Getting started
Introduction
What the API does, what all its operations share and your first steps.
With the Qbox standard, self-storage management software publishes its customers' centres on quetrastero.com, with their sizes, their prices, their free units in real time and their floor plan, and receives their requests. It is the same for every software, and it is free.
- Your software calls our API and sends us every change as it happens: we don't poll you every few minutes.
- We check everything on the way in. What doesn't pass isn't published, and the response says which field fails and why.
- We send you signed webhooks: requests, review decisions and what a listing is missing.
- Each operator gives your software access from Qbox (OAuth 2.0). Your software only sees the operators that have given it access.
The basics
| What | How |
|---|---|
| Base URL | https://api.findqbox.com/connect/v1, the same for testing and production: each credential decides |
| Credentials | Your software's, in its area: client_id and client_secret, for testing (qt_test_…) and, once certified, for production (qt_live_…) |
| Tokens | Authorization: Bearer <token>. Each token belongs to an operator that gave access; it expires after an hour and is renewed with its refresh_token |
| Format | JSON in UTF-8, with camelCase names. Ignore anything you don't recognise in a response |
| Dates | YYYY-MM-DD; a month, YYYY-MM; moments, in ISO 8601 and UTC: 2026-10-26T08:15:00Z |
| Amounts | Up to two decimals, in euros, exactly as the centre has them: with or without VAT (pricesIncludeVat). The portal always shows the final price |
| Identifiers | Your software's own, opaque and stable (a GUID works): 1 to 64 letters, digits, ., _ or - |
| Messages | In Spanish or English, with Accept-Language: es or en. English by default. code values never change |
| Safe retries | Idempotency-Key (a UUID) on everything that changes something. See Errors and limits |
Get started in three steps
1. Get your credentials
Request access from the Developers page. Once we accept it, you create your test credentials in your area and give access to your “Test operator”, just as a real operator will: see The operator's permission.
2. Send a centre
With the operator's token, the whole centre, with its address, its location and its opening hours:
curl -X PUT https://api.findqbox.com/connect/v1/facilities/madrid-01 \
-H "Authorization: Bearer $TOKEN" \
-H "Idempotency-Key: $(uuidgen)" \
-H "Content-Type: application/json" \
-d @centre.jsonThen its sizes, its units and its floor plan: Publish your centres.
3. Receive webhooks
Set your webhook URL in your area and check each webhook's signature before using it: Webhooks.
The operations
| Scope | Operation | What for |
|---|---|---|
facilities.write | PUT /facilities/{facilityId} | Creates or updates a whole centre |
facilities.write | GET /facilities/{facilityId} | Its status on the portal and what it's missing |
facilities.write | DELETE /facilities/{facilityId} | Removes it from the portal |
facilities.write | PUT /facilities/{facilityId}/unit-types | Its sizes |
facilities.write | PUT /facilities/{facilityId}/units | All its units |
facilities.write | PUT /facilities/{facilityId}/units/{unitId} | A unit that changes, in real time |
facilities.write | PUT /facilities/{facilityId}/floor-plan | Its floor plan: one SVG per floor |
facilities.write | PUT /facilities/{facilityId}/photos/{photoId} | Uploads a photo |
facilities.write | PUT /facilities/{facilityId}/photos | The order of the photos and their captions |
facilities.write | PUT /facilities | The daily list |
leads.read | GET /leads | Requests from the last 30 days |
leads.read | PUT /leads/{leadId}/status | Marks a request as handled |
| Your software | GET /connections | The operators that have given you access |
| Your software | POST /webhooks/test | Sends you a test.ping webhook |