> ## Documentation Index
> Fetch the complete documentation index at: https://docs.drumtix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhooks

> Receive real-time event notifications from Drumtix to your own endpoints.

Webhooks push data to your server whenever something happens in Drumtix — a ticket is sold, an order is refunded, an attendee checks in, and so on.

## Setting up a webhook

1. Go to **Settings → Webhooks** in your dashboard
2. Click **Add Endpoint**
3. Enter your endpoint URL (must be HTTPS)
4. Select the events you want to receive
5. Save — Drumtix will start delivering to your endpoint immediately

## Sending a test event

Once an endpoint is saved, click the flask icon next to it to send a test payload. Choose any event type your endpoint subscribes to. The test request includes an `X-Drumtix-Test: 1` header so you can tell it apart from real deliveries.

## Webhook events

| Event               | Triggered when                         |
| ------------------- | -------------------------------------- |
| `order.created`     | A ticket order is completed            |
| `order.refunded`    | An order (full or partial) is refunded |
| `ticket.checked_in` | A ticket is scanned at the door        |
| `event.updated`     | An event's details are changed         |
| `event.cancelled`   | An event is cancelled                  |

## Payload format

Drumtix sends a `POST` request with `Content-Type: application/json`. The body is a standard envelope:

```json theme={null}
{
  "id": "wh_01J9XYZ...",
  "type": "order.created",
  "createdAt": "2025-06-06T20:30:00.000Z",
  "data": {
    "id": "01J9ABC...",
    "organisationId": "org_...",
    "eventId": "01J9DEF...",
    "status": "paid",
    "subtotalMinor": 2500,
    "platformFeeMinor": 110,
    "totalMinor": 2610,
    "currency": "GBP",
    "createdAt": "2025-06-06T20:30:00.000Z"
  }
}
```

All `*Minor` fields are in the smallest currency unit (pence for GBP, cents for EUR). Money is never returned as a float.

## Verifying webhook signatures

Every delivery includes these headers:

| Header                | Description                                              |
| --------------------- | -------------------------------------------------------- |
| `X-Drumtix-Signature` | `v1=<hmac>` — HMAC-SHA256 signature                      |
| `X-Drumtix-Timestamp` | Unix timestamp in milliseconds when the request was sent |
| `X-Drumtix-Event`     | The event type, e.g. `order.created`                     |
| `X-Drumtix-Delivery`  | Unique delivery ID for this attempt                      |

**Always verify the signature** before processing a payload. The signed string is `{timestamp}.{rawBody}` where `timestamp` is the value of `X-Drumtix-Timestamp`.

```js theme={null}
const crypto = require('crypto')

function verifySignature(rawBody, headers, secret) {
  const timestamp = headers['x-drumtix-timestamp']
  const sigHeader = headers['x-drumtix-signature'] // "v1=abc123..."
  const received = sigHeader?.replace(/^v1=/, '')

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex')

  return crypto.timingSafeEqual(
    Buffer.from(received ?? '', 'hex'),
    Buffer.from(expected, 'hex')
  )
}
```

Your endpoint secret is shown once when you create the endpoint. If you lose it, delete the endpoint and create a new one.

<Warning>
  Reject any request where the signature does not match. Do not process the payload first and verify later.
</Warning>

## Retries

If your endpoint returns a non-2xx status or times out, Drumtix will retry delivery up to **4 times** with exponential backoff. After 4 failed attempts the delivery is marked as permanently failed.

You can inspect delivery history — including response codes and bodies — in the **Deliveries** drawer next to each endpoint in **Settings → Webhooks**.

## Zapier & Make.com

Connect Drumtix to Zapier via **Settings → Integrations**. Zapier-managed webhooks receive a simplified flat payload (no envelope wrapper) — the field mapping is handled inside the Zapier app. Make.com support is coming soon.