Events and webhooks

A paid booking is held first (booking.held) and confirmed when the payment lands; a free one confirms at once. Each event's data is the resource after the change: the booking, session, offering, customer or org.

Guests can answer by email too. Messages to a guest carry a Reply-To of reply+<token>@daybooked.io, one address per conversation, so a reply joins the thread without the quoted email below it, as message.received with channel email, and the owner is emailed as for any guest message. Mail to that address from anyone but the guest is dropped. Messages to guests get delivered_at when their mail server takes the email, or failed_at when it bounces or is marked as spam.

curl "https://daybooked.io/api/v1/events?after=0" \
  -H "Authorization: Bearer daybooked_live_…"

{
  "data": [
    {
      "id": 42,
      "type": "booking.confirmed",
      "data": {
        "id": "1e2d3c4b-5a69-4788-9a6b-5c4d3e2f1a0b",
        "reference": "0GWYRZ2V",
        "status": "confirmed"
      },
      "created_at": "2026-12-01T17:04:11+00:00"
    }
  ],
  "next_after": 42
}

• Oldest first, up to 50 a call (limit up to 200). Filter with type, such as type=booking.confirmed.
• Pass next_after back as after to get what happened next; after=0 starts from the beginning.
• order=desc serves the newest first, for a look at what just happened rather than paging; next_after is still the newest event served.
• An event is served once it's 2 seconds old, so a cursor never skips one still being written.

curl -X POST https://daybooked.io/api/v1/webhooks \
  -H "Authorization: Bearer daybooked_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com/hooks/daybooked",
    "events": [
      "booking.confirmed",
      "booking.cancelled"
    ]
  }'

{
  "id": "9a8b7c6d-5e4f-4a3b-9c2d-1e0f9a8b7c6d",
  "url": "https://example.com/hooks/daybooked",
  "events": [
    "booking.confirmed",
    "booking.cancelled"
  ],
  "active": true,
  "secret": "whsec_…"
}

Each event then arrives as a JSON POST:

{
  "id": 42,
  "type": "booking.confirmed",
  "created_at": "2026-12-01T17:04:11+00:00",
  "data": {
    "id": "1e2d3c4b-5a69-4788-9a6b-5c4d3e2f1a0b",
    "reference": "0GWYRZ2V",
    "status": "confirmed"
  }
}

1. Keep the raw request body; verify before you parse it.
2. Split the header at the commas: t is a unix time, v1 the signature.
3. HMAC-SHA256 the string "<t>.<raw body>" with your webhook secret, hex encoded, and compare it to v1 in constant time.
4. Reject a t more than five minutes away, so a captured request can't be replayed.

import { createHmac, timingSafeEqual } from "node:crypto";

// body: the raw request body · header: the Daybooked-Signature header
function verify(secret, body, header) {
  const { t, v1 = "" } = Object.fromEntries(header.split(",").map((part) => part.split("=")));
  if (!t || Math.abs(Date.now() / 1000 - Number(t)) > 300) return false; // missing, stale or replayed
  const expected = createHmac("sha256", secret).update(`${t}.${body}`).digest("hex");
  return v1.length === expected.length && timingSafeEqual(Buffer.from(v1), Buffer.from(expected));
}

• Each endpoint gets the events it subscribes to, oldest first, one request at a time.
• A 2xx moves the endpoint's cursor past the event. Anything else stops delivery there: an error status, a redirect, or no answer within 5 seconds.
• A stopped endpoint picks up from the first event it missed: with its next event, and every 5 minutes, until it answers 2xx. Up to 50 events go out per run.
• Delivery is at least once: dedupe on the event id.
• An endpoint that answers 410 Gone is switched off: it has said it wants no more, as Zapier does for a Zap that's off. webhooks_list shows it with active: false and why in last_error, out of the count of 50, until you delete it.
• Revoking the API key that made a webhook (api_key_id) switches it off at once, as a 410 does: a leaked key's webhooks stop with it.
• A new endpoint starts with the next event; poll events_list for history.
• webhooks_list shows each endpoint's last status and error.