Webhooks

Webhooks push inspection state changes to your server the moment they happen, so you don't have to poll. Set notify_url when you create an inspection, or configure a global endpoint in the dashboard.

Events

Event	Fires when
inspection.created	An inspection (and its capture link) is created.
inspection.started	The customer begins capturing.
inspection.processing	The walkthrough is submitted; detection is running.
inspection.completed	The report is ready.
inspection.expired	The link expired before submission.

Payload

{
  "id": "evt_7Kp2",
  "type": "inspection.completed",
  "created_at": "2026-07-21T09:20:41Z",
  "data": {
    "id": "insp_3fJ2c9",
    "reference": "claim_84213",
    "status": "completed",
    "report_url": "https://api.gauzr.com/v1/inspections/insp_3fJ2c9/report",
    "summary": { "findings": 3, "grade": "moderate" }
  }
}

Verifying signatures

Every delivery includes a Gauzr-Signature header — an HMAC-SHA256 of the raw request body, keyed with your endpoint's signing secret. Verify it before trusting the payload.

import crypto from 'node:crypto';

function verify(rawBody, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature),
  );
}

tip

Verify against the raw request body, before any JSON parsing re-serializes it — reformatting changes the bytes and breaks the signature.

Delivery and retries

Respond 2xx within 10 seconds to acknowledge. Non-2xx responses and timeouts are retried with exponential backoff for up to 24 hours. Handle events idempotently by keying on the event id — a retried delivery reuses it.