Webhooks
Send Tiquo events to your own endpoints as they happen
Webhooks let Tiquo tell your systems when something changes, so you don't have to keep polling the Admin API. Each time a subscribed event happens, Tiquo sends an HTTP POST with the event details to the endpoint URL you chose.
Webhooks are available to every organization. You manage them in Settings > Webhooks under the Developer section. The tab needs the same permission as Admin API keys.
Add a webhook
- Go to Settings > Webhooks and choose to add a webhook.
- Enter a Name, the Endpoint URL, and an optional Description.
- Tick the Events you want to receive.
- Add any Custom headers your endpoint needs, up to 10. These are static values sent with every request. Once saved, header values aren't shown again. When you edit the webhook, leave a value blank to keep the one you saved.
- Save.
The endpoint URL must be a public address. Tiquo won't send to private or internal addresses, and it doesn't follow redirects, so use the final URL.
Events
| Group | Events |
|---|---|
| Customers | customer.created, customer.updated |
| Companies | company.created, company.updated |
| Orders | order.created, order.updated, order.completed, order.cancelled, order.refunded |
| Bookings | booking.created (a tentative booking), booking.confirmed, booking.updated, booking.cancelled, booking.completed |
| Enquiries | enquiry.created, enquiry.updated |
| Memberships | membership.created, membership.updated, membership.paid |
| Payments | payment.succeeded, payment.failed, payment.refunded, payment.partially_refunded |
Tiquo only records an event when at least one active webhook is subscribed to it.
Each organization can have up to 20 webhooks.
Verify the signature
Every request carries a tiquo-signature header in the form t=timestamp,v1=signature. The signature is an HMAC-SHA256 of timestamp.body, using your webhook's signing secret as the key. Recompute it on your side and compare before you trust the request.
Delivery and retries
Reply with a 2xx status within 10 seconds to confirm you received the event. Anything else counts as a failed delivery.
Tiquo delivers each event at least once, so your endpoint may occasionally receive the same event more than once, for example after a retry or a replay. Every copy carries the same tiquo-event-id header, so store the IDs you've handled and skip repeats. Each request also carries a tiquo-delivery-attempt header with the attempt number.
- A failed delivery is retried 7 times over about 44 hours.
- If every delivery to a webhook fails for 3 days, Tiquo turns the webhook off. It shows as Turned off with a note in Settings, and the change is recorded in the activity log. Fix your endpoint, then turn the webhook back on.
- Tiquo emails the organization's admins and the person who created the webhook after a day of failed deliveries, and again if the webhook is turned off.
- Delivery history and events are kept for 30 days.
Manage a webhook
Use the switch on a webhook to pause or enable it. Paused and deleted webhooks stop sending, and any retries still waiting are closed as not sent. The menu on each webhook also has:
- Send test: sends a test event and tells you the response status, or why it couldn't be delivered. Each webhook can send 5 test events a minute, and the organization 30 an hour.
- Edit: change the name, URL, events, or headers.
- Rotate secret: creates a new signing secret. The old secret stops working immediately, so update your endpoint straight away. Tiquo asks you to confirm first.
- Delete: removes the webhook.
Each webhook lists its recent delivery attempts. You can replay an attempt, as long as the webhook is active and the attempt isn't still in progress. An organization can replay up to 200 attempts an hour.
Webhooks created by Zapier
If you connect Tiquo to Zapier, Zapier creates and removes its own webhooks when you turn a Zap on or off. These show as Managed by Zapier and are read-only in Tiquo. You can't edit, rotate, delete, or send test events to them. Change them in Zapier instead.