Webhooks

Webhooks push data to your server whenever something happens in Drumtix — a ticket is sold, an order is refunded, an attendee checks in, and so on.

Setting up a webhook

Go to Settings → Webhooks in your dashboard
Click Add Endpoint
Enter your endpoint URL (must be HTTPS)
Select the events you want to receive
Save — Drumtix will start delivering to your endpoint immediately

Sending a test event

Once an endpoint is saved, click the flask icon next to it to send a test payload. Choose any event type your endpoint subscribes to. The test request includes an X-Drumtix-Test: 1 header so you can tell it apart from real deliveries.

Webhook events

Event	Triggered when
`order.created`	A ticket order is completed
`order.refunded`	An order (full or partial) is refunded
`ticket.checked_in`	A ticket is scanned at the door
`event.updated`	An event’s details are changed
`event.cancelled`	An event is cancelled

Payload format

Drumtix sends a POST request with Content-Type: application/json. The body is a standard envelope:

{
  "id": "wh_01J9XYZ...",
  "type": "order.created",
  "createdAt": "2025-06-06T20:30:00.000Z",
  "data": {
    "id": "01J9ABC...",
    "organisationId": "org_...",
    "eventId": "01J9DEF...",
    "status": "paid",
    "subtotalMinor": 2500,
    "platformFeeMinor": 110,
    "totalMinor": 2610,
    "currency": "GBP",
    "createdAt": "2025-06-06T20:30:00.000Z"
  }
}

All *Minor fields are in the smallest currency unit (pence for GBP, cents for EUR). Money is never returned as a float.

Verifying webhook signatures

Every delivery includes these headers:

Header	Description
`X-Drumtix-Signature`	`v1=<hmac>` — HMAC-SHA256 signature
`X-Drumtix-Timestamp`	Unix timestamp in milliseconds when the request was sent
`X-Drumtix-Event`	The event type, e.g. `order.created`
`X-Drumtix-Delivery`	Unique delivery ID for this attempt

Always verify the signature before processing a payload. The signed string is {timestamp}.{rawBody} where timestamp is the value of X-Drumtix-Timestamp.

const crypto = require('crypto')

function verifySignature(rawBody, headers, secret) {
  const timestamp = headers['x-drumtix-timestamp']
  const sigHeader = headers['x-drumtix-signature'] // "v1=abc123..."
  const received = sigHeader?.replace(/^v1=/, '')

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex')

  return crypto.timingSafeEqual(
    Buffer.from(received ?? '', 'hex'),
    Buffer.from(expected, 'hex')
  )
}

Your endpoint secret is shown once when you create the endpoint. If you lose it, delete the endpoint and create a new one.

Reject any request where the signature does not match. Do not process the payload first and verify later.

Retries

If your endpoint returns a non-2xx status or times out, Drumtix will retry delivery up to 4 times with exponential backoff. After 4 failed attempts the delivery is marked as permanently failed. You can inspect delivery history — including response codes and bodies — in the Deliveries drawer next to each endpoint in Settings → Webhooks.

Zapier & Make.com

Connect Drumtix to Zapier via Settings → Integrations. Zapier-managed webhooks receive a simplified flat payload (no envelope wrapper) — the field mapping is handled inside the Zapier app. Make.com support is coming soon.

Overview

Events

Orders

Tickets

Attendees

Check-ins

Promoters

Setting up a webhook

Sending a test event

Webhook events

Payload format

Verifying webhook signatures

Retries

Zapier & Make.com

​Setting up a webhook

​Sending a test event

​Webhook events

​Payload format

​Verifying webhook signatures

​Retries

​Zapier & Make.com

Setting up a webhook

Sending a test event

Webhook events

Payload format

Verifying webhook signatures

Retries

Zapier & Make.com