Connect ClearQuote to your fleet systems

API access uses your ClearQuote account. Call Login to get a token for all other calls. For integrations that run unattended, email us for a dedicated API user so the integration is not tied to a person's login.

Common use cases

Webhooks

When something happens in an inspection, we send a POST request with a JSON body to an HTTPS address you choose. Webhooks are push only: your system just receives requests, so no ClearQuote login is needed on your side.

Getting connected

1. Set up an HTTPS endpoint that replies with a 2xx within 10 seconds.
2. Fill in the webhook form with the events you want and where to send them.
3. We register it and send a connectionTest event to check we can reach you.
4. Once confirmed, events go live automatically.

Events

Select an event to see when it is sent and what it contains. Examples show only eventData; every event also carries the common fields.

"eventData": {
  "inspectionType": "Standard inspection"
}

"eventData": {
  "status": "estimationcompleted"
}

"eventData": {
  "hasNewDamage": true,
  "newDamages": [
    { "panel": "Bonnet", "type": "Dent" }
  ]
}

"eventData": {
  "data": {
    "failedItems": [
      { "itemName": "Tyres", "expected": "OK", "actual": "Not OK" }
    ]
  }
}

"eventData": {
  "damages": [ { "panel": "Rear door", "type": "Scratch" } ],
  "safetyAuditIssues": [ ]
}

"eventData": {
  "displayTotal": "450.00"
}

"eventData": {
  "validationCompletedAt": "2026-06-19T15:02:00.000Z"
}

Common fields

Every event has the same outer structure. Only eventData changes by event.

{
  "eventId": "cq_evt_550e8400-...",
  "timestamp": "2026-06-19T14:30:00.000Z",
  "eventType": "inspectionSubmitted",
  "dealerCode": "UK04",
  "inspectionId": "Q-abc123",
  "detailsLink": "https://...",
  "vehicleDetails": {
    "vin": "WVWZZZ3CZWE123456",
    "registrationNumber": "AB12 CDE",
    "make": "Volkswagen",
    "model": "Golf",
    "year": 2022
  },
  "dealerName": "Your account name",
  "driverName": "Inspector name or null",
  "pdfLink": "https://...",
  "eventData": { }
}

eventId

Unique per event. Use it to skip duplicates.

timestamp

Always UTC, ISO 8601.

dealerCode

Your ClearQuote account code, confirmed during setup.

inspectionId

The Quote ID. Use it with the API to fetch the full inspection.

pdfLink

Present once a PDF report has been generated.

Security

Live events include a signature header, and an auth token header if you chose one:

x-api-key

An auth token we generate for you, if you choose one in the form.

x-clearquote-signature

A hex encoded HMAC SHA256 of the exact request body, signed with a signing secret we generate for you. No prefix.

Checking the signature is optional but recommended. Compute it from the raw body exactly as received, before parsing the JSON.

const crypto = require('crypto');

function isValid(rawBody, signature, secret) {
  const expected = crypto.createHmac('sha256', secret)
    .update(rawBody).digest('hex');
  if (!signature || signature.length !== expected.length) return false;
  return crypto.timingSafeEqual(
    Buffer.from(expected), Buffer.from(signature));
}

import hmac, hashlib

def is_valid(raw_body: bytes, signature: str,
             secret: str) -> bool:
    expected = hmac.new(secret.encode(), raw_body,
                        hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature or "")

How we share your credentials: once your endpoint is registered, we email your auth token and signing secret only to the contacts on your ClearQuote account. Store it securely and do not forward it.

Delivery and retries

If your endpoint times out, or returns 5xx or 429, we retry after 1 minute, 5 minutes and 30 minutes. Other 4xx responses are not retried. Because of retries, an event can arrive more than once, so check eventId before processing.

No code options

Prefer not to build anything? These options need no development on your side.