Webhooks for developers

Add an endpoint

Webhooks sit alongside the other integrations under Settings → Integrations, next to Add booking to your website and Sync with Google Calendar. A webhook calls a URL on your server the moment something happens in Slotwise, instead of you having to poll for changes.

1. Go to https://slotwise.skotechlabs.com/app/integrations and open Webhooks.
2. Enter the URL of your endpoint — the address on your server that will receive the calls.
3. Choose which events should trigger a call to that endpoint:
   • appointment.created
   • appointment.confirmed
   • appointment.rescheduled
   • appointment.cancelled
   • appointment.completed
   • appointment.no_show
   • payment.received
   • customer.created
   • review.created
4. Save.

Tip Only subscribe to the events you actually plan to handle. It's easier to add more later than to filter out noise from events your code ignores.

The payload

Every webhook call is a POST request with a JSON body shaped like this:

{
  "id": "evt_7f3a1c9e2b5d4f60",
  "event": "appointment.created",
  "created_at": "2026-09-14T10:30:00Z",
  "business": { ... },
  "data": { ... }
}

id uniquely identifies this delivery, event is one of the event names above, created_at is when it happened, business identifies which Slotwise business it belongs to, and data holds the record itself — the appointment for an appointment.* event, the customer for customer.created, and so on.

Verify the signature

Every request carries a signature header so you can confirm it really came from Slotwise and wasn't altered in transit:

X-Slotwise-Signature: t=<unix time>,v1=<signature>

• t is the Unix timestamp, in seconds, of when the request was sent.
• v1 is the hex-encoded HMAC-SHA256 signature of the string <t>.<raw body>, computed using your webhook secret.

To verify a request on your end: take the t value from the header, join it with a period to the raw, unparsed request body (exactly as received, before any JSON parsing), compute the HMAC-SHA256 of that combined string using your webhook secret, and check that the resulting hex digest matches the v1 value. If it doesn't match, reject the request.

Tip Use the raw request body for this, not a re-serialized version of the parsed JSON. Re-serializing can reorder keys or change whitespace, which changes the bytes and breaks the signature check.

Retries and testing

If your endpoint doesn't respond successfully, Slotwise retries the delivery automatically — after 1 minute, then 5, then 30, then 120 minutes. After that final attempt, it stops retrying that particular delivery.

Use the Send test button next to an endpoint to send a sample payload immediately, without waiting for a real event. It's the fastest way to check your endpoint and your signature verification both work before you rely on them.

Tip Design your handler to be idempotent — safe to process the same event twice — using the id field to detect duplicates. An occasional retry can mean the same event arrives more than once.

Using Zapier or Make

You don't need an in-house developer to use webhooks. Both Zapier and Make let you start an automation with a Catch hook trigger: create one, copy the URL it gives you, and paste that in as your endpoint URL in Slotwise. From there you can build an automation — for example, adding every new customer to a spreadsheet — without writing any code.

Tip Start with Send test when wiring up Zapier or Make. It lets you confirm the connection and see a real payload shape before a genuine booking triggers your automation.