[Cotlet](https://cotlet.dev/index.md) · [Integrations](https://cotlet.dev/integrations.md) · [How it works](https://cotlet.dev/how-it-works.md) · [Use cases](https://cotlet.dev/use-cases.md) · [Security](https://cotlet.dev/security.md) · [For developers](https://cotlet.dev/for-developers.md) · [For automation agencies](https://cotlet.dev/for-agencies.md) · [Blog](https://cotlet.dev/blog.md) · [API docs](https://cotlet.dev/docs.md) · [Help center](https://cotlet.dev/help.md) · [Changelog](https://cotlet.dev/changelog.md) · [Contact](https://cotlet.dev/contact.md) · [Pricing](https://cotlet.dev/pricing.md) · [Sign up](https://cotlet.dev/signup)

# Quickbase API and MCP server

> Quickbase has a full RESTful API and an older XML API, but no official MCP server (checked 23 Oct 2026). The API adds, edits, deletes and searches records and builds tables and fields, and you call it with a user token that inherits your role. Quickbase's own AI, the Intelligence Package from April 2026, is a paid add-on that works inside Quickbase.

Low-code platform where teams build business apps: tables of records, forms, reports, user roles and Pipelines automations in one realm.

## What is the Quickbase API?

Cotlet's Quickbase API exposes 14 endpoints for your own Quickbase account: list apps, list tables, list reports, list form fields, run report, search records, get record, list app users, export report to CSV, create record, update record, delete record, share app with a user and change a user role. The list_apps endpoint returns Quickbase apps you can open, with your role in each. Each endpoint takes simple JSON inputs like app, table or report and works both as an operation of the quickbase_read or quickbase_write MCP tool for agents and as a REST call for scripts.

- **Category:** [Productivity & teams](https://cotlet.dev/integrations/category/productivity-teams.md)
- **Endpoints:** 14 (9 read, 5 write)
- **Updated:** 2026-10-20

Quickbase has a full RESTful API and an older XML API, but no official MCP server (checked 23 Oct 2026). Cotlet is a hosted MCP server and REST API for Quickbase with 14 endpoints (9 read, 5 write): you sign in once in your own cloud browser, your AI agent does the work.

## Does Quickbase have an official API?

Quickbase has a full RESTful API and an older XML API, but no official MCP server (checked 23 Oct 2026). The API adds, edits, deletes and searches records and builds tables and fields, and you call it with a user token that inherits your role. Quickbase's own AI, the Intelligence Package from April 2026, is a paid add-on that works inside Quickbase.

| Task | Quickbase official | Cotlet |
|---|---|---|
| Search records and read one record | Yes: RESTful API; you wrap it as agent tools and send a user token | Yes |
| Run a table report | Yes: RESTful API; no MCP server for agents | Yes |
| Create a record | Yes: RESTful API | Yes |
| Update a record | Yes: RESTful API | Yes |
| Delete records | Yes: RESTful API; Quickbase cannot bring a deleted record back | Yes |
| List apps, tables and fields | Yes: RESTful API | Yes |
| Share an app and change a user role | Partly: The XML API has role calls such as API_GetUserRole; Pipelines and the Users page cover the rest | Yes |
| Use it from an AI agent without a wrapper or a token | No | Yes |

Sources: [Quickbase Help: Welcome to the Quickbase API Guide](https://help.quickbase.com/hc/en-us/articles/4418310927892-Welcome-to-the-Quickbase-API-Guide), [Quickbase Help: Rate limiting overview](https://help.quickbase.com/docs/rate-limiting-overview), [Quickbase Help: Authentication and secure access](https://helpv2.quickbase.com/hc/en-us/articles/4418302304276-authentication-and-secure-access), [Quickbase: Intelligence Pack](https://www.quickbase.com/intelligence-pack)

