Webhooks, signed and sent as inspections move
Ready To Inspect sends a signed webhook to your own HTTPS endpoint when an inspection is submitted, approved or sent back, or a client signs off, so your systems hear about it without anyone watching RTI.
- Signed with HMAC-SHA256
- Four events, plus a test
- Queued, retried, replayable
Made for teams that connect RTI to their own tools
- Developers who feed inspection events into an internal system or a data warehouse
- Operations leads who start a follow-up in their own tools when work is approved or sent back
- Owner's reps whose own trackers should know when a client signs off
- Your systems hear about a review when it is decided, not when someone exports a report.
- Every request is signed with a secret only your endpoint and RTI hold, so your endpoint can refuse anything RTI did not send.
- A delivery that fails is retried and logged, admins are told when one runs out of retries, and an admin can replay it.
What goes wrong when news of a review is passed along by hand
Status by export
Someone exports a report and pastes it into the next system, a day after the review.
Unverified calls
An endpoint that takes any request cannot tell a real event from a forged one.
Lost messages
A message sent once to a server that was down is gone, and nobody knows it is missing.
With the integration
- Inspection events, sent as they happen
- Every request signed and checkable
- Failures retried, logged and replayable
When an inspection is submitted, approved or sent back, or a client signs it off, RTI posts the event as JSON to each active endpoint subscribed to it, signed with that endpoint's own secret.
From the review board to your endpoint
Add an endpoint
Stays in RTI- Who acts
- A workspace admin
- In RTI
- Adds an HTTPS address in Integrations, then Webhooks, and picks the events it gets. Private, loopback and internal addresses are refused.
- What RTI sends or reads
- Nothing is sent yet. RTI makes a signing secret for the endpoint, shows it once and stores it encrypted.
- Trigger
- Add endpoint
Send a test
Sends to your endpoint- Who acts
- A workspace admin
- In RTI
- Clicks Send test on the endpoint.
- What RTI sends or reads
- RTI posts a test.ping event, signed like any other, and shows the HTTP result straight away.
- Trigger
- Send test
An inspection moves
Sends to your endpoint- Who acts
- Inspectors, QA/QC managers and clients
- In RTI
- An inspection is submitted, approved or sent back, or a client signs off an approved inspection in the client portal.
- What RTI sends or reads
- RTI posts the event to each endpoint subscribed to it: the tag, project, status, inspector, reviewer notes and dates, signed in the X-RTI-Signature header.
- Trigger
- Submit, approve, send back or sign off
Retry until it lands
Sends to your endpoint- Who acts
- RTI
- In RTI
- Queues each delivery before sending it. Recent deliveries shows what was delivered, what is waiting and what failed.
- What RTI sends or reads
- A delivery that gets anything but a 2xx within 10 seconds is tried up to five times in all, at least 1, 5, 30 and then 120 minutes apart. A 429 waits for your Retry-After; a 410 stops that delivery.
- Trigger
- A delivery that does not go through
Replay a failure
Sends to your endpoint- Who acts
- A workspace admin
- In RTI
- Sees the failed delivery in Recent deliveries. Admins and QA/QC managers also get a notice when a delivery runs out of retries.
- What RTI sends or reads
- Replay sends the same event again, at once, with the same delivery ID.
- Trigger
- Replay
The event RTI sends
| Field | Example value |
|---|---|
| X- | submission.approved |
| X- | t=1789410552,v1=4be1c9…a07e |
| X- | c41d7e0a-… |
| event | submission.approved |
| sent_ | 2026-09-14T18:29:12.408Z |
| submission. | 8f2a… |
| submission. | approved |
| submission. | Riverside Commons |
| submission. | 2b71… |
| submission. | RIV-A-F3-210 |
| submission. | Unit |
| submission. | Sam Cortez |
| submission. | No open defects |
| submission. | 2026-09-12T15:02:44.123456+00:00 |
| submission. | 2026-09-12T16:10:03.881204+00:00 |
| submission. | 2026-09-14T18:29:11.517093+00:00 |
Three moments it handles
Use case 1
Approvals into your own system
When a reviewer approves an inspection, your endpoint gets submission.approved with the tag, the project and the review date, and can update your own records.
Use case 2
Rework where you work
When an inspection is sent back, your endpoint gets submission.rejected with the reviewer's notes, so your own tools can open the follow-up.
Use case 3
Client sign-off on your side
When a client signs off an approved inspection in the client portal, your endpoint gets signoff.signed, so your tracker can mark it signed off.
Setting up the connection
Add the endpoint
A workspace admin opens Integrations, then Webhooks, adds your HTTPS address and picks the events to send.
Copy the signing secret
RTI shows the secret once. Keep it with your endpoint's configuration; RTI stores it encrypted and shows only a hint after that.
Check every signature
Your endpoint computes a hex-encoded HMAC-SHA256 of the timestamp, a dot and the raw body, keyed with the full whsec_ secret, and compares it with v1 in X-RTI-Signature.
Answer fast with a 2xx
Answer within 10 seconds and do slow work after you reply. Anything other than a 2xx is tried again.
Send a test
Use Send test to post a test.ping event and see the HTTP result in RTI.
Rotate the secret when you need to
Rotate secret makes a new one at once and the old one stops working, so update your endpoint at the same time.
What it doesn't do
- It only sends. Nothing your endpoint answers changes the RTI record.
- It does not send photos, signatures or files. An event carries the tag, project, status, inspector, reviewer notes and dates.
- It accepts only an HTTPS address on a public host. An address that is not HTTPS, or names a private, loopback or internal host, is refused when you add it and checked again before every send.
- It does not hold events for a paused endpoint. Events that happen while an endpoint is paused are never sent to it.
- It does not promise order or a single delivery. A retry can arrive after a newer event, or twice, so use X-RTI-Delivery to skip a repeat.
- Only a workspace admin can add, change, test or remove an endpoint, or see and replay its deliveries.
Questions about RTI webhooks
6 answers
- Which events does RTI send to a webhook?
- Four: submission.submitted when an inspection is handed in for review, submission.approved and submission.rejected when a reviewer approves it or sends it back, and signoff.signed when a client signs off an approved inspection in the client portal. Each endpoint picks the events it gets, and Send test posts a fifth, test.ping.
- How do I check that a webhook came from RTI?
- Every request carries X-RTI-Signature in the form t=<unix time>,v1=<signature>. Compute a hex-encoded HMAC-SHA256 of the timestamp, a dot and the raw request body, keyed with your endpoint's full whsec_ signing secret, and compare it with v1 in constant time. Refuse the request if they differ, and consider refusing an old timestamp too.
- What happens when my endpoint is down?
- RTI queues every delivery before it sends it. A delivery that gets anything other than a 2xx within 10 seconds is tried up to five times in all, at least 1, 5, 30 and then 120 minutes apart. A 429 is retried after your Retry-After, and a 410 stops that delivery. When a delivery runs out of retries, admins and QA/QC managers are notified, and an admin can replay it from Recent deliveries.
- What is in a webhook payload?
- JSON with the event name, the time it was sent and the inspection: its ID, status, project, tag, equipment type, inspector, reviewer notes, and when it was created, submitted and reviewed. Photos, signatures and files are not sent. They stay in RTI with the tamper-evident record.
- Can the same event arrive twice?
- It can. If your endpoint did the work but answered late or with an error, RTI tries again. Each delivery carries an X-RTI-Delivery ID that stays the same on every retry and replay, so keep the IDs you have handled and skip a repeat. A test.ping, sent straight away rather than queued, carries no X-RTI-Delivery.
- Who can manage webhooks in RTI?
- Workspace admins. Only an admin can add an endpoint, choose its events, pause it, rotate its secret, send a test, remove it, or see and replay its deliveries.
Resources and contact
Questions about building on RTI?
Your message goes to the founder, a Certified Building Official, with no sales sequence in between. Support questions go to the support inbox.
See it on a real job.
Tag one area, run one walk, and see the record it leaves behind.
30-day trial · No card required