthcheck/api/v1/**	HealthCheck	System Check monitors, incidents, agents, status pages
/security-check/api/v1/**	HealthCheck	Security Check targets and scans
/business-check/api/v1/**	HealthCheck	Business Check assessments

The Organization prefixes are registered path by path — /api/v1/** is not a catch-all, and an unregistered path under it will not route.

Required headers

curl https://api.rabbitqa.com/tmt/company/api/v1/testCases \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Workspace-Id: 91"

Header	Required	Purpose
Authorization: Bearer <jwt>	Yes	The access token returned by POST /api/v1/auth/login. See Authentication.
X-Workspace-Id	In practice, yes	Selects the active workspace. The gateway validates that your account can reach it, and services scope their queries by it. Omitting it on a workspace-scoped endpoint returns data for no workspace, or is rejected.
Content-Type: application/json	On write	Some endpoints also accept multipart/form-data for uploads.

Response format

Endpoints return their resource representation directly — there is no { "success": ..., "data": ... } envelope.

{
  "id": 4211,
  "code": "TC-118",
  "name": "Login with a valid account",
  "priority": "HIGH",
  "createdDate": "2026-08-14T09:12:44"
}

List endpoints that support paging return a Spring page object with content, totalElements, totalPages, number and size, and accept page, size and sort query parameters. Endpoints that return a plain array do not page.

Errors

Status	Meaning
400	Validation failed on the request body or parameters
401	Missing, malformed, expired or blacklisted token
403	Authenticated, but the permission or module entitlement is missing, or the workspace is not accessible
404	The resource does not exist, or is not visible in the active workspace
409	Conflicting state, such as a duplicate name
429	Rate limited. See Rate Limits.
500	Unhandled server error

Rate-limit responses use application/problem+json (RFC 7807). Other errors return a JSON body with a message field.

Workspace scoping

Almost every resource belongs to a workspace. The same account can see different projects, test cases and runs depending on the X-Workspace-Id it sends, and a token alone does not grant access to a workspace — the gateway checks membership on each request.

HealthCheck is the exception: it is scoped to the company and ignores X-Workspace-Id.