## Quick reference

```text
Quickbase has a full RESTful API and an older XML API, but no official MCP server (checked 23 Oct 2026). The API adds, edits, deletes and searches records and builds tables and fields, and you call it with a user token that inherits your role. Quickbase's own AI, the Intelligence Package from April 2026, is a paid add-on that works inside Quickbase.
Cotlet provides a hosted MCP server and REST API for Quickbase: 14 tools (9 read, 5 write).
Access       Sign up at https://cotlet.dev/app/signup?app=quickbase, then request the app and create API keys in the Cotlet console.

MCP server   https://cotlet.dev/mcp/v1
MCP tools    quickbase_read, quickbase_write, reads and writes apart; call one with {"operation": "<operation>", "arguments": {...}}
REST base    https://cotlet.dev/api/v1/quickbase, each operation at its own route, e.g. POST /api/v1/quickbase/records
Auth         Authorization: Bearer <COTLET_API_KEY>. Listing endpoints and schemas needs no key; calling an endpoint needs one. Over MCP the input schemas come with sign-in.
Operations   list_apps, list_tables, list_reports, list_fields, run_report, search_records, get_record, list_users, export_report, create_record, update_record, delete_record, share_app, change_user_role
Confirm      delete_record, share_app, change_user_role (by default the user approves each call; the user can switch this off per tool, e.g. for scheduled automations)
Markdown     https://cotlet.dev/integrations/quickbase-api-mcp-server.md

How access works:
1. The user signs up at https://cotlet.dev/app/signup?app=quickbase, requests Quickbase in the Cotlet console and creates an API key there.
2. The user signs in to Quickbase once in their Cotlet Cloud Browser (their own Chrome in the cloud, opened from the console) and enables Quickbase for agents. An agent cannot do this step.
3. The API key goes into the MCP client or the REST call as a bearer token.

Fits: people who want a hosted Quickbase server that someone else maintains, including non-developers. Developers who prefer to run and fix code on their own computer can use an open-source Quickbase MCP server instead.

Policy: Cotlet never stores passwords, never solves CAPTCHAs, never bypasses MFA.
Company: legal details in the Terms of service at https://cotlet.dev/terms. Contact contact@cotlet.dev.
Sign-in: the user signs in to Quickbase in their own Cloud Browser, a Chrome Cotlet runs for them in the EU; password saving is off, the profile is AES-256-GCM encrypted, and agents get Quickbase only after the user enables it. Calls are requests from that browser's IP with its cookies, each listed in the user's Background activity. Disable for agents, signing out in the browser or Reset browser cuts access. Cotlet is run by Take Group sp. z o.o. (EU VAT PL6342984273).
API key: holds no Quickbase login or cookies, only asks Cotlet to run a tool. Each key is scoped to chosen apps and tools, read only or read and write. Actions that reach other people wait for the user's approval by default, so a leaked key cannot post or message as the user. Every call is in the activity log; deleting the key ends access at once.
Terms: the user stays responsible for following Quickbase's terms; Cotlet is not affiliated with Quickbase.
```

## What can an AI agent do in Quickbase?

Cotlet is best for Quickbase builders and operations teams who want their AI agent to read reports and update records without creating user tokens, or running or fixing a server.

- **[Reassign overdue work orders](https://cotlet.dev/integrations/quickbase-api-mcp-server/reassign-overdue-records.md)** (runs: weekly): "Run the Overdue work orders report in the Work orders table of Field Ops. For each row assigned to Sam Ortiz, set Assigned to Dana Whitfield and Priority High. Leave every other row alone and list what you changed." → `run_report`, `get_record`, `update_record`
- **[Add records from a list](https://cotlet.dev/integrations/quickbase-api-mcp-server/add-records-from-a-list.md)** (runs: daily): "Add each line of this list as a record in the Work orders table of Field Ops. Skip any title that already exists, set Priority High for lines marked urgent, and tell me which required fields you could not fill." → `list_fields`, `search_records`, `create_record`
- **[Export a report to CSV every week](https://cotlet.dev/integrations/quickbase-api-mcp-server/export-report-to-csv-weekly.md)** (runs: weekly): "Every Monday run Overdue work orders in the Work orders table of Field Ops, export it as CSV, and give me a count by site and the oldest due date." → `list_reports`, `export_report`
- **Review who has access to an app** (runs: weekly): "List everyone in the Field Ops app with their role. Tell me who is in an admin role, and move Sam Ortiz to Viewer once I confirm." → `list_users`, `change_user_role`
- **Look up a record and its status**: "Find the work order about the boiler in Field Ops and tell me its status, assignee and due date." → `search_records`, `get_record`

## Can Quickbase automations run on a schedule in n8n, Make or Zapier?

Yes. Cotlet does not replace your automation platform: it gives it a Quickbase connection it does not have, with the same API key as your agent. Write actions ask for your OK by default; switch that off in your dashboard for the tools you choose, for example to reassign overdue work orders, and the schedule runs on its own. Cotlet runs in the cloud, so it keeps going while your computer is off.

| Where | How to connect | How to schedule |
|---|---|---|
| Your AI agent | Add https://cotlet.dev/mcp/v1 with your API key. | A scheduled agent run, for example a Claude Code routine. |
| n8n | MCP Client node with https://cotlet.dev/mcp/v1, or an HTTP Request node with the endpoint's method and URL, such as GET https://cotlet.dev/api/v1/quickbase/reports/run. | Schedule Trigger node. |
| Make | HTTP module: the endpoint's method and URL with an Authorization: Bearer header, and a JSON body for POST, PUT and PATCH. | Scenario schedule. |
| Zapier | Webhooks by Zapier, Custom Request: the same method, URL, header and body. | Schedule by Zapier trigger. |
| Your own script | GET https://cotlet.dev/api/v1/quickbase/reports/run with your API key. | cron or GitHub Actions. |

## Tools

**For AI agents:** Every endpoint and its schema is public. The 14 endpoints on this page, with parameters and example responses, can be listed without an account. Calling one returns 401 without an API key and 403 while the key has no access to Quickbase.

### list_apps

Quickbase apps you can open, with your role in each. Access: read. REST: `GET /api/v1/quickbase/apps`. MCP: `quickbase_read → list_apps`.

No parameters.

Returns the apps on your My apps page for the signed-in realm, with your role in each as the app shows it. Use the app name it returns in every other tool. An app you were not shared with is not listed.

