Sandbox API Documentationfor Claim Route 360

Phase 1 workflow:

1. Claim Route 360 sends a REST request to create a roof report order.
2. Roof Report 360 returns a report_id.
3. Roof Report 360 sends webhook status updates to Claim Route 360.
4. Claim Route 360 calls the report details endpoint.
5. Roof Report 360 returns JSON roof report details and the completed PDF as a URL once available.

Sandbox base URL:

https://api.roofreport360.com/v1

Future production format:

https://api.roofreport360.com/v1

Go-live prerequisites

• All UAT checks above passed and signed off by both teams.
• Customer agreement signed (pricing, SLA, support, data handling).
• Live API key, API secret, and webhook signing secret issued and rotated in to Claim Route 360.
• Live webhook URL registered on the Roof Report 360 side and signature verification confirmed.
• One coordinated smoke order completed end-to-end before opening to full volume.

Production base URL

https://api.roofreport360.com/v1

Until the branded hostname is provisioned, the Live environment may temporarily use the Lovable Cloud function URL above. The hostname in your handoff packet is the authoritative one.

Environment field

Live responses and webhook payloads return "environment": "live". Sandbox returns "environment": "sandbox". Always assert on this field before writing into production records.

Credential separation

• Sandbox keys cannot access Live orders and vice versa.
• Sandbox keys are not promoted. Live credentials are issued fresh.
• Store Live and Sandbox secrets in separate locations to prevent accidental cross-environment calls.

Rollback

If Live behavior is wrong, Roof Report 360 can disable the Live API key immediately. Claim Route 360 should be prepared to pause outbound order creation on request and resume after the all-clear.

Required headers on every request:

x-api-key: <provided separately>
x-api-secret: <provided separately>
Content-Type: application/json
Idempotency-Key: <unique UUID per logical order attempt>

• The API secret is shown only once and must be stored securely.
• The Idempotency-Key prevents duplicate orders if Claim Route 360 retries a request.
• Duplicate reference_id values return the existing report instead of creating a new order.

POST /measurement-orders
GET  /measurement-orders/:report_id
GET  /measurement-orders/:report_id/status

Add ?profile=provider_compatibility to GET requests to return PascalCase compatibility field names.

• Default profile: roof_report_360
• Compatibility profile: provider_compatibility

In the samples below, {base_url} represents the Sandbox Base URL shown above.

POST /measurement-orders - creates a sandbox roof report order and returns a Roof Report 360 report_id.

Required fields

• reference_id
• property.address1
• property.city
• property.state
• property.postal_code

Recommended fields

• product_code
• insured_name
• claim_number
• webhook_event_subscription

Claim Route 360 should set reference_id to its internal order ID.

Sample request

{
  "reference_id": "CR360-ORDER-100023",
  "product_code": "residential_roof_report",
  "property": {
    "address1": "123 Main St",
    "city": "Austin",
    "state": "TX",
    "postal_code": "78701"
  },
  "insured_name": "Jane Homeowner",
  "claim_number": "CLM-44219",
  "webhook_event_subscription": [
    "order.status_changed",
    "order.completed"
  ]
}

Copy-ready curl example

curl -X POST "{base_url}/measurement-orders" \
  -H "x-api-key: <YOUR_SANDBOX_API_KEY>" \
  -H "x-api-secret: <YOUR_SANDBOX_API_SECRET>" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 9b1c2f54-2c8a-4f6e-9a11-3d2b6e7f0011" \
  -d '{
    "reference_id": "CR360-ORDER-100023",
    "product_code": "residential_roof_report",
    "property": {
      "address1": "123 Main St",
      "city": "Austin",
      "state": "TX",
      "postal_code": "78701"
    },
    "insured_name": "Jane Homeowner",
    "claim_number": "CLM-44219",
    "webhook_event_subscription": [
      "order.status_changed",
      "order.completed"
    ]
  }'

Replace <YOUR_SANDBOX_API_KEY> and <YOUR_SANDBOX_API_SECRET> with the credentials delivered separately.

