Connect via MCP

Subscribe to rfq.received, message.received, rfq.status_changed and rfq.outcome_changed. Outcomes identify buyer withdrawal, supplier decline or a completed discussion. A webhook.test event contains empty data and no conversation link. Use the stable event ID for duplicate prevention.

{
  "id": "00000000-0000-4000-8000-000000000001",
  "type": "rfq.received",
  "version": 1,
  "created_at": "2026-10-01T10:00:00Z",
  "company_id": "00000000-0000-4000-8000-000000000002",
  "data": {
    "quote_request_id": "00000000-0000-4000-8000-000000000003",
    "conversation_id": "00000000-0000-4000-8000-000000000004",
    "message_id": "00000000-0000-4000-8000-000000000005"
  },
  "url": "https://marketplace.aivironment.ai/dashboard/company/example?tab=inbox&conversation=00000000-0000-4000-8000-000000000004"
}

Read X-Aivironment-Signature as t=UNIX_SECONDS,v1=HEX_DIGEST. Verify HMAC-SHA256 over the timestamp, a period, and the original request bytes, using the complete signing secret including whsec_. Do not parse and reserialize JSON before verification. This Node.js example accepts a five-minute clock window.

import { createHmac, timingSafeEqual } from "node:crypto"

export function verifyWebhook(rawBody, signatureHeader, signingSecret) {
  const match = /^t=(\d+),v1=([a-f0-9]{64})$/.exec(signatureHeader ?? "")
  if (!match) return false
  const timestamp = Number(match[1])
  if (!Number.isSafeInteger(timestamp)) return false
  if (Math.abs(Date.now() / 1000 - timestamp) > 300) return false
  const expected = createHmac("sha256", signingSecret)
    .update(match[1] + ".")
    .update(rawBody)
    .digest()
  return timingSafeEqual(expected, Buffer.from(match[2], "hex"))
}

Deliveries can repeat and arrive out of order. Record X-Aivironment-Event-Id before processing; X-Aivironment-Delivery-Id identifies the endpoint delivery shown in the dashboard. Read current CRM API metadata before applying status changes. Retry failed events from the delivery log after fixing the receiver.

Use api:crm:read for GET /api/v1/integrations/crm/conversations. Paginate with limit (up to 100) and offset; optionally filter by company_id. Responses include current RFQ status, conversation state, marketplace_path and stored CRM references.

curl "https://api.marketplace.aivironment.ai/api/v1/integrations/crm/conversations?limit=50&offset=0" \
  --header "Authorization: Bearer YOUR_API_TOKEN"

After your receiver creates a CRM record, save its opaque identifier using api:crm:write. Use a stable system name such as my-crm. The supplier inbox displays this reference; no customer details are copied.

PUT /api/v1/integrations/crm/conversations/{conversation_id}/links/my-crm
Authorization: Bearer YOUR_API_TOKEN
Content-Type: application/json

{ "external_record_id": "deal-123" }

The same API supports PATCH /conversations/ID/status and POST /conversations/ID/close with api:crm:write. Sending POST /conversations/ID/messages requires api:crm:reply, a JSON body containing body, and a stable Idempotency-Key header. Closing an RFQ status and closing a conversation are separate actions.