Example response:

```json
{
  "apps": [
    {
      "app": "Field Ops",
      "role": "Administrator",
      "url": "https://yourcompany.quickbase.com/nav/app/bq4k2xyz9"
    },
    {
      "app": "Sales Pipeline",
      "role": "Viewer",
      "url": "https://yourcompany.quickbase.com/nav/app/bq5m8wvt2"
    }
  ]
}
```

### list_tables

Tables in an app, as listed in the app's sidebar. Access: read. REST: `GET /api/v1/quickbase/tables`. MCP: `quickbase_read → list_tables`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `app` | string | yes | App name as it appears under My apps, e.g. 'Field Ops'. |

Returns the tables in the sidebar of one app, in sidebar order, with what the app calls their records (for example 'Work order'). Tables your role cannot open are not listed. Use the table name it returns in the other tools.

Example response:

```json
{
  "tables": [
    {
      "table": "Work orders",
      "record_name": "Work order"
    },
    {
      "table": "Sites",
      "record_name": "Site"
    },
    {
      "table": "Technicians",
      "record_name": "Technician"
    }
  ]
}
```

### list_reports

Reports of a table that your role can see. Access: read. REST: `GET /api/v1/quickbase/reports`. MCP: `quickbase_read → list_reports`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `app` | string | yes | App name as it appears under My apps, e.g. 'Field Ops'. |
| `table` | string | yes | Table name as it appears in the app's sidebar, e.g. 'Work orders'. |

Returns the reports in the Reports panel of one table, with the report type (table, chart and others). Reports hidden from your role, or set to 'No one; hide it', are not listed. Run one with run_report or export_report.

Example response:

```json
{
  "reports": [
    {
      "report": "List All",
      "type": "table"
    },
    {
      "report": "Overdue work orders",
      "type": "table"
    },
    {
      "report": "Work orders by site",
      "type": "chart"
    }
  ]
}
```

### list_fields

Fields of the Add record form of a table, with type and whether each is required. Access: read. REST: `GET /api/v1/quickbase/fields`. MCP: `quickbase_read → list_fields`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `app` | string | yes | App name as it appears under My apps, e.g. 'Field Ops'. |
| `table` | string | yes | Table name as it appears in the app's sidebar, e.g. 'Work orders'. |

Returns the fields the table's Add record form shows, in form order, with the field type and required marked as on the form (the asterisk). App builders decide which fields appear on the form, so a field that is not listed cannot be set with create_record. Read this before creating records so the agent fills every required field in the right format.

Example response:

```json
{
  "fields": [
    {
      "field": "Title",
      "type": "text",
      "required": true
    },
    {
      "field": "Site",
      "type": "list",
      "required": true
    },
    {
      "field": "Priority",
      "type": "list",
      "required": false
    },
    {
      "field": "Due",
      "type": "date",
      "required": false
    }
  ]
}
```

### run_report

Rows of a table report with their Record ID#, in the report order. Access: read. REST: `GET /api/v1/quickbase/reports/run`. MCP: `quickbase_read → run_report`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `app` | string | yes | App name as it appears under My apps, e.g. 'Field Ops'. |
| `table` | string | yes | Table name as it appears in the app's sidebar, e.g. 'Work orders'. |
| `report` | string | yes | Report name from list_reports, e.g. 'Overdue work orders'. |
| `limit` | integer | no | Rows to return in this call. |
| `cursor` | string | no | Next page cursor from the previous call. |

Opens one table report and returns its columns and rows in the order the report sorts them, each row with its Record ID#. Filters saved in the report apply; the dynamic filters are not changed. Pass next_cursor back as cursor for the next page. A chart report returns an error, because Quickbase has no row data for it; use a table report.

Example response:

```json
{
  "report": "Overdue work orders",
  "columns": [
    "Title",
    "Site",
    "Assigned to",
    "Due"
  ],
  "rows": [
    {
      "record_id": 1042,
      "values": [
        "Replace pump seal",
        "Plant North",
        "Sam Ortiz",
        "2026-10-17"
      ]
    },
    {
      "record_id": 1057,
      "values": [
        "Inspect boiler 3",
        "Plant South",
        "Lena Park",
        "2026-10-20"
      ]
    },
    {
      "record_id": 1063,
      "values": [
        "Repaint bay door",
        "Depot",
        "Sam Ortiz",
        "2026-10-21"
      ]
    }
  ],
  "next_cursor": null
}
```

### search_records

Records whose searchable report fields contain your text. Access: read. REST: `GET /api/v1/quickbase/records/search`. MCP: `quickbase_read → search_records`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `app` | string | yes | App name as it appears under My apps, e.g. 'Field Ops'. |
| `table` | string | yes | Table name as it appears in the app's sidebar, e.g. 'Work orders'. |
| `query` | string | yes | Text to search for. |
| `report` | string | no | Report to search in. Default: the table's default report. |
| `limit` | integer | no | Rows to return in this call. |
| `cursor` | string | no | Next page cursor from the previous call. |

Types your text into the Search box on the table home page and returns the matching rows. The Search box only checks fields that the report marks as searchable, so a value in another field is not found. Pass a report to search inside it; without one, the table's default report is used. Returns rows like run_report, with Record ID# for get_record and update_record.

