Public API v2.2 — build VIP into your ERP, CRM, and dashboards

Quickstart

1. Open Settings → API Keys and generate a key. Choose live or test and the scopes the integration needs.
2. Copy the key immediately — it is hashed at rest and never shown again.
3. Send it as a bearer token on every request.

curl https://virtualinspection.ai/api/public/v2/inspections?limit=25 \
  -H "Authorization: Bearer vip_live_xxxxxxxxxxxxxxxx"

Base URL: https://virtualinspection.ai/api/public/v2. All requests and responses are JSON over HTTPS. CORS is enabled, but keys must never be shipped in browser code.

Smarter response filtering in v2.2

v2.2 makes retrieval far more targeted, so integrations pull only what they need:

• New fields: reference_id and isFlagged are returned on responses, so records line up with your own work-order numbers and exception queues.
• Better targeting: fetch responses for specific question_ids, or set flagged=true to retrieve only flagged items.
• New filters: narrow lists by status, updated_after, and template_id — ideal for incremental syncs on a schedule.

Webhooks

Subscribe endpoints in Settings → Webhooks. Choose the events you want and, optionally, exactly which fields the payload should include.

Sample payload

{
  "id": "evt_01J9…",
  "type": "inspection.completed",
  "created_at": "2026-08-05T17:42:11.204Z",
  "data": {
    "inspection": {
      "id": "b1f4…",
      "status": "completed",
      "reference_id": "WO-88213",
      "address": "1420 W Grand Ave, Chicago IL",
      "completed_at": "2026-08-05T17:42:09.000Z"
    }
  }
}

Verifying the signature

Every delivery carries x-vip-signature: t=<unix>,v1=<hex>. Compute HMAC-SHA256 over `${t}.${rawBody}` with your endpoint secret and compare using a timing-safe check.

import { createHmac, timingSafeEqual } from "crypto";

function verify(rawBody, header, secret) {
  const parts = Object.fromEntries(
    header.split(",").map((kv) => kv.split("=", 2)),
  );
  const age = Math.abs(Date.now() / 1000 - Number(parts.t));
  if (age > 300) return false; // reject replays older than 5 minutes

  const expected = createHmac("sha256", secret)
    .update(`${parts.t}.${rawBody}`)
    .digest("hex");

  const a = Buffer.from(parts.v1), b = Buffer.from(expected);
  return a.length === b.length && timingSafeEqual(a, b);
}

Retries: non-2xx responses and timeouts are retried with exponential backoff. Persistent failures disable the endpoint and surface a failure count in Settings, where you can re-enable it once your receiver is healthy. Deliveries can repeat, so make handlers idempotent on the event id.

Zapier & CRM integration

Connect HubSpot, Zoho, Dynamics 365, Zendesk, Genesys, Procore and hundreds of other systems without custom code. Create a key with the read and write scopes, paste it into the Zapier connection screen, and the app authenticates against GET /v2/me.

Start a session from any CRM record

curl -X POST https://virtualinspection.ai/api/public/v2/sessions \
  -H "Authorization: Bearer vip_live_…" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: WO-4821" \
  -d '{
    "customer_name": "Jane Doe",
    "customer_phone": "+15551234567",
    "address": "12 Elm St, Austin TX",
    "job_reference": "WO-4821",
    "source": "zapier",
    "send_sms": true
  }'

Send an Idempotency-Key header so a retried automation returns the original session instead of creating a duplicate. SMS is best-effort — if it can't send, sms.sent is false with a reason and join_url is still returned so your CRM can deliver it.

Subscribe to finished reports

curl -X POST https://virtualinspection.ai/api/public/v2/hooks \
  -H "Authorization: Bearer vip_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "target_url": "https://hooks.zapier.com/hooks/catch/123/abc/",
    "event_type": "report.completed"
  }'
# -> { "data": { "id": "…", "secret": "whsec_…" } }

The signing secret is returned once at subscribe time — store it and verify every delivery as shown above. Remove a subscription with DELETE /v2/hooks/{id}.

Developer FAQ