Partner API

Webhooks

Webhooks tell your server when studio data changes, regardless of whether the change came from web-admin, a widget, mobile, a provider reconciliation, or the Partner API.

Create a subscription

In Settings → Developer, choose a credential with webhooks:manage, enter a public HTTPS endpoint, and select events. The signing secret is shown once.

Verify every request

ClassFlow signs the exact request body as HMAC-SHA256(secret, timestamp + "." + body). Reject stale timestamps, compare signatures in constant time, then record the delivery ID before processing.

import crypto from "node:crypto";

const signed = Buffer.concat([
  Buffer.from(req.headers["x-classflow-timestamp"] + "."),
  rawBody,
]);
const expected = "v1=" + crypto
  .createHmac("sha256", process.env.CLASSFLOW_WEBHOOK_SECRET)
  .update(signed)
  .digest("hex");

const supplied = Buffer.from(signature ?? "");
const calculated = Buffer.from(expected);
if (supplied.length !== calculated.length ||
    !crypto.timingSafeEqual(calculated, supplied)) {
  throw new Error("Invalid ClassFlow signature");
}

Headers

Delivery behavior

• Return a 2xx response within 10 seconds after persisting the event to your own queue.
• Deliveries can be duplicated and related events can arrive out of order. Processing must be idempotent.
• ClassFlow attempts delivery up to eight times with increasing delays, then moves it to dead-letter state.
• Studio operators can inspect each HTTP attempt, replay any delivery, and rotate the signing secret from Settings → Developer.
• Revoking or expiring the owning API credential stops delivery. Credential rotation transfers subscriptions to the replacement credential.
• Redirects are not followed, and endpoints resolving to private or loopback networks are rejected.

Event catalog

booking.created, booking.cancelled, class.created, class.updated, class.cancelled, form.submitted, lead.created, lead.updated, member.created, member.updated, membership.updated, purchase.created, waitlist.created, and waitlist.updated.

Webhook payloads contain safe identifiers and the API version. Fetch the current resource through the scoped Partner API when you need more fields.