Example response:

```json
{
  "report": "List All",
  "columns": [
    "Title",
    "Site",
    "Assigned to",
    "Due"
  ],
  "rows": [
    {
      "record_id": 1042,
      "values": [
        "Replace pump seal",
        "Plant North",
        "Sam Ortiz",
        "2026-10-17"
      ]
    }
  ],
  "next_cursor": null
}
```

### get_record

All fields of one record as the View record page shows them. Access: read. REST: `GET /api/v1/quickbase/records/{record_id}`. MCP: `quickbase_read → get_record`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `app` | string | yes | App name as it appears under My apps, e.g. 'Field Ops'. |
| `table` | string | yes | Table name as it appears in the app's sidebar, e.g. 'Work orders'. |
| `record_id` | integer | yes | Record ID# from run_report, search_records or create_record. |

Opens the View record page of one record and returns every field it shows, by field label. App builders decide which fields appear in view mode and your role decides which records you can open, so a field you cannot see is not returned. Use it to check a value right before update_record.

Example response:

```json
{
  "record_id": 1042,
  "table": "Work orders",
  "fields": {
    "Title": "Replace pump seal",
    "Site": "Plant North",
    "Assigned to": "Sam Ortiz",
    "Priority": "Normal",
    "Status": "Open",
    "Due": "2026-10-17"
  }
}
```

### list_users

Users of an app with their role, as the Users page lists them. Access: read. REST: `GET /api/v1/quickbase/users`. MCP: `quickbase_read → list_users`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `app` | string | yes | App name as it appears under My apps, e.g. 'Field Ops'. |
| `role` | string | no | Only users in this role, e.g. 'Technician'. |
| `cursor` | string | no | Next page cursor from the previous call. |

Returns the rows of the Users page of one app: name, email and role. Opening the Users page needs an App Admin or App Manager role, or the 'Manage users and share the app' permission on your role; other roles get APP_PERMISSION_DENIED. Filter by role to narrow the list. Pass next_cursor back as cursor for the next page.

Example response:

```json
{
  "users": [
    {
      "name": "Dana Whitfield",
      "email": "dana@example.com",
      "role": "Administrator"
    },
    {
      "name": "Sam Ortiz",
      "email": "sam@example.com",
      "role": "Technician"
    },
    {
      "name": "Lena Park",
      "email": "lena@example.com",
      "role": "Technician"
    }
  ],
  "next_cursor": null
}
```

### export_report

The CSV that the report's Download report as CSV icon gives. Access: read. REST: `GET /api/v1/quickbase/reports/export`. MCP: `quickbase_read → export_report`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `app` | string | yes | App name as it appears under My apps, e.g. 'Field Ops'. |
| `table` | string | yes | Table name as it appears in the app's sidebar, e.g. 'Work orders'. |
| `report` | string | yes | Report name from list_reports. A chart report cannot be exported. |

Opens a table report and returns the text of its CSV download. Quickbase exports any report type except charts. Totals and averages are not in the file, and file attachments are not exported. Column header renames made in Column Properties carry over into the file.

Example response:

```json
{
  "report": "Overdue work orders",
  "rows": 3,
  "csv": "Title,Site,Assigned to,Due\nReplace pump seal,Plant North,Sam Ortiz,2026-10-17\nInspect boiler 3,Plant South,Lena Park,2026-10-20\nRepaint bay door,Depot,Sam Ortiz,2026-10-21"
}
```

### create_record

Adds a record through the table Add record form. Access: write. REST: `POST /api/v1/quickbase/records`. MCP: `quickbase_write → create_record`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `app` | string | yes | App name as it appears under My apps, e.g. 'Field Ops'. |
| `table` | string | yes | Table name as it appears in the app's sidebar, e.g. 'Work orders'. |
| `fields` | object | yes | Field label to value, as on the Add record form, e.g. {'Title': 'Replace pump seal'}. |

Fills the table's Add record form and saves it. Fields are set by their label on the form; list_fields shows which ones exist and which are required. A value in the wrong format is rejected by Quickbase and nothing is saved. It reaches no one by itself and is undone with delete_record, so it does not wait for your OK. A Pipelines or notification rule in your app can still run on save, so a record can start work in the app.

Example response:

```json
{
  "record_id": 2318,
  "table": "Work orders",
  "fields": {
    "Title": "Replace pump seal",
    "Site": "Plant North",
    "Priority": "High",
    "Status": "Open"
  },
  "url": "https://yourcompany.quickbase.com/db/bq4k2xzab?a=dr&rid=2318"
}
```

### update_record

Changes fields of one record and returns the old values. Access: write. REST: `PATCH /api/v1/quickbase/records/{record_id}`. MCP: `quickbase_write → update_record`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `app` | string | yes | App name as it appears under My apps, e.g. 'Field Ops'. |
| `table` | string | yes | Table name as it appears in the app's sidebar, e.g. 'Work orders'. |
| `record_id` | integer | yes | Record ID# from run_report, search_records or create_record. |
| `fields` | object | yes | Field label to new value, e.g. {'Priority': 'High'}. Only these fields change. |

Opens the record in edit mode, sets the fields you pass and saves; fields you leave out stay as they are. The answer lists each changed field with its previous and new value, so a wrong change is undone by calling update_record with the previous values. If someone saved the same record while it was open, the call fails and changes nothing. It does not wait for your OK because it is undone in one call, but a Pipelines or notification rule in your app can still run on save, for example when you change who a record is assigned to.

