Webhooks
Get your systems pushed to when things happen — the subscribable events, the signed request format, the retry ladder and auto-disable, and the test event.
Webhooks push events to your own systems the moment they happen — no polling. Configure endpoints under Settings → Webhooks.
Subscribable events
| Event | Fires when |
|---|---|
order.paid | An order is confirmed paid. |
order.cancelled | An order is cancelled. |
ticket.checked_in | A ticket is admitted at the door. |
Each endpoint subscribes to the events it cares about, so your CRM can
listen only for order.paid while your access system listens for
ticket.checked_in.
Configuring an endpoint
- URL — your HTTPS receiver.
- Events — which of the three to send.
- Custom headers — encrypted headers (e.g. an auth token for your receiver).
- Signing secret — shown once at creation; use it to verify signatures.
Verifying signatures
Every delivery carries a Bookitive-Signature header, Stripe-shaped
— an HMAC of the payload with your endpoint's signing secret. Verify it
on receipt to be sure the request really came from Bookitive and wasn't
tampered with. Reject anything that doesn't match.
Reliability
Deliveries are emitted from the same transaction as the change that caused them — so an event can't be lost because the database committed but the webhook didn't fire. If your endpoint is down, Bookitive retries on a backoff ladder:
after the first attempt it waits 1 min → 10 min → 1 hour → 6 hours between the next four tries — up to 5 attempts in total.
After persistent failure an endpoint is auto-disabled and owners and admins are emailed, so a dead receiver doesn't retry forever in silence. A delivery log shows recent attempts and their results.
Testing
Send test delivers a test.ping event to your endpoint regardless
of its subscriptions — verify your receiver and signature check end to
end before relying on real events.
Design your receiver to be idempotent: a retry (or a rare duplicate) means your handler may see the same event more than once. Key on the event's id and ignore repeats — the golden rule of any webhook consumer.