Developer portal

Quickstarts

Five copy-pasteable recipes. Set QEHS_API_KEY in your shell and run.

bash

Create an incident

POST a record into the Incidents module using an API key.

curl -X POST https://app.qehsethos.com/api/v1/records \
  -H "Authorization: Bearer $QEHS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "moduleKey": "incidents",
    "payload": {
      "title": "Forklift near-miss at Bay 3",
      "incident_date": "2026-04-16",
      "severity": "medium",
      "location": "plant-1.bay-3"
    }
  }'

typescript

List today’s inspections

Paginated GET with filter for a specific date range.

import { QEHSClient } from '@qehs/sdk';

const qehs = new QEHSClient({ apiKey: process.env.QEHS_API_KEY! });
const page = await qehs.records.list('inspections', {
  filter: { status: ['open', 'in_review'] },
  from: '2026-04-16T00:00:00Z',
  to:   '2026-04-17T00:00:00Z',
  limit: 50,
});
console.log(page.items.length, page.nextCursor);

typescript

Verify a webhook signature

Validate the HMAC on an inbound webhook before trusting the body.

import crypto from 'node:crypto';

export function verify(body: string, header: string, secret: string): boolean {
  const [ts, sig] = header.split(',').map((s) => s.split('=')[1]);
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${ts}.${body}`)
    .digest('hex');
  const ok = crypto.timingSafeEqual(
    Buffer.from(sig, 'hex'),
    Buffer.from(expected, 'hex')
  );
  const fresh = Math.abs(Date.now() / 1000 - Number(ts)) < 300;
  return ok && fresh;
}

bash

Upload a photo to a record

Two-step: request a signed URL, then PUT the binary.

# 1) Request signed URL
SIGNED=$(curl -s -X POST https://app.qehsethos.com/api/v1/attachments \
  -H "Authorization: Bearer $QEHS_API_KEY" \
  -d '{ "recordId":"rec_01J...", "filename":"photo.jpg", "contentType":"image/jpeg" }')

# 2) Upload binary
curl -X PUT "$(echo "$SIGNED" | jq -r .uploadUrl)" \
  -H "Content-Type: image/jpeg" \
  --data-binary @photo.jpg

bash

Provision a user via SCIM

Standard SCIM 2.0 POST to /api/scim/v2/Users — works with Okta, Entra ID, Google Workspace.

curl -X POST https://app.qehsethos.com/api/scim/v2/Users \
  -H "Authorization: Bearer $QEHS_SCIM_TOKEN" \
  -H "Content-Type: application/scim+json" \
  -d '{
    "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
    "userName": "alice@acme.com",
    "name": { "givenName":"Alice","familyName":"Adams" },
    "active": true,
    "emails": [{ "value":"alice@acme.com","primary":true }]
  }'

Need something not here? Open an issue on the SDK repo or ping our developer-relations team in the Help Center. We add new recipes whenever we see three or more support conversations about the same pattern.