Example response:

```json
{
  "record_id": 1042,
  "table": "Work orders",
  "updated": {
    "Assigned to": {
      "previous": "Sam Ortiz",
      "current": "Dana Whitfield"
    },
    "Priority": {
      "previous": "Normal",
      "current": "High"
    }
  }
}
```

### delete_record

Deletes one record. Quickbase cannot bring it back. Access: write, asks the user first. REST: `DELETE /api/v1/quickbase/records/{record_id}`. MCP: `quickbase_write → delete_record`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `app` | string | yes | App name as it appears under My apps, e.g. 'Field Ops'. |
| `table` | string | yes | Table name as it appears in the app's sidebar, e.g. 'Work orders'. |
| `record_id` | integer | yes | Record ID# from run_report, search_records or create_record. |

Deletes one record with the Delete record button of the edit page. It works only if your role may delete records; otherwise you get APP_PERMISSION_DENIED. Quickbase says a deleted record cannot be retrieved, so the answer returns the field values the record had, for you to keep. By default you confirm each call; you can switch that off for this tool.

Example response:

```json
{
  "record_id": 1063,
  "table": "Work orders",
  "deleted": true,
  "fields": {
    "Title": "Repaint bay door",
    "Site": "Depot",
    "Assigned to": "Sam Ortiz",
    "Status": "Open",
    "Due": "2026-10-21"
  }
}
```

### share_app

Adds a person to an app with a role, with or without an invitation email. Access: write, asks the user first. REST: `POST /api/v1/quickbase/app/share`. MCP: `quickbase_write → share_app`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `app` | string | yes | App name as it appears under My apps, e.g. 'Field Ops'. |
| `email` | string | yes | Email address of the person to add. |
| `role` | string | yes | Role name from list_users, e.g. 'Technician'. |
| `send_invitation` | boolean | no | true sends the invitation email. Default: true. |

Uses Share app with new user on the Users page: it adds the email address with the role you pick. Set send_invitation to true to send Quickbase's invitation email, false to add the person without one. Needs an App Admin or App Manager role, or the 'Manage users and share the app' permission. The role must exist in the app. By default you confirm each call; you can switch that off for this tool.

Example response:

```json
{
  "app": "Field Ops",
  "email": "priya@example.com",
  "role": "Technician",
  "invitation_sent": true
}
```

### change_user_role

Moves one user of an app to another role. Access: write, asks the user first. REST: `PATCH /api/v1/quickbase/user-role`. MCP: `quickbase_write → change_user_role`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `app` | string | yes | App name as it appears under My apps, e.g. 'Field Ops'. |
| `email` | string | yes | Email address of the user, as list_users shows it. |
| `role` | string | yes | New role name. It must exist in the app. |

Uses Change Role on the Users page: it selects the user by email and sets the new role. The user's access to the app changes at once, and the answer returns the previous role so you can switch back. Needs an App Admin or App Manager role, or the 'Manage users and share the app' permission. By default you confirm each call; you can switch that off for this tool.

Example response:

```json
{
  "app": "Field Ops",
  "email": "sam@example.com",
  "previous_role": "Technician",
  "role": "Viewer"
}
```

## How do I connect Quickbase to Claude Code, Codex or Cursor?

Connecting Quickbase takes three steps: sign up, sign in to Quickbase once in your Cloud Browser and enable it for agents, then add one MCP server or call the REST API with the same key.

### Connect Quickbase to your agent.

1. **Create an account** Sign up and add Quickbase in the console. Your API key is there too.

2. **Sign in to Quickbase in your Cloud Browser** Open your Cloud Browser in the console: your own Chrome in the cloud. Sign in to Quickbase there yourself, the way you always do, then press Enable for agents, read only or read and write. We never save your password, and your agent keeps working even when your computer is off.

3. **Add Cotlet to your agent** Paste the snippet for your client. The same server and key serve every app you connect, so you do this once.

