Introduction

Webhooks let you receive real-time notifications when events happen on the Bardge network — a booking is confirmed, a booking is cancelled, a client purchases credits, or a prepaid pass renews — instead of polling the API for changes.

What you can do

List your registered webhook endpoints

Delete (disable) a webhook endpoint

Key concepts

Registering an endpoint

Call POST /webhook_endpoints with the URL you want events delivered to. Only one webhook endpoint is active per reseller at a time — registering a new URL replaces and disables the previous endpoint.

{
  "url": "https://example.com/bardge/webhooks"
}

The response includes a signing_secret — save it immediately. It is only ever returned once, at registration time, and is required to verify incoming events. It is not returned by the list endpoint.

A ping event is sent to the new endpoint immediately after registration to confirm connectivity.

Event types

Event	When it fires
`ping`	Sent once, immediately after registering an endpoint
`booking.confirmed`	A spa or class booking is confirmed
`booking.cancelled`	A booking is cancelled
`credits.purchased`	A credit package purchase completes for a client
`prepaid.pass.renewed`	A prepaid pass renews
`checkin.succeeded`	A client successfully checks in for a visit

Endpoints receive all event types — there is no per-endpoint event filtering.

Payload shape

Every webhook request body has the same envelope:

{
  "event_type": "booking.confirmed",
  "event_id": "whevt_01H8XYZABCDE",
  "reseller_id": "res_01H8XYZABCDE",
  "created_at": "2026-04-30T12:00:00Z",
  "api_version": "v3",
  "data": { ... }
}

data holds the same response object your API call would have returned for that action (for example, the booking response for booking.confirmed).

checkin.succeeded example

{
  "event_type": "checkin.succeeded",
  "event_id": "whevt_01H8XYZABCDE",
  "reseller_id": "res_01H8XYZABCDE",
  "created_at": "2026-04-30T12:00:00Z",
  "api_version": "v3",
  "data": {
    "client_id": "cl_01H8XYZABCDE",
    "checkin_id": "chkin_01H8XYZABCDE",
    "provider_branch_name": "Bardge Spa - Victoria Island",
    "checked_in_at": 1777896000,
    "status": "success",
    "failure_reason": null
  }
}

Signature verification

Every webhook request carries an X-Bardge-Signature header:

X-Bardge-Signature: sha256=5257a869e7ecebeda32affa62cdca3fa51cad7e77a0e56ff536d0ce8e108d8bd

To verify a request:

Compute HMAC-SHA256(signing_secret, raw_request_body), using the raw request body bytes exactly as received.

Hex-encode the result and compare it against the value after sha256= in the header, using a constant-time comparison.

Reject the request if the signatures do not match.

The signing secret is specific to the endpoint and distinct from your API key.

Delivery and retries

Delivery is attempted over HTTP POST with a JSON body and the signature header above.

Any 2xx response marks the event as delivered. Any other response (or a timeout) is treated as a failed attempt.

Failed attempts are retried on a fixed schedule: 1s, 5s, 30s, 5m, 30m — up to 6 attempts total. After the final failed attempt, the event is marked FAILED and not retried further.

Deliveries are at-least-once — the same event may be delivered more than once. Dedupe on event_id.

Return a 2xx response quickly. If processing takes time, acknowledge receipt first and process asynchronously.

Disabling an endpoint (via delete) stops future deliveries, including any already-queued events for that endpoint.

Bookings — source of booking.confirmed and booking.cancelled events

Credits — source of credits.purchased events

What you can do#

Key concepts#

Related sections#

What you can do

Key concepts

Related sections