What are Webhooks
Webhooks let Timetics AI tell your own systems the moment something happens with a booking. Instead of you logging in to check for new bookings, Timetics AI sends a small message to a web address you control every time a booking is confirmed, cancelled, or rescheduled. Your app reads that message and does whatever you want with it: update a CRM, kick off an email sequence, log a row in a spreadsheet, ping an internal tool.
Why do you need this
Bookings rarely live in one place. You might track customers in a CRM, run automations in your own backend, or want a Slack message the second someone books. Copying that data by hand is slow and easy to forget. A webhook closes the gap: the event reaches your system in near real time, with the full booking details attached, so your automations fire on their own. If you build software on top of Timetics AI, webhooks are how you keep your side in sync without polling our API on a timer.
Step-by-Step Instructions
Step 1: Access Webhooks
Navigate to Dashboard → Settings → Webhooks. The page lists the webhooks in your workspace and lets you add, edit, test, pause, or delete them. Each webhook watches one event type and posts to one URL.
Step 2: Add a Webhook
Click “Add Webhook”. A form opens with four fields: Name, Webhook URL, Signing Secret, and Event Trigger.
Step 3: Name It
In the “Name” field, type a label that reminds you what this webhook does (for example, `CRM sync` or `Slack alerts`). The name is only for you; it never leaves your dashboard.
Step 4: Set the Webhook URL
In “Webhook URL”, paste the address on your server that should receive the event (for example, `https://example.com/hooks/timetics`). It must be a full, valid URL that accepts a POST request. This is where Timetics AI sends the booking data.
Step 5: Set the Signing Secret
The “Signing Secret” is a shared key used to prove the message really came from Timetics AI. Click “Generate” to create one (it starts with `whsec_`), or paste your own. Copy it with the copy button and store it in your app. You verify each incoming request against this secret, so keep it private.
Step 6: Choose the Event Trigger
Pick the one event this webhook fires on:
- Booking Created (`booking.created`) — a new booking is made
- Booking Confirmed (`booking.confirmed`) — a booking is confirmed
- Booking Cancelled (`booking.cancelled`) — a booking is cancelled
- Booking Rescheduled (`booking.rescheduled`) — a booking is moved to a new time
- Payment Completed (`payment.completed`) — a booking payment succeeds
- Payment Failed (`payment.failed`) — a booking payment fails
To listen for more than one event, add a separate webhook for each.
Step 7: Save
Click “Save”. The webhook appears in the list as Active and starts firing on the next matching event.
Step 8: Send a Test (Optional)
Click the test button on any webhook to send a sample `booking.test` payload to your URL right away. Use it to confirm your endpoint receives the request and your signature check passes before a real booking depends on it.
How the Request Looks
| Header | Value |
|---|---|
X-Timetics-Event | The event type, for example booking.confirmed |
X-Timetics-Signature | `sha256=<hash>`, an HMAC-SHA256 of the raw body signed with your Signing Secret |
The body carries the booking details: event id and uuid, status, the customer’s name, email and phone, start and end times, the host, any custom question answers, and a link back to the booking.
Verifying the Signature
To be sure a request is genuine, compute your own HMAC-SHA256 over the exact raw request body using your Signing Secret, prefix it with `sha256=`, and compare it to the `X-Timetics-Signature` header. If they do not match, reject the request. This stops anyone who does not know your secret from faking events.
Managing Webhooks
Each webhook in the list has controls:
| Action | What it does |
|---|---|
| Toggle switch | Pause or resume the webhook. Paused webhooks stop firing but stay saved. |
| Test | Sends a sample booking.test payload to the URL immediately. |
| Edit | Change the name, URL, signing secret, or event. |
| Delete | Permanently removes the webhook. |
Prerequisites
- Active Timetics AI account
- Permission to change workspace settings (owner or a role with settings access)
- A public HTTPS URL that accepts POST requests
- Somewhere on your side to store the Signing Secret and verify the signature
Notes
Delivery is best effort and happens at the moment of the event; there is no automatic retry, so build your endpoint to respond quickly and do heavy work in the background. Keep your Signing Secret private. If it leaks, edit the webhook, generate a new secret, and update it in your app. An inactive webhook fires nothing. If events stop arriving, check that the toggle is on and the URL still resolves. A webhook watches a single event. Point several webhooks at the same URL if you want one endpoint to receive more than one event type.