   Claude Code:

```
claude mcp add --transport http cotlet \
  https://cotlet.dev/mcp/v1 \
  --header "Authorization: Bearer $COTLET_API_KEY"
```

   Cursor:

```
{
  "mcpServers": {
    "cotlet": {
      "url": "https://cotlet.dev/mcp/v1",
      "headers": {
        "Authorization": "Bearer ${COTLET_API_KEY}"
      }
    }
  }
}
```

   Codex:

```
# ~/.codex/config.toml
[mcp_servers.cotlet]
url = "https://cotlet.dev/mcp/v1"
bearer_token_env_var = "COTLET_API_KEY"
```

4. **Ask your agent** Ask in plain words. Your agent finds the Quickbase tools on the server and calls them for you; anything that reaches other people waits for your OK unless you switch that off for a tool.

```
Run the Overdue work orders report in the Work orders table of Field Ops. For each row assigned to Sam Ortiz, set Assigned to Dana Whitfield and Priority High. Leave every other row alone and list what you changed.
```

### Call Quickbase from your scripts.

1. **Export your API key** Your scripts use the same API key as your agent. Keep it in an environment variable, never in your code.

```
export COTLET_API_KEY="cotlet_..."
```

2. **Call a tool** Every tool is an endpoint under /api/v1/quickbase with its own method and path, listed with the endpoints above. Path parameters go in the URL; the other parameters go in the query for GET and DELETE and in a JSON body otherwise.

```
curl -X POST https://cotlet.dev/api/v1/quickbase/records \
  -H "Authorization: Bearer $COTLET_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"app":"Field Ops","table":"Work orders","fields":{"Title":"Replace pump seal","Site":"Plant North","Priority":"High"}}'
```

3. **Read the result** You get plain JSON back, ready for your script. A failed call costs nothing.

```
{
  "record_id": 2318,
  "table": "Work orders",
  "fields": {
    "Title": "Replace pump seal",
    "Site": "Plant North",
    "Priority": "High",
    "Status": "Open"
  },
  "url": "https://yourcompany.quickbase.com/db/bq4k2xzab?a=dr&rid=2318"
}
```

## Why use Cotlet for Quickbase?

**Built for agents**

- One MCP server for every app you connect.
- The same tools as a REST API for scripts and cron jobs.
- Works with Claude Code, Codex and Cursor.

**Your login stays yours**

- You sign in to Quickbase yourself, in your own Cloud Browser. We never save your password; the profile is encrypted with AES-256-GCM, the cipher 1Password uses.
- A+ on Qualys SSL Labs, securityheaders.com and Mozilla Observatory.
- The model never sees a login.
- No stored passwords, no CAPTCHA solving, no MFA bypass.

**You stay in control**

- Scope each API key: its apps, its tools, read only or read and write.
- Anything that reaches other people waits for your OK, so a leaked key cannot post or message as you.
- Every background request listed in your Background activity. Disable for agents in one click.

**Kept working for you**

- We test every integration every 6 hours.
- When Quickbase changes, the tool pauses until we fix it.
- Failed calls cost nothing.

## Is it safe to connect Quickbase to Cotlet?

Yes. You sign in to Quickbase yourself, in your own Cloud Browser, and we never save your password. Your agents only get Quickbase once you enable it, and every background request is listed. The browser profile is stored encrypted with AES-256-GCM, the same cipher 1Password uses for its vaults and Apple for iCloud Keychain. Independent public scanners grade cotlet.dev A+ and find it clean; click a result to rerun it yourself.

- **A+ on Qualys SSL Labs**: Encryption in transit: TLS setup and certificates, on all four server addresses. [Live result](https://www.ssllabs.com/ssltest/analyze.html?d=cotlet.dev)
- **A+ on securityheaders.com**: Browser protections sent with every page, all six headers present. [Live result](https://securityheaders.com/?q=cotlet.dev&followRedirects=on)
- **A+ on Mozilla Observatory**: Mozilla's web security baseline: score 120 of 100, 12 of 12 tests passed. [Live result](https://developer.mozilla.org/en-US/observatory/analyze?host=cotlet.dev)
- **Clean on Sucuri SiteCheck**: No malware, spam or defacement, and not on any of 9 blocklists, Google Safe Browsing included. [Live result](https://sitecheck.sucuri.net/results/cotlet.dev)

[How Cotlet protects your access](https://cotlet.dev/security.md)

### Common concerns

**Who runs Cotlet?**

Cotlet is run by Take Group, a Polish software company working since 2019. Take Group runs about 3,200 websites on its own systems and has its own DevOps team for infrastructure security. We built and used integrations like this inside the company for years before opening them as Cotlet.

**Is this an official Quickbase integration?**

No, Cotlet is independent of Quickbase. Quickbase's own API is too limited for this work. Cotlet works through your own Quickbase account, the way you use Quickbase in the browser, so you need no partner approval and no developer setup.

**What about client data and GDPR?**

Cotlet is run from the EU and follows the GDPR. Cloud Browsers run in Finland, a Tier 1 country in the ITU Global Cybersecurity Index 2024. Data passes through a call and is not kept after it.

**Can I start with read only?**

Yes. Enable the app for agents as read only, or make the API key read only, and anything that reaches other people waits for your OK unless you switch that off per tool.

**Is it reliable?**

Every Cotlet service is checked every 3 minutes from Europe, North America, Asia and Australia. The live results and any outage are public at status.cotlet.dev.

**How do I stop?**

Press Disable for agents next to Quickbase in your console: your agents lose access at once and you stay signed in. Signing out of Quickbase in the browser works too, and Reset browser deletes the whole profile.

