visit.created
A visit is created: an invitation or pre-registration (from the API, the console or the Workspace app), a
walk-in at the kiosk, or a confirmed in-person booking. data.object.source tells you which.
Agoo sends this as a signed POST to every enabled endpoint subscribed to visit.created (or *). Verify the
signature, return any 2xx within 15 seconds, and de-duplicate on webhook-id.
webhook-id*stringThe event's ID. It is the same on every attempt and redelivery, so use it to de-duplicate.
^evt_[0-7][0-9a-hjkmnp-tv-z]{25}$"evt_01m4ww0ezgf2bryg9gxb2gbewx"webhook-timestamp*stringWhen this attempt was signed, in Unix seconds. Reject the request if it is more than 5 minutes from your clock.
^[0-9]+$webhook-signature*stringOne or more space-separated signatures, each v1,<base64>: the base64 HMAC-SHA256 of
{webhook-id}.{webhook-timestamp}.{raw body}, keyed with the base64-decoded part of your whsec_ secret.
During a secret rotation there are two. Accept the request if any one matches.
application/json- body
An event about a visit.
id*EventIdThe event's ID. Webhook deliveries send it as webhook-id.
^evt_[0-7][0-9a-hjkmnp-tv-z]{25}$"evt_01m4ww0ezgf2bryg9gxb2gbewx"created_at*stringWhen the event happened.
date-timeorganisation_id*OrganisationIdAn organisation ID (TypeID with the org prefix).
^org_[0-7][0-9a-hjkmnp-tv-z]{25}$"org_01kjpsrza0etzb0a4vf72x8ang"livemode*booleanfalse for events in test mode.
type*string"visit.created""visit.updated""visit.approval_requested""visit.approved""visit.denied""visit.checked_in""visit.checked_out""visit.cancelled""visit.no_show""visit.needs_someone""visit.host_changed"data*Return any 2xx status within 15 seconds to acknowledge the event. Agoo ignores the response body, so
acknowledge first and do slow work afterwards.
Example Requests
/visit.createdRedeliver an event POST
Queues the event for delivery again, to one endpoint or to every enabled endpoint subscribed to its type. Redeliveries carry the same `webhook-id` as the original, so handlers that de-duplicate on it stay safe, and are retried on the usual schedule. Use it after fixing an endpoint that missed events. - An `endpoint_id` must be enabled and subscribed to the event's type (`validation_failed` otherwise). - An OAuth app acts with its person's role as well as its scopes: when that role can't manage webhooks (an Auditor reads events but can't), the answer is `forbidden` and nothing is queued. - With no `endpoint_id` and no enabled endpoint subscribed to the type, `endpoint_ids` is empty: nothing was queued, and the audit trail records no redelivery. **Scope:** `webhooks:manage` · **Plan:** Growth, Pro and Enterprise in live mode; every plan in test mode.
visit.updated Webhook
A visit's details change: site, host, type, times, purpose or custom fields. Status changes fire their own events instead. Agoo sends this as a signed `POST` to every enabled endpoint subscribed to `visit.updated` (or `*`). Verify the signature, return any `2xx` within 15 seconds, and de-duplicate on `webhook-id`.