How to get started with the Questa Developer Platform

Register on the Questa Developer Platform using an email address. It’s a standard signup — once you’re in, you land in a dashboard where projects, keys, and credit balance all live.

A project is the container for a given integration — its own keys, its own usage tracking, and eventually its own webhook and integration settings. If you’re building more than one integration, separate projects keep usage and permissions from getting muddled together.

Questa authenticates requests through API keys and OAuth 2.0 bearer tokens — most first integrations build a bearer token from the API key. The part that actually matters is picking the right key for where the code runs:

With a key in hand, send text to the redaction endpoint and see what comes back.

import requests

API_KEY = "YOUR_QUESTA_API_KEY"  # replace with your development key
ENDPOINT = "https://api.questa-ai.com/v1/redact"

headers = {
    "Authorization": f"Bearer {API_KEY}",
    "Content-Type": "application/json",
}

payload = {
    "text": "Hi, this is John Carter. Reach me at john.carter@email.com.",
    "rules": ["PII", "EMAIL", "NAMES"],
    "anonymize": True,
}

response = requests.post(ENDPOINT, headers=headers, json=payload)
sanitized_output = response.json()

print(sanitized_output)

Authorization carries the key as a bearer token, tying the request to your project’s permission scope. rules sets which categories to look for. anonymize: true tells the endpoint to transform the flagged content, not just detect it. Run it, and the response comes back with names and emails swapped out or masked, everything else untouched.

Before touching application code, the Playground lets you submit text or files for redaction and see exactly what comes back. It supports sandbox and live keys — sandbox runs are free, live runs draw from your credit balance. It’s the fastest way to answer “what does Questa do with this specific kind of sensitive data” before writing any integration code.

Once the redaction behavior checks out, wire the same request pattern into your app — swap the development key for a staging key in CI/CD, then a production key once RBAC approval is in place. The request structure doesn’t change; the key, environment, and data do.

The Developer Platform includes a webhooks section for notifying your systems about events instead of polling for status. Event types, payload structure, and retry behavior aren’t detailed in the Quick Start material — check the API documentation directly before building around them.