Webhooks API

Webhooks allow you to receive real-time notifications when events occur in EquipDash, enabling automated workflows and integrations.

What is a Webhook?

A webhook is an HTTP callback that sends data to your server when something happens:

1. An event occurs in EquipDash (e.g., new booking created)
2. EquipDash sends an HTTP POST request to your URL
3. Your server receives the event data and takes action

EquipDash                          Your Server
    │                                   │
    │  Event: booking.created           │
    │  ──────────────────────────────►  │
    │     POST /your-webhook-url        │
    │     { event, data, timestamp }    │
    │                                   │
    │  ◄──────────────────────────────  │
    │         200 OK                    │
    │                                   │

Webhook Structure

Webhook
├── name (identifier)
├── url (your endpoint)
├── events[] (subscribed events)
├── secret (for signature verification)
├── is_active
├── failure_count
└── last_triggered_at

Available Events

Booking Events

Event	Triggered When
booking.created	New booking is created
booking.updated	Booking details change
booking.cancelled	Booking is cancelled
booking.completed	Booking marked complete
booking.picked_up	Rental items are picked up
booking.returned	Rental items are returned
booking.checked_in	Customer checks in for an experience
booking.no_show	Staff mark the booking as a no-show
booking.status_changed	Booking status changes

Payment Events

Event	Triggered When
payment.received	Payment is processed
payment.refunded	Payment is refunded
payment.balance_due	A balance reminder is sent

Customer Events

Event	Triggered When
customer.created	New customer added
customer.updated	Customer details change
customer.deleted	Customer is deleted

Product Events

Event	Triggered When
product.created	New product added
product.updated	Product details change
product.archived	Product is archived

Experience Events

Event	Triggered When
experience.created	New experience added
experience.updated	Experience details change
experience.archived	Experience is archived

Other Events

Event	Triggered When
form_response.submitted	Waiver or form submitted
voucher.sold	Gift card/voucher purchased
voucher.redeemed	Voucher applied to booking

Booking requests, inventory, sessions, shifts, the workshop, store products, surveys, promo codes, agents, bundles, the waitlist and memberships have events too. Webhook Events lists every one.

API Endpoints

Method	Endpoint	Description	Scope Required
GET	/v1/webhooks	List all webhooks	webhooks:read
GET	/v1/webhooks/{id}	Get a single webhook	webhooks:read
POST	/v1/webhooks	Create a new webhook	webhooks:write
PATCH	/v1/webhooks/{id}	Update a webhook	webhooks:write
DELETE	/v1/webhooks/{id}	Delete a webhook	webhooks:write
GET	/v1/webhooks/events	List available events	webhooks:read
POST	/v1/webhooks/{id}/regenerate-secret	Generate new secret	webhooks:write

Webhook Payload Format

All webhook payloads follow this structure:

{
  "id": "evt_8fK2pQ7xLm4Vn9Rt3Wc1",
  "event": "booking.created",
  "created_at": "2026-01-15T12:00:00+00:00",
  "data": {
    // The record the event is about, e.g. the full booking object
  }
}

id names the event and stays the same when a delivery is retried, so use it to skip a repeat. See Webhook Events for a full example.

Mixed bookings

A booking that holds both rentals and experiences fires one booking.created event (not one per type — no fan-out, no double-counting). Its data.type is "mixed" and data.line_types is ["rental", "experience"]. Branch on line_types rather than type if you need to route the rental and experience halves separately. See Bookings → Line Types.

Verifying Webhook Signatures

Each webhook request includes an X-Webhook-Signature header. Always verify this signature:

$payload = file_get_contents('php://input');
$signature = hash_hmac('sha256', $payload, $your_webhook_secret);

if (hash_equals($signature, $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'])) {
    // Valid - process the webhook
    http_response_code(200);
} else {
    // Invalid - reject the request
    http_response_code(401);
}

Failure Handling

• Webhooks must respond with 2xx status within 30 seconds
• Failed deliveries are retried with exponential backoff
• After 10 consecutive failures, the webhook is automatically disabled
• Re-enable by updating is_active: true after fixing your endpoint

Common Use Cases

Sync Bookings to External Calendar

curl -X POST "https://app.equipdash.com/api/v1/webhooks" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Calendar Sync",
    "url": "https://your-app.com/webhooks/calendar",
    "events": ["booking.created", "booking.updated", "booking.cancelled"]
  }'

Send Notifications

Subscribe to events and send SMS/email notifications:

{
  "name": "Customer Notifications",
  "url": "https://your-app.com/webhooks/notify",
  "events": ["booking.created", "booking.no_show", "payment.received"]
}

Update Inventory Systems

Keep external inventory in sync:

{
  "name": "Inventory Sync",
  "url": "https://your-app.com/webhooks/inventory",
  "events": ["product.created", "product.updated", "booking.created"]
}

Best Practices

1. Always verify signatures - Never process unverified webhooks
2. Respond quickly - Return 200 immediately, process async if needed
3. Handle duplicates - Same event may be delivered more than once
4. Use HTTPS - Always use HTTPS URLs in production
5. Monitor failures - Check failure_count regularly
6. Rotate secrets - Periodically regenerate webhook secrets

Related Resources

• Bookings - Booking event payloads
• Customers - Customer event payloads
• Products - Product event payloads
• Experiences - Experience event payloads