Webhooks

Webhooks let your server receive HTTP POST payloads when events happen on your AllServicePros account.

Set up a webhook

  1. Open Developer console → Webhooks
  2. Provide a name, HTTPS payload URL, and subscribe to events
  3. Copy the signing secret when it is shown (only once)
  4. Return 2xx quickly from your endpoint; do heavy work asynchronously

Supported events

Bookings

| Event | When | | --- | --- | | booking.created | New booking created | | booking.pending_approval | Needs professional approval | | booking.confirmed | Confirmed by professional | | booking.cancelled | Cancelled | | booking.rescheduled | Time changed | | booking.completed | Marked completed | | booking.no_show | Customer no-show |

Quotes / RFQs

| Event | When | | --- | --- | | rfq.created | New quote request received | | quote.sent | Quote sent to customer | | quote.viewed | Customer viewed quote | | quote.accepted | Quote accepted | | quote.declined | Quote declined | | quote.expired | Quote expired |

Reviews & availability

| Event | When | | --- | --- | | review.submitted | New review submitted | | review.approved | Review approved and published | | availability.updated | Availability changed |

Request shape

POST https://your-server.example/hooks/asp
Content-Type: application/json
X-Webhook-Signature: t=1710000000,v1=HEX_HMAC
X-Webhook-Event: booking.created
X-Webhook-Id: evt_...