## Is there a Quickbase MCP server on GitHub?

Yes. Community Quickbase MCP servers exist on GitHub, usually maintained by one person. You install one on your own computer, give it a user token, and fix it when Quickbase changes; most run locally. Cotlet hosts the same kind of server for you, and our team keeps it working. If you already run a script with a user token, the API does the same job for free.

|  | GitHub MCP server | Cotlet |
|---|---|---|
| Setup | Clone the repo, create a user token, set realm and app ID, add it to each MCP client | Sign up, sign in to Quickbase once, add one MCP server or API key |
| When Quickbase changes | It breaks until you or the maintainer fix it | Our team tests it daily and fixes it for you; failed calls are free |
| Your Quickbase access | A user token in a file on your computer, readable by any program you run | Signed in inside your own Cloud Browser in the EU, profile encrypted, only for the apps you enable, disabled for agents in one click |
| When access expires | Tools fail until you create a new token or sign in again by hand | Your Cloud Browser keeps you signed in; if Quickbase logs you out, your agent gets a link to sign in again |
| Upkeep | You update, monitor and debug it yourself | Nothing to host or update |
| Where it runs | Your computer, while it is on | Hosted: Claude Code, Codex, Cursor, n8n and scripts, also on a schedule |
| Price | Free, paid for with your time | Free 7-day trial, then pay-as-you-go credit packs, no subscription |

### Which one fits you

**Pick Cotlet if**

- you are not a developer, or you do not want to maintain a server
- you need it to keep working when Quickbase changes, without checking it yourself
- your agent or a script should run it on a schedule, also while your computer is off

**Pick an open-source server if**

- you are comfortable installing, updating and fixing it yourself
- you want your sign-in to stay on your own computer
- you only need it now and then, from one MCP client

## How much does the Quickbase API cost?

Free 7-day trial with 2,000 credits, no card needed. After that, the Quickbase API is pay as you go with no limit on apps: Credit packs from $29 for 5,000 credits, one-time, no subscription. A successful call uses 10 credits (about $0.04 to $0.06), your Cloud Browser uses 50 credits a day while it has an app enabled for agents, however many apps that is, and an agent driving the browser itself uses 5 credits a minute. Credit packs stay valid for 12 months and stack, so unused credits carry over.

| Credits | Price, one time | Calls at 10 credits | Per 1,000 credits |
|---|---|---|---|
| 5,000 | $29 | 500 | $5.80 |
| 15,000 | $79 | 1,500 | $5.27 |
| 32,000 | $149 | 3,200 | $4.66 |
| 60,000 | $249 | 6,000 | $4.15 |

Only successful calls use credits; failed calls and timeouts cost nothing. At a balance of 0 calls pause, never a surprise charge. Authenticate with the `Authorization: Bearer` header. [See full pricing](https://cotlet.dev/pricing.md)

## How Cotlet holds your access

Cotlet hosts MCP servers and REST APIs for apps with no usable API. Your agent works in your own Quickbase account.

- **Company details:** Cotlet is run by Take Group sp. z o.o., a company registered in Poland. Its full address and registration numbers are in the Terms of service. [Terms of service](https://cotlet.dev/terms)
- **Your sign-in:** You sign in to Quickbase yourself, in your own Cloud Browser: a Chrome we run for you in the EU, one per app. We never save your password (password saving is off), the profile is stored encrypted with AES-256-GCM, and your agents get Quickbase only after you enable it. When Quickbase signs you out, your agent gives you a link to sign in again. [Security](https://cotlet.dev/security.md)
- **Revoking access:** Press Disable for agents next to Quickbase, sign out of Quickbase in your Cloud Browser, or reset the browser. Every background request is listed in your Background activity. Actions that reach other people wait for your OK unless you switch that off per tool.
- **What we never do:** Store passwords, solve CAPTCHAs or bypass MFA.
- **Quickbase's terms:** You use your own Quickbase account and stay responsible for following Quickbase's terms. Cotlet is independent and not affiliated with Quickbase. [Terms](https://cotlet.dev/terms)
- **Contact:** Questions about the company, security or an app: [contact@cotlet.dev](mailto:contact@cotlet.dev)

## Frequently asked questions

**How do I get access?**

Sign up free, open Quickbase in the console and press Request access. Then you create your API key and connect Quickbase there.

**Do I need to be technical?**

No. You sign in to Quickbase once in your Cloud Browser, a normal Chrome you open from the console, and paste one command into your agent, or one URL into n8n. Your agent can walk you through it. There is no server to install, update or fix.

**Is it safe to connect Quickbase to Cotlet?**

Yes. You sign in to Quickbase yourself, in your own Cloud Browser in the EU, and we never save your password. Your agents only get Quickbase once you enable it, every background request is listed, and the browser profile is stored encrypted with AES-256-GCM, the cipher 1Password uses for its vaults. The AI model never sees a login, posts and messages wait for your OK, and Disable for agents cuts access in one click. Independent scanners grade cotlet.dev A+ on Qualys SSL Labs, securityheaders.com and Mozilla Observatory; live results are on https://cotlet.dev/security.