Sample success response

{

  "report_id": "RRP-100247",
  "reference_id": "CR360-ORDER-100023",
  "status": "received",
  "environment": "sandbox",
  "created_at": "2026-05-28T23:15:00Z",
  "details_url": "{base_url}/measurement-orders/RRP-100247",
  "duplicate": false
}

Sample duplicate response

{
  "report_id": "RRP-100247",
  "reference_id": "CR360-ORDER-100023",
  "status": "received",
  "environment": "sandbox",
  "duplicate": true,
  "message": "Order already exists with this reference_id"
}

Claim Route 360 can order a Xactimate Roof Estimate alongside the roof measurement report, or on its own. Add include_xactimate_estimate: true plus an estimate object to the create-order payload, or send product_code: "XACTIMATE_ESTIMATE" for an estimate-only order.

Estimate fields

• roof_type (required - e.g. laminated, 3-tab, metal, tile)
• stories, layers (default 1)
• plumbing_vent_count, box_vent_count, turtle_vent_count, power_vent_count, turbine_vent_count, ridge_vent_lf
• skylight_count, chimney_count, satellite_dish_count, solar_panel_count

Sample request

{
  "reference_id": "CR360-ORDER-100024",
  "product_code": "residential_roof_report",
  "include_xactimate_estimate": true,
  "estimate": {
    "roof_type": "laminated",
    "stories": 1,
    "layers": 1,
    "plumbing_vent_count": 3,
    "box_vent_count": 6,
    "turbine_vent_count": 0,
    "ridge_vent_lf": 42,
    "skylight_count": 1,
    "chimney_count": 1
  },
  "property": {
    "address1": "123 Main St",
    "city": "Austin",
    "state": "TX",
    "postal_code": "78701"
  },
  "webhook_event_subscription": [
    "order.completed",
    "order.estimate_completed"
  ]
}

Estimate webhook events

• order.estimate_assigned - estimate work has started.
• order.estimate_submitted - vendor submitted for review.
• order.estimate_completed - approved and released. Payload includes the ESX and PDF in deliverables[] with deliverable_type of xactimate_estimate_esx or xactimate_estimate_pdf.

Estimate status and deliverables are also returned by GET /measurement-orders/:report_id under estimate.

1. Use a test Claim Route 360 order ID as the reference_id.
2. Submit one sandbox order via POST /measurement-orders.
3. Store the returned report_id on the Claim Route 360 record.
4. Wait for the order.completed webhook, or poll GET /measurement-orders/:report_id/status.
5. Once status is completed, call GET /measurement-orders/:report_id.
6. Store the returned report_pdf_url on the Claim Route 360 record.

GET /measurement-orders/:report_id - returns status, reference ID, measurements, and the PDF URL when available.

• report_pdf_url is null until the order is completed.
• Measurement fields may be null until the QA vendor completes the report.
• Once completed, each GET request returns a fresh 24-hour signed PDF URL.
• The PDF is returned as a URL, not as a file attachment and not in the webhook body.

Sample response - default roof_report_360 profile

{
  "report_id": "RRP-100247",
  "reference_id": "CR360-ORDER-100023",
  "status": "completed",
  "environment": "sandbox",
  "created_at": "2026-05-28T23:15:00Z",
  "completed_at": "2026-05-28T23:45:00Z",
  "property": {
    "address1": "123 Main St",
    "city": "Austin",
    "state": "TX",
    "postal_code": "78701"
  },
  "measurements": {
    "total_area_sqft": 2480,
    "predominant_pitch": "6/12",
    "length_ridge_ft": 64,
    "length_valley_ft": 38,
    "length_eave_ft": 142,
    "length_rake_ft": 96,
    "length_hip_ft": 22
  },
  "report_pdf_url": "https://...signed-24h-url..."
}

For customers migrating from another roof measurement provider, Claim Route 360 can request a compatibility-shaped response by adding ?profile=provider_compatibility:

