Webhooks

All Out sends booking events and catalogue events to the HTTPS addresses you gave (port 443), which can be one address for both. Tell events apart by the X-Allout-Event-Type header or the body's eventType: booking.updated, availability_request.updated, or activity.added, activity.updated, activity.removed. See the event payloads under Webhooks in the API reference.

• Answer with any 2xx within 10 seconds, once you have stored the event.
• Anything else is retried after 1, 5 and 15 minutes, then 1, 3, 6 and 12 hours: eight attempts in all.
• Webhooks can be missed. After any outage or suspension, read your open bookings. The booking is the source of truth.

Handling events correctly

Delivery is at least once, and events can arrive late or out of order.

• Store eventId and ignore one you already have.
• Keep the highest bookingVersion per booking, and the highest catalogueVersion overall. Ignore an event with a lower one.
• Capture at most once per booking, however many events you receive.
• A webhook is a notice, not a payment instruction. Capture results always come from your side, through POST /payment-updates.

Verifying the signature

Verify every request before using it. The headers are X-Allout-Event-Id, X-Allout-Event-Type, X-Allout-Timestamp (Unix seconds, new on every attempt) and X-Allout-Signature.

The signature is the hex HMAC-SHA256 of <timestamp>.<raw body>, keyed with your webhook signing secret. Use the raw bytes as received, before parsing.

const crypto = require('crypto');

function verify(rawBody, headers, secret, toleranceSeconds = 300) {
  const ts = headers['x-allout-timestamp'];
  const given = headers['x-allout-signature'] || '';
  if (!ts || Math.abs(Date.now() / 1000 - Number(ts)) > toleranceSeconds) return false;
  const expected = crypto.createHmac('sha256', secret).update(`${ts}.${rawBody}`).digest('hex');
  return given.length === expected.length && crypto.timingSafeEqual(Buffer.from(given), Buffer.from(expected));
}