When Jobber / Housecall / Stripe / GitHub / Zapier fires an event, POST a signed JSON body to this gateway. QEV records it under a job/case id and can auto-lock when evidence is complete.
…
Header: x-qev-signature: sha256=<hmac-sha256 of raw body with QEV_WEBHOOK_SECRET>
{
"flow_id": "field-service",
"case_id": "JOB-123",
"action": "estimate.approved",
"actor": { "id": "customer@example.com" },
"provider_event_id": "unique-from-source-system",
"outcome": "success"
}
{
"flow_id": "field-service",
"case_id": "JOB-123",
"action": "payment.recorded",
"actor": { "id": "stripe@system" },
"provider_event_id": "pi_abc123",
"outcome": "success",
"payload": { "amount_cents": 25000 }
}
{
"flow_id": "devops-change",
"case_id": "CHG-991",
"action": "deployment.completed",
"actor": { "id": "ci@company.com" },
"provider_event_id": "gha-run-55",
"outcome": "success",
"artifacts": [{ "name": "app.tgz", "sha256": "<64-hex>", "size_bytes": 1 }]
}
BODY='{"flow_id":"field-service","case_id":"JOB-123","action":"work.completed","actor":{"id":"tech@co.com"},"provider_event_id":"evt-1","outcome":"success"}'
SIG=$(printf %s "$BODY" | openssl dgst -sha256 -hmac "$QEV_WEBHOOK_SECRET" | awk '{print $2}')
curl -sS -X POST "$ORIGIN/v1/webhooks/jobber" \
-H "content-type: application/json" \
-H "x-qev-signature: sha256=$SIG" \
-d "$BODY"
IT keeps QEV_WEBHOOK_SECRET on the host — never in the browser.