GET /measurement-orders/:report_id?profile=provider_compatibility

Sample response

{
  "ReportId": "RRP-100247",
  "ReferenceId": "CR360-ORDER-100023",
  "Status": "Completed",
  "Environment": "sandbox",
  "ReportDownloadLink": "https://...signed-24h-url...",
  "TotalMeasurements": {
    "Area": 2480,
    "Pitch": "6/12",
    "LengthRidge": 64,
    "LengthValley": 38,
    "LengthEave": 142,
    "LengthRake": 96,
    "LengthHip": 22
  }
}

GET /measurement-orders/:report_id/status

Sample response

{
  "report_id": "RRP-100247",
  "reference_id": "CR360-ORDER-100023",
  "status": "in_progress",
  "environment": "sandbox",
  "updated_at": "2026-05-28T23:25:00Z"
}

Roof Report 360 sends webhook status updates to the configured Claim Route 360 webhook endpoint.

Sample webhook payload

{
  "event": "order.completed",
  "timestamp": "2026-05-28T23:45:00Z",
  "environment": "sandbox",
  "report_id": "RRP-100247",
  "reference_id": "CR360-ORDER-100023",
  "status": "completed",
  "details_url": "{base_url}/measurement-orders/RRP-100247"
}

• The webhook does not contain measurement data.
• The webhook does not contain the PDF URL.
• The webhook does not contain file bytes.
• Claim Route 360 should call details_url to retrieve report JSON and the PDF URL.

Webhook headers

Content-Type: application/json
X-RoofReport360-Event: order.completed
X-RoofReport360-Timestamp: <unix timestamp>
X-RoofReport360-Signature: sha256=<hmac>

Signature verification

expected = HMAC_SHA256(webhook_signing_secret, `${timestamp}.${raw_body}`)
Compare expected value to X-RoofReport360-Signature after removing the
sha256= prefix. Use constant-time comparison if available.

• Claim Route 360 internal order ID should be sent as Roof Report 360 reference_id.
• Roof Report 360 stores reference_id and maps it to the returned report_id.
• If the same reference_id is submitted again, Roof Report 360 returns the existing report instead of creating a duplicate order.
• Claim Route 360 should store both reference_id and report_id.

1. Send a test order from Claim Route 360.
2. Confirm Roof Report 360 returns report_id.
3. Confirm Claim Route 360 stores report_id.
4. Confirm duplicate reference_id does not create a second order.
5. Confirm status endpoint returns the correct status.
6. Confirm Claim Route 360 receives webhook.
7. Confirm Claim Route 360 verifies webhook signature.
8. Confirm Claim Route 360 calls details_url.
9. Confirm JSON report details are returned.
10. Confirm report_pdf_url is null before completion.
11. Confirm report_pdf_url is populated after completion.
12. Confirm PDF URL opens successfully.
13. Confirm PDF URL expires after 24 hours.
14. Confirm Claim Route 360 attaches or stores the PDF URL on the correct record.

• Sandbox orders are no-charge.
• Sandbox orders do not touch production data.
• Sandbox keys cannot access production orders.
• Sandbox uses internal QA fulfillment.
• Branded API hostname will be handled before production.
• Phase 1 supports the PDF report workflow only.
• ESX / XML / ZIP support is not included in Phase 1 unless separately approved.
• Pricing endpoint is not included in Phase 1.
• Search endpoint is not included in Phase 1.
• Cancel / update-address endpoints are not included in Phase 1.
• Production API credentials will not be issued until UAT is approved and the customer agreement is signed.

• Store API key and secret securely.
• Do not place credentials in frontend / browser code.
• Do not email credentials unnecessarily.
• Do not log API secrets.
• Use HTTPS only.
• Use a unique Idempotency-Key per logical order attempt.
• Verify webhook signatures.
• Treat signed PDF URLs as temporary and private.
• Do not expose PDF URLs publicly.

For UAT questions, contact: