Complete iQ Inspect public API

Authentication

Send your key as Authorization: Bearer ciq_sk_live_… or in the x-api-key header. Keys belong to one organization, are stored only as a hash, and carry one or both scopes:

• inspections:read for status, reports, photos and templates
• inspections:write for creating inspections

Base URL: https://inspection360.ai/api/v1

Endpoints

Generated from the OpenAPI specification. Download it for the full request and response schemas.

Webhooks

Add an endpoint in Settings → API & Webhooks. Each endpoint gets a signing secret, shown once. Deliveries are POST requests with these headers:

• X-CIQ-Event: the event name
• X-CIQ-Delivery: a unique delivery ID. Deduplicate on it.
• X-CIQ-Signature: t=<unix-seconds>,v1=<hmac-hex>

{
  "event": "inspection.submitted",
  "id": "<delivery id, equals X-CIQ-Delivery>",
  "created_at": "2026-06-01T19:12:13.570Z",
  "data": {
    "entityType": "inspection_request",
    "entityId": "<inspection request id>",
    "eventType": "inspection_submitted"
  }
}

Verify every delivery

The signature is an HMAC-SHA256 of ${t}.${rawBody} using your endpoint's secret. Verify against the raw body bytes, use a constant-time comparison, and reject timestamps older than about five minutes.

import crypto from "node:crypto";

// Mount with a raw body parser so you verify the exact signed bytes:
//   app.post("/ciq-webhook", express.raw({ type: "application/json" }), handler)
function verifyCiqWebhook(req, secret, toleranceSec = 300) {
  const header = req.get("X-CIQ-Signature") || "";
  const parts = Object.fromEntries(header.split(",").map((kv) => kv.split("=")));
  const t = Number(parts.t);
  const sig = parts.v1;
  if (!t || !sig) return false;
  if (Math.abs(Date.now() / 1000 - t) > toleranceSec) return false;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${t}.${req.body}`)
    .digest("hex");
  const a = Buffer.from(sig);
  const b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

• At-least-once delivery. Failed deliveries retry with increasing delays (1m, 5m, 30m, 2h, 6h; up to six attempts).
• Ordering isn't guaranteed. Reconcile with the status endpoint when order matters.
• Acknowledge quickly. A non-2xx response or a reply slower than 10 seconds counts as a failure.

MCP server

The Model Context Protocol server exposes the API as tools for AI agents and assistants over Streamable HTTP at https://inspection360.ai/api/mcp. It uses the same API keys and scopes, and every tool calls the matching REST endpoint, so validation and idempotency behave identically.

{
  "mcpServers": {
    "complete-iq": {
      "url": "https://inspection360.ai/api/mcp",
      "headers": { "Authorization": "Bearer ciq_sk_live_..." }
    }
  }
}

The PDF report and photo ZIP are binary, so agents use the URLs returned by the inspection and photo tools.

Errors and rate limits

Errors use one envelope: { "error": { "code", "message" } }. Requests are limited to 120 per minute per client IP; beyond that you'll get HTTP 429, so retry with backoff.

Questions about the API? Email support@completeiq.com.