Auto repair approvals over iMessage: photo of the part, then YES

Who uses iMessage for repair approvals?

iMessage approvals fit independent repair shops, dealer service departments, tire and brake shops and mobile mechanics, where a tech finds extra work mid-job and the car sits on the lift waiting for a yes. Customers at work often don't pick up, and “you need brakes” is easier to believe with the part in front of them. A photo of the worn pad with the price handles both.

ZeroSettle is an iMessage API: a real phone number on real iMessage, running on Apple hardware we operate for you, that your code texts customers from and hears back on through a bearer token and signed webhooks.

How repair approvals over iMessage work, step by step

A ZeroSettle repair approval runs from a drop-off text to a pay link, with the customer's YES reaching your webhook in between.

1. Drop-off. Record text consent on the repair order or check-in kiosk and send a short “your car is on the lift” text that asks for a reply, or have the customer text first from a counter QR code. Photos go only to customers who have replied at least once (403 attachment_before_reply otherwise). For a customer new to the number, the drop-off text is the visit's one new contact.
2. The finding. The advisor sends a photo of the worn pad from the ZeroSettle console, or your shop system calls POST /api/imessage/send with image_b64 and the price as the caption, which arrives in the same bubble. A JPEG up to 2048 px on the long edge goes out exactly as sent; a HEIC from a shop iPad, or a bigger photo, is re-encoded to JPEG without EXIF or GPS. The cap is 5 MB.
3. The answer. The YES reaches your webhook as a signed message.received event about 1–2 seconds after it lands on the line, and your handler marks the line item approved.
4. The record. GET /api/imessage/messages?handle=… returns both messages with their timestamps: the photo's caption and image link, then the reply.
5. Pickup. The customer has replied, so the pay link in the “ready” text is tappable; see why links in a first iMessage aren't tappable.
6. Next visit. A returning customer continues the same conversation, which uses no new-contact allowance.

Example conversation: a brake approval and a pay link

One visit, as the shop sees it in the ZeroSettle console:

Asking for YES or NO gives the handler two words to match and keeps customers away from “stop”, which opts them out.

Setup: photo approvals from the console or your shop system

An advisor can run the whole loop from the ZeroSettle console with no code. A shop system needs a photo send and a signed-webhook receiver that records YES or NO when exactly one line item is open, following the ZeroSettle iMessage API docs.

# approvals.py: run with  uvicorn approvals:app --port 8100
import base64, hashlib, hmac, json, os, time
import requests
from fastapi import BackgroundTasks, FastAPI, Request, Response

BASE = os.environ.get("ZEROSETTLE_BASE_URL", "https://portal.zerosettle.io")
AUTH = {"Authorization": f"Bearer {os.environ['ZEROSETTLE_TOKEN']}"}
SECRET = os.environ["ZEROSETTLE_WEBHOOK_SECRET"]
app, seen = FastAPI(), set()                       # seen: use your database in production

def send_approval(to, jpg_path, caption):          # photo + price caption, one bubble; 403 attachment_before_reply until they have replied once
    with open(jpg_path, "rb") as f:
        image = base64.b64encode(f.read()).decode()
    return requests.post(f"{BASE}/api/imessage/send", headers=AUTH, timeout=120, json={
        "to": to, "image_b64": image, "image_format": "jpg", "text": caption}).json()

def verify(header, raw, tolerance=300):
    try:
        parts = dict(p.split("=", 1) for p in header.split(","))
        t, v1 = int(parts["t"]), parts["v1"]
    except Exception:
        return False
    if abs(time.time() - t) > tolerance:
        return False
    expected = hmac.new(SECRET.encode(), f"{t}.".encode() + raw, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)

def handle(msg):
    items = pending_line_items(msg["handle"])      # your shop system: items awaiting a yes
    answer = (msg.get("text") or "").strip().strip(".!").upper()
    if len(items) != 1 or msg.get("kind", "message") != "message" or answer not in ("YES", "NO"):
        return notify_advisor(msg)                 # your shop system: questions, photos, STOP
    items[0].record_decision(answer, message_id=msg["id"], ts_ms=msg["ts_ms"])
    if answer == "YES":                            # "like" tapback on their YES
        requests.post(f"{BASE}/api/imessage/reactions", headers=AUTH, timeout=90,
                      json={"message_id": msg["id"], "reaction": "like"})

@app.post("/webhook")
async def webhook(request: Request, tasks: BackgroundTasks):
    raw = await request.body()
    if not verify(request.headers.get("X-ZeroSettle-Signature", ""), raw):
        return Response(status_code=401)
    payload = json.loads(raw)
    msg = payload.get("message")
    if payload["event"] != "message.received" or msg is None:
        return Response(status_code=200)           # own sends echo as message.sent
    if (msg["id"], payload["event"]) in seen:
        return Response(status_code=200)           # retries repeat the id and event
    seen.add((msg["id"], payload["event"]))
    tasks.add_task(handle, msg)                    # answer 2xx within 10 s, work afterwards
    return Response(status_code=200)

Register the receiver with PUT /api/imessage/webhook and keep the secret it returns (shown once); the webhook steps cover testing. A photo send normally returns in a few seconds but can take up to about 105, so run send_approval from a job queue.

Keep the approval with the repair order

Copy the two stored messages, and the photo file you uploaded, into the repair order:

BASE=https://portal.zerosettle.io            # ZEROSETTLE_TOKEN is exported in your shell
curl -s -H "Authorization: Bearer $ZEROSETTLE_TOKEN" \
  "$BASE/api/imessage/messages?handle=%2B15555550123&after_id=0&limit=500"
curl -s -H "Authorization: Bearer $ZEROSETTLE_TOKEN" \
  "$BASE/api/imessage/messages/45/image" -o ro-88213-front-pads.jpg

California's Bureau of Automotive Repair lists text among the ways to reach a customer about added work, and its Write It Right guide says what to record:

BAR also asks you to document the authorization on both the work order and the invoice. It calls the guide “not all-inclusive”, and other states set their own rules; this is not legal advice.

Limits and consent for repair approvals

A repair visit uses ZeroSettle's new-contact allowance once: the drop-off text to a customer the number has never messaged. Approval and pickup texts never count as new contacts, though on every plan they must stay within two unanswered messages, and the photo needs the customer to have replied once.

Source: ZeroSettle iMessage API docs, “Errors, limits, and compliance”. Anyone who texted the line first never counts as a new contact.

The limit math for a Monday with 25 drop-offs

• On Pro, 5 drop-off texts to customers new to the number can go out each day. The 6th returns 429 new_contact_limit with retry_after_s.
• If all 25 are new to the number, Pro refuses texts 6 to 25 until 3 AM Eastern (midnight Pacific), long after those cars are gone. Skipping the drop-off text doesn't help: a photo can't be the first message.
• The fix: a QR code at the counter that opens Messages to the shop's number, since customers who text first never count as new contacts; see how to get customers to text you first.
• On Growth, each number allows 50 a day but only 3 per 15 minutes, so queue the 7:30 AM rush.
• On any plan, after Mike's OK the 10:41 photo is one unanswered message (texts sent within 5 minutes of each other count as one), so a second separate text is fine but a third before he replies returns 403 awaiting_reply. Call instead.

Consent and STOP in a repair thread

Collect text consent on the repair order, tied to this job. A coupon for the next brake job is marketing, a separate consent: ZeroSettle's docs note that marketing texts need written consent under the TCPA (the FCC's rule, 47 CFR 64.1200) and say to send nothing promotional before 8 am or after 9 pm in the customer's time zone. Whether a given text counts as marketing depends on its content and your situation; this isn't legal advice.

When ZeroSettle is not a fit for repair approvals

ZeroSettle is the wrong tool for repair approvals in these cases:

• Your state requires a signature for added work. BAR's guide lists text as a valid way to authorize added work in California; where a signature is required, a text YES may not be enough on its own; check your state's rules.
• Many customers use Android. iMessage only reaches people on an iPhone or another Apple product (Apple Support), and ZeroSettle has no SMS fallback. ZeroSettle checks every first message with Apple, and a number that isn't on iMessage gets nothing (422 not_on_imessage) and uses no new-contact slot.
• You want to send inspection videos. Video isn't supported; photos and voice messages are (see what an iMessage API can send).
• Your inspection software already gets approvals by link and customers use it.

Related setups: technician on-the-way texts, text-a-photo quotes and dealership lead follow-up, all on the use-case hub.

How much does iMessage for repair approvals cost?

Repair approvals cost the plan price: ZeroSettle charges no per-message fee, and messages are unlimited.

Both plans carry a 30-day money-back guarantee on the subscription. Approvals sent by advisors or your shop system use no AI credits. See plans and pricing, or get a number.