IQValidate

API Documentation

The integration API and signed webhooks that work today

Base URL:https://your-domain.com

What is available

The public REST API v1 is not available yet

There is no public REST API for jobs, drives, wipe records or certificates yet. Do not build against paths under /api/v1. Pages in the web app call other routes that sign in with your browser session; those are not part of an API and can change at any time.

Two things work with a key or a signature today, and this page documents only those:

  • Integration API: a few routes under /api/integrations that read items and manage clients, called with an integration API key.
  • Webhooks: IQValidate sends a signed message to your server when a wipe, job, certificate or destruction finishes.

Authentication

Integration API requests use an integration API key as a Bearer token. An administrator creates the key in Settings > Integration API Keys and picks which scopes it has. The key is shown once, so store it safely.

Request Header

Authorization: Bearer your_api_key_here

Scopes the routes check

clients:readList clients and read one client
clients:writeCreate a client
items:readList items and read one item
integrations:writeSet up or remove a client's ServiceNow connection

Other limits

  • A key can have an expiry date and a list of allowed IP addresses. A request from another address is refused.
  • Every request is limited to the organization that owns the key.

Error Responses

A missing, invalid or expired key, a blocked address or a missing scope returns HTTP 401. A missing record returns 404. A bad body returns 400.

{
  "error": "Invalid or expired API key"
}

Integration API

For other systems

These routes let another system look up items and keep a list of clients in step. All of them need an integration API key (see Authentication). There is no create or update route for items.

Webhooks

Set up

An administrator adds an endpoint and picks its events in Settings > Webhooks. The signing secret (it starts with whsec_) is shown once. Webhook endpoints are managed in the web app, not through an API key.

What your server receives

A POST with a JSON body. timestamp and eventId repeat occurredAt and id for older integrations. Use id to ignore a repeated delivery.

{
  "event": "job.completed",
  "version": 1,
  "id": "evt_1760000000000_ab12cd",
  "occurredAt": "2026-10-16T14:30:00.000Z",
  "organizationId": "org_abc",
  "data": {
    "jobId": "job_abc",
    "status": "COMPLETED"
  }
}

Headers

X-IQValidate-Signature: t=1760625000,v1=<hex HMAC SHA-256>
X-IQValidate-Event: job.completed
X-IQValidate-Delivery: <delivery id>
User-Agent: IQValidate-Webhooks/1.0

Check the signature

Build the text t + "." + rawBody from the exact bytes you received, compute an HMAC SHA-256 with your signing secret, and compare it with v1 in constant time. Reject old timestamps to stop replays.

const crypto = require('crypto')

function isValid(rawBody, header, secret) {
  const parts = Object.fromEntries(header.split(',').map(p => p.split('=')))
  const expected = crypto.createHmac('sha256', secret)
    .update(parts.t + '.' + rawBody)
    .digest('hex')
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1))
}

Delivery

  • Answer with any 2xx status to confirm. Anything else, or no answer in time, is tried again.
  • Each endpoint has its own timeout and number of retries (the defaults are 30 seconds and 5). The wait before each retry doubles.
  • Delivery history for each endpoint is in Settings > Webhooks.

Events that are sent

job.completedA wipe job finished and every drive was handled. data: jobId, status, workOrder, drives (total, completed, failed, cancelled), completedAt.
job.failedA wipe job ended as failed. Same data as job.completed.
job.cancelledA wipe job was cancelled. Same data as job.completed.
drive.wipedOne drive was wiped successfully. data: wipeLogId, jobId, driveNumber, serial, model, sizeBytes, workOrder, result, certificateNumber, endedAt.
certificate.generatedA certificate was issued.
destruction.completedA destruction session was completed.
sanitization.batch_completedEvery drive of a work order batch was wiped.
item.status_changedAn item’s status changed after a wipe. data: assetId, serialNumber, previousStatus, newStatus, trigger, result, agentId.

The data holds ids and plain facts only: no passwords, tokens, host names or user names.

Need something that is not here?

Tell us what your system needs to read or send, and we will plan it.

Contact us