**Is a hosted server safer than a local one? My Quickbase sign-in would leave my computer.**

On Cotlet you sign in inside your own Cloud Browser, which only you open, and its profile is stored encrypted with AES-256-GCM in the EU. Agents get only the apps you enable, and every background request is listed. A local server keeps your Quickbase cookie in a plain file on your computer, readable by any program you run, and stops when your computer is off.

**Why does Cotlet send requests instead of clicking in my browser?**

To be fast, Cotlet doesn't click through Quickbase's pages. It sends the same requests your browser would, from your browser's IP with its cookies, without opening a window. Quickbase sees the same browser and IP you signed in with, and every request is listed in your Background activity.

**What if someone gets my Cotlet API key?**

The key holds no Quickbase login or cookies, it only asks Cotlet to run a tool. It can call only the apps and tools you gave it, and a read-only key changes nothing. Anything that reaches other people, like posts, comments or messages, waits for your OK in the dashboard by default, so a leaked key cannot post or message as you. When you switch approval off for a scheduled job, give that job its own key limited to that one tool. Every call is in your activity log, and deleting the key ends access at once.

**Why a signed-in browser and not OAuth, like other integration platforms?**

Quickbase offers no OAuth token you can simply grant for these tools: its official API leaves them out or needs a developer app, a plan or an approval first (see the official API section above). That is why Cotlet sets the limits itself: per key, per tool, with your approval before anything reaches other people. Cotlet is run by Take Group sp. z o.o., an EU company (VAT PL6342984273).

**Which Quickbase role does my agent need?**

Your agent works as you, so your role in each app decides what it can do. Quickbase shows the Delete record button only if you have permission to delete records, and the Users page needs an App Admin or App Manager role or the 'Manage users and share the app' permission. A call without the right role fails with APP_PERMISSION_DENIED. list_apps shows your role in each app.

**Does Quickbase's own AI do the same?**

Quickbase's Intelligence Package, an add-on sold as one bundle, has an AI Agent that helps users make edits, build reports and manage workflows inside Quickbase (checked 23 Oct 2026). Its page describes no way to connect an outside AI agent. Cotlet works from the agent you already use, such as Claude Code, n8n or a script.

**Can my agent create tables or fields?**

No. The tools read apps, tables, reports and records, write records, and manage app users. Building tables and fields stays in Quickbase's builder or its API, which does cover them.

**Can my agent post or send messages in Quickbase without asking me?**

No. Every call to delete_record, share_app or change_user_role waits for your OK by default. For scheduled automations you can switch confirmation off per tool in your dashboard, for example only for approvals. create_record and update_record run without asking, because they send nothing to anyone and one call undoes it.

**Can I use the Quickbase API in n8n?**

Yes. Add https://cotlet.dev/mcp/v1 with your API key in n8n's MCP Client node, or call its endpoints under https://cotlet.dev/api/v1/quickbase from the HTTP Request node.

---

Give your AI agents your signed-in browser.

**Product:** [Integrations](https://cotlet.dev/integrations.md) · [Use cases](https://cotlet.dev/use-cases.md) · [How it works](https://cotlet.dev/how-it-works.md) · [Pricing](https://cotlet.dev/pricing.md) · [Security](https://cotlet.dev/security.md)

**Resources:** [Blog](https://cotlet.dev/blog.md) · [API docs](https://cotlet.dev/docs.md) · [Help center](https://cotlet.dev/help.md) · [Changelog](https://cotlet.dev/changelog.md) · [GitHub](https://github.com/cotletdev/cotlet)

**Solutions:** [For developers](https://cotlet.dev/for-developers.md) · [For automation agencies](https://cotlet.dev/for-agencies.md)

**Company:** [About](https://cotlet.dev/about.md) · [AI info: company facts](https://cotlet.dev/ai-info.md) · [Contact](https://cotlet.dev/contact.md)

**Legal:** [Terms of service](https://cotlet.dev/terms) · [Privacy policy](https://cotlet.dev/privacy) · [Refund policy](https://cotlet.dev/refunds) · [Acceptable use](https://cotlet.dev/acceptable-use) · [Cookie policy](https://cotlet.dev/cookies) · [DPA](https://cotlet.dev/dpa) · [Subprocessors](https://cotlet.dev/subprocessors)

**Elsewhere:** [Status page](https://status.cotlet.dev) · [Cotlet on GitHub](https://github.com/cotletdev) · [Cotlet on X](https://x.com/cotletdev) · [Cotlet on LinkedIn](https://www.linkedin.com/company/cotletdev) · [Cotlet on Product Hunt](https://www.producthunt.com/products/cotlet) · [Cotlet on Crunchbase](https://www.crunchbase.com/organization/cotlet) · [Cotlet on SaaSHub](https://www.saashub.com/cotlet)

Cotlet.dev is built by Bart Krawczyk and Jake Slugocki, the founders of Take Group sp. z o.o., ul. Wincentego Janasa 4, 40-855 Katowice, Poland. KRS 0000871398, NIP 6342984273, VAT EU: PL6342984273. [About us](https://cotlet.dev/about.md)

Cotlet is an independent service. It is not affiliated with, endorsed by or sponsored by any of the products listed on this site. Product names are trademarks of their respective owners.