Skip to main content

Outbound webhooks

React to platform events.
Build for retries from day one.

Subscribe a venue endpoint to selected Booking Bible events. Every delivery carries a signed JSON envelope, stable event identity and delivery record.
Open API referenceDeveloper overview
  • HMAC-SHA256 signatures
  • Delivery logs
  • Exponential backoff

Event surface

A broad catalog without a wall of names

Choose only the events your integration owns. The full catalog is grouped in the venue webhook configuration; the preview below shows common business domains.

458
active event keys
53
event groups
Bookings6 examples
  • booking.created

    A new booking was created

  • booking.cancelled

    A booking was cancelled

  • booking.checked_in

    A member checked in to a class

  • booking.no_show

    A member was marked as no-show

  • booking.waitlist_promoted

    A member was promoted from the waitlist

  • booking.waitlist_added

    A member was added to a waitlist by staff

Members3 examples
  • member.created

    A new member signed up or joined an additional venue. Payload includes membership_origin: "new_signup" | "existing_user_joined".

  • member.updated

    A member profile was updated

  • member.deleted

    A member was removed

Passes6 examples
  • pass.activated

    A pass was activated

  • pass.expired

    A pass expired

  • pass.paused

    A pass was paused

  • pass.resumed

    A pass was resumed from a pause/freeze window

  • pass.cancelled

    A pass/subscription was cancelled

  • pass.upgraded

    A membership was upgraded to a higher plan (immediate, prorated)

Payments6 examples
  • payment.succeeded

    A payment was completed

  • payment.failed

    A payment failed

  • payment.refunded

    A payment was refunded

  • payment.dunning_reminder

    A dunning reminder was sent for a past_due subscription pass

  • payment.settled_externally

    A failed membership renewal was recorded as paid through another channel (cash / bank transfer / MobilePay / external card)

  • payment.renewal_waived

    A failed membership renewal was waived (comped) by the venue

Courses6 examples
  • course.enrolled

    A student successfully enrolled + paid (full, deposit, or installments; carries the chosen plan)

  • course.enrollment_created

    A student enrolled in a course

  • course.enrollment_withdrawn

    A student withdrew from a course

  • course.enrollment_completed

    A student completed a course (met attendance threshold)

  • course.waitlist_promoted

    A waitlisted enrollment was promoted to enrolled

  • course.certificate_issued

    A completion certificate was issued to a student

Delivery contract

Small envelope, explicit headers

The event-specific payload lives under data. Identity and routing facts remain stable at the envelope and header level.

json
{
  "id": "evt_a1b2c3d4",
  "type": "booking.created",
  "created_at": "2026-07-28T07:15:00.000Z",
  "organization_id": "org_xxxx",
  "data": {
    "booking_id": "bk_xxxx",
    "user_id": "usr_xxxx",
    "class_instance_id": "ci_xxxx"
  }
}
HeaderPurpose
X-Webhook-Signaturesha256=<HMAC of raw body>
X-Webhook-EventCatalog event key
X-Webhook-IdStable event identity
X-Webhook-TimestampEnvelope creation time

Receiver design

The safe path is the straightforward path

Preserve the raw request bytes, authenticate first, claim the event identity, acknowledge, then process asynchronously.

Verify the raw body

Compute HMAC-SHA256 with the endpoint secret and compare it with X-Webhook-Signature using a constant-time function.

Deduplicate by event ID

Use X-Webhook-Id or the envelope id as your durable idempotency key. Delivery is at least once, so repeats are expected.

Acknowledge promptly

Return a 2xx response before doing heavy work. Booking Bible applies a ten-second request timeout.

Expect bounded retries

Non-2xx responses and timeouts enter an exponential-backoff retry path. Repeated endpoint failures are visible in delivery logs and can disable the endpoint.

typescript
import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifyBookingBibleWebhook(
  rawBody: Buffer,
  signature: string,
  secret: string,
) {
  const expected =
    'sha256=' + createHmac('sha256', secret).update(rawBody).digest('hex');
  const suppliedBytes = Buffer.from(signature);
  const expectedBytes = Buffer.from(expected);

  return suppliedBytes.length === expectedBytes.length &&
    timingSafeEqual(suppliedBytes, expectedBytes);
}

Integration path

Start with one event and one replay-safe handler

Venue administrators create scoped endpoints and inspect recent deliveries in developer settings. Partners can bring a broader event contract to the integrations team.

Read the API referenceContact integrations

Need the complete catalog? It is available in the authenticated webhook configuration.