API Authentication and Response Formats

Authentication headers

Every API request must include these headers:

Header	Required	Description
`user-id`	Yes	The client identifier issued by QuarkIP
`access-key`	Yes	The API key issued by QuarkIP

Example request:

GET /openapi/static/node/list?page_no=1&page_limit=20 HTTP/1.1
Host: {domain}
client-id: {your-user-id}
access-key: {your-access-key}

If either credential is missing, invalid, or does not match the other, the API may return 401 with the message authentication error.

Keep your credentials secure

Store and use API credentials only on trusted server-side systems.
Do not hard-code your access-key in browser-based JavaScript, mobile applications, or public repositories.
Do not share a complete API token in support tickets, chat messages, or screenshots.
Store credentials in environment variables or a dedicated secret-management service.
If you believe a credential has been exposed, stop using it and contact QuarkIP Support.

Endpoints that return a single object use the following structure:

{
  "code": 0,
  "msg": "Ok",
  "info": {}
}

Field	Description
`code`	Result code. A value of `0` indicates success.
`msg`	A short description of the result. Successful requests normally return `Ok`.
`info`	The data object returned by the endpoint.

Endpoints that return a list use the following paginated structure:

{
  "code": 0,
  "msg": "Ok",
  "info": {
    "items": [],
    "item_total": 0,
    "page_no": 1,
    "page_limit": 20
  }
}

Field	Description
`info.items`	The records returned on the current page.
`info.item_total`	The total number of matching records.
`info.page_no`	The current page number.
`info.page_limit`	The maximum number of records returned on the current page.

We recommend checking both the HTTP status and the code value in the response body:

Confirm that your client received a valid HTTP response.
Check that the response body contains "code": 0.
Read the requested data from info.
If code is not 0, log the code and msg values and handle the error accordingly.

Do not rely on the msg text alone, as the wording may vary depending on the validation error.