Webhooks

Signed events, delivered to your endpoint

Create subscriptions at Account → Developer in the Skiff web app. Skiff POSTs JSON to your HTTPS URL when things happen on the owner's boats. Deliveries retry with exponential backoff (up to 6 attempts over roughly 5 hours), then park as dead.

Events

inspection.completed       an inspection reached completed
inspection_item.flagged    an item verdict became attention or non_operational
service.logged             a service entry was created
hours.logged               engine hours were logged
work_request.updated       a work request was created or changed

Payload

POST your-url
x-skiff-event: service.logged
x-skiff-delivery: 812
x-skiff-signature: hex(hmac_sha256(secret, raw_body))

{
  "event": "service.logged",
  "occurred_at": "2026-07-19T04:01:27.33+00:00",
  "table": "service_logs",
  "record_id": "3403b0f0-…",
  "data": { …the row as JSON… }
}

Verify the signature

Compute HMAC-SHA256 of the raw request body with your subscription secret (shown when you create the subscription) and compare it, constant-time, to x-skiff-signature.

import crypto from "node:crypto";

function verify(rawBody: string, signature: string, secret: string): boolean {
  const expected = crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

Respond fast

Return any 2xx within 10 seconds. Do the real work asynchronously; a timeout counts as a failed attempt.