Create Webhook

Create a new webhook to receive event notifications.

Endpoint

POST /v1/webhooks

Authentication

Requires an API key with the webhooks:write scope.

Request Body

Field	Type	Required	Description
name	string	Yes	Webhook name (max 255 characters)
url	string	Yes	Endpoint URL (must be HTTPS in production)
events	array	Yes	List of event types to subscribe to
is_active	boolean	No	Whether webhook is active (default: true)

Available Events

The booking events most integrations start with:

Event	Description
booking.created	New booking created
booking.updated	Booking details updated
booking.cancelled	Booking cancelled
booking.completed	Booking marked complete
booking.no_show	Booking marked as a no-show
booking.status_changed	Booking status changed

An event name not on the Webhook Events list is refused with 422. That page lists every event, and GET /v1/webhooks/events returns the same list.

Example Request

curl -X POST "https://app.equipdash.com/api/v1/webhooks" \
  -H "Authorization: Bearer eqd_live_abc123xyz789..." \
  -H "Content-Type: application/json" \
  -d '{
    "name": "My Integration",
    "url": "https://my-app.com/webhooks/equipdash",
    "events": ["booking.created", "booking.cancelled", "payment.received"]
  }'

Response

Success (201 Created)

{
  "data": {
    "id": 3,
    "name": "My Integration",
    "url": "https://my-app.com/webhooks/equipdash",
    "events": ["booking.created", "booking.cancelled", "payment.received"],
    "is_active": true,
    "failure_count": 0,
    "last_triggered_at": null,
    "secret": "abc123xyz789...",
    "created_at": "2026-01-15T12:00:00+00:00",
    "updated_at": "2026-01-15T12:00:00+00:00"
  },
  "meta": {
    "request_id": "req_def456",
    "timestamp": "2026-01-15T12:00:00+00:00"
  }
}

Save Your Secret

The secret is only returned when creating the webhook. Store it securely - you'll need it to verify webhook signatures. Use Regenerate Secret if you lose it.

Verifying Webhook Signatures

Each webhook request includes a signature in the X-Webhook-Signature header. Verify it using HMAC-SHA256:

$payload = file_get_contents('php://input');
$signature = hash_hmac('sha256', $payload, $secret);

if (hash_equals($signature, $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'])) {
    // Signature valid - process the webhook
}

Errors

Status	Code	Description
401	authentication_required	No API key provided
401	invalid_api_key	Invalid API key
403	insufficient_scope	API key lacks webhooks:write scope
422	validation_error	Invalid request data

Validation Error Example

{
  "error": {
    "code": "validation_error",
    "message": "The given data was invalid.",
    "details": {
      "url": ["The url must be a valid URL."],
      "events": ["The events field must have at least 1 items."]
    }
  }
}