Questro developer documentation: Personal Access Token authentication, the REST endpoints under /api/v1 for timers and Q&A, outbound webhooks, rate limits, and the OpenAPI specification.
The Questro API is a small REST interface for driving a live event from show-control software, a rundown system, or a script. It reads timer state, controls the running timer, and reads moderated Q&A questions, which is enough to keep an external cue system and the room screens in agreement. It is not a full management API: creating events and projects, editing teleprompter scripts, and configuring AI Interpreter all stay in the Questro app. Every endpoint lives under https://questro.live/api/v1, speaks JSON, allows cross-origin requests, and returns errors in one shape — an object with an error property carrying code and message.
Authenticate with a Personal Access Token created in Settings under Developer, and send it as an Authorization header of the form "Bearer qsk_…". Tokens are stored only as a SHA-256 hash, so the full value is shown once at creation and cannot be recovered afterwards; a lost token is revoked and replaced rather than looked up. A token carries the permissions of the account that created it and can be revoked at any time. Requests are limited to 60 per token per minute; over the limit the API answers 429 with a Retry-After header. Missing or invalid tokens return 401, and a project that does not exist or belongs to another account returns 404 in both cases, so the API never reveals which one it was.
GET /api/v1/timers/{projectId} returns the timer queue with live remaining seconds, the active timer id, and the currently visible speaker message. POST /api/v1/timers/{projectId}/control accepts a JSON body with an action of start, pause, reset, or next and an optional timerId, and applies it through the same transaction the operator UI uses, so external control and the operator page can never disagree about state. GET /api/v1/qa/{projectId}/questions returns the moderated question list and accepts an optional status filter of approved or answered; it reads the public display view, so it returns exactly what the room is allowed to see. Both timer endpoints also accept OPTIONS for CORS preflight.
Instead of polling, register one webhook URL per account in Settings under Developer and receive an HTTPS POST when something happens: timer.started, timer.paused, and qa.question.approved. Each delivery carries an X-Questro-Signature header of the form "sha256=<hex>", an HMAC-SHA256 of the exact raw request body computed with the signing secret shown when the webhook is saved — verify it with a constant-time comparison before trusting the payload. Deliveries are fire-and-forget with a five-second timeout and are not retried, so treat a webhook as a fast hint and the REST endpoints as the source of truth. The receiving URL must be HTTPS and publicly resolvable; IP literals and internal hostnames are rejected when the webhook is saved and again at delivery time.
The OpenAPI 3.1 description of every endpoint above is published at https://questro.live/openapi.yaml. Agent-facing guidance about when to reach for Questro, which links are public and which are private, and how to call the API is published at https://questro.live/agents.md, with a site-wide index at https://questro.live/llms.txt and the long-form version at https://questro.live/llms-full.txt. Marketing and documentation pages also answer to Accept: text/markdown and are mirrored as plain Markdown under https://questro.live/md/, so an agent can read a page without parsing the application shell.