GeneralBid integrations

What can you export?

Schedule of values CSV

For an awarded package: one row per line with Line, Cost Code, Description, Amount, Included/Excluded, Notes, the cost code taken from the package’s CSI division. Built for Procore, Autodesk Build and most ERPs; check it against your import template, since every company maps cost codes differently.

Full package as JSON

Everything about one package in a single structured file: the project, the package, the levelling sheet, the levelled result, the award and its watchlist, clarifications, change orders and the activity history. Useful for your own reporting, or for keeping a record outside GeneralBid.

Levelling CSV and print

Every sheet, in the app and in the free Bid Leveler, downloads as a CSV of lines, bidders, plugs, levelled totals and rank, or prints as a one-document levelling sheet.

Can subs email their proposals in?

Every package has its own inbox address. Forward proposals to it, or have your invitations use it as the reply-to, and each PDF is read onto the package’s scope lines and waits for you to review. The reading is kept; the email and its attachments are not.

Does it work with Zapier and Make?

There is no GeneralBid app in the Zapier or Make directories yet. Both can receive our webhooks directly: in Zapier, start a Zap with Webhooks by Zapier → Catch Hook; in Make, start a scenario with a Custom webhook. Paste the URL they give you into Settings → Integrations, pick the events, and send a test. From there, post awards to Slack, add change orders to a spreadsheet, or create a record in your own system.

How do webhooks work?

Team admins add HTTPS endpoints in Settings → Integrations and choose which events each one receives. Each delivery is a JSON POST, signed with the endpoint’s secret, which is shown once when you create it.

Payload

{
  "id": "evt_…",
  "type": "award.made",
  "createdAt": "2026-09-27T14:03:11.000Z",
  "orgId": "…",
  "data": { … }
}

Verifying the signature

Every request carries GeneralBid-Signature: t=<unix time>,v1=<hex>, where v1 is the HMAC-SHA256 of t.body with your secret. Reject anything that does not match, or that is more than a few minutes old.

import crypto from "node:crypto";

// header: the GeneralBid-Signature request header
// body:   the raw request body, as a string
export function verify(header, body, secret) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${parts.t}.${body}`)
    .digest("hex");
  const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < 300;
  const given = Buffer.from(parts.v1 ?? "");
  return fresh && given.length === expected.length && crypto.timingSafeEqual(Buffer.from(expected), given);
}

Delivery

• A 2xx response within 10 seconds counts as delivered.
• Failures are retried after 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours.
• After 20 failures in a row the endpoint is switched off and your admins are emailed.
• The last 50 deliveries of each endpoint, with their response codes, are in Settings.
• Only public HTTPS addresses are accepted, never private or internal ones.