YachtInspect API

The YachtInspect Export API delivers one vessel's findings — with their checklist actions, comment history and photos — to your own systems: fleet-management software, a claims database, a yard's planning tool, or a BI dashboard.

• Base URL: https://yachtinspect.quickinspect.me/api
• Machine-readable spec: /v1/openapi.json (OpenAPI 3 — import it into Postman, Insomnia, or your code generator)
• Access: read-only. An Admin enables API access for your company; ask your YachtInspect contact.

Authentication

Send the key in the Authorization header of every request:

curl https://yachtinspect.quickinspect.me/api/v1/findings \
  -H "Authorization: Bearer yi_live_your_key_here"

Keys are managed in the app under Lists → API Access:

Action	Who
Turn API access on or off for the company	Admin
Create, list and revoke keys	The company owner with the Key User role, or an Admin

When creating a key you give it a name and choose the project it may read. The key is shown exactly once — YachtInspect stores only a cryptographic hash and cannot show it again. Treat it like a password. If it is lost, revoke it and create a new one. Revoking takes effect immediately. A company can hold up to 20 active keys.

Endpoints

Endpoint	Data	Notes
GET /v1/project	The key's vessel	Vessel identity, classification, propulsion, survey, claim and client details.
GET /v1/findings	Findings	Each finding includes its checklist. Filters below. Paginated.
GET /v1/findings/{id}/comments	A finding's comment thread	Includes the app's automatic status-change entries. Paginated, oldest first.
GET /v1/findings/{id}/attachments	A finding's photos and documents, including those attached to its comments	Download links valid for 15 minutes.
GET /v1 and GET /v1/openapi.json	Discovery and spec	Public, no key required.

Full request and response schemas live in the OpenAPI document.

What "actions" means

A finding's follow-up work lives in two places, and the API delivers both:

• Checklist items are embedded in each finding as checklist[], with title, done, date_created, date_closed and who created them. Each finding also carries checklist_total and checklist_open. Checklist items have no id of their own; index is their position in the list.
• Comments come from /v1/findings/{id}/comments. Entries the app writes itself — for example when a finding's status changes — have system_triggered: true, so together they form the finding's full history.

The finding's own corrective_measure, start_date, due_date, status and priority are ordinary fields on the finding.

Filtering findings

GET /v1/findings has two modes:

Mode	Order	Parameters
Default	date_created, oldest first	from (inclusive) and to (exclusive), both on date_created
Incremental sync	last_edited_date, oldest first	updated_since — findings created or edited at or after that instant

updated_since cannot be combined with from or to.

You can additionally filter on one of:

• status — exactly one of Open, To be reviewed, Closed, Accepted as is, Cancelled, Shipyard confirmed rectification
• system — e.g. Hull
• priority

Combining two of them returns 400. Filter on one and narrow the rest in your own code.

Dates are ISO-8601 (2026-09-01 or 2026-09-01T08:00:00Z).

# Everything edited since the last sync
curl "https://yachtinspect.quickinspect.me/api/v1/findings?updated_since=2026-09-25T00:00:00Z" \
  -H "Authorization: Bearer yi_live_your_key_here"

Findings hidden in the app are never returned, and their comments and attachments return 404.

Pagination

List endpoints return at most limit records (default 100, maximum 500) plus a cursor:

{
  "data": [ ... ],
  "next_page_token": "eyJ2IjoxLCJhIjoxNz..."
}

Pass next_page_token back as page_token to get the next page. Keep paging until next_page_token is null. A page can hold fewer than limit records and still have a next page (hidden findings are left out after the page is read), so a short page does not mean you are done. Tokens are opaque — don't parse or build them.

All timestamps are ISO-8601 UTC, and field names are stable snake_case.

Attachments

GET /v1/findings/{id}/attachments lists every file of a finding. The source field says where each one comes from:

source	What	Order
location_details_image	The finding's location image	First
findings_file	The finding's photos and documents	As the app and its reports show them
comment	Files attached to the finding's comments: a photo, video, voice note or document (content_kind is image, video, audio or file)	Oldest comment first

Comment files carry the comment_id of the comment they belong to, so you can attach them to the right entry from /comments. In /comments itself, has_image, has_video, has_audio and has_file tell you which comments have files.

Each row has a download_url that is valid for 15 minutes (download_url_expires_at), so download files during your sync run rather than storing the links.

If a link cannot be created, that row has download_url: null and a download_error; the rest of the list is still returned. This endpoint has no cursor: limit caps the rows across all sources and truncated: true tells you something was left out.

Privacy

The API returns the display names of people who created, edited or commented. It never returns email addresses or profile pictures. /v1/project leaves out budget and hours-spent figures.

Rate limits

Each key may make 60 requests per minute and 10,000 per day. Above that the API returns 429 with a Retry-After header in seconds — wait that long and retry. Use limit=500 for full exports to keep the request count low. Higher limits are available on request.

Errors

Every error has the same shape:

{ "error": { "code": "unauthorized", "message": "Invalid API key." } }

HTTP	code	Meaning
400	invalid_request	A parameter is malformed, or two filters were combined.
401	unauthorized	Key missing, malformed, unknown or revoked.
403	forbidden	API access is off for the company, or the key's project no longer exists or has moved to another company.
404	not_found	Unknown endpoint, or the finding isn't in this key's project.
429	rate_limited	Too many requests — honour Retry-After.
500	internal	Something went wrong on our side. Retry with backoff.

Security notes

• Keys are stored as SHA-256 hashes only; the raw key is never saved.
• Every API request, and every key creation and revocation, is recorded in your company's audit trail.
• The API is read-only. It cannot create, change or delete anything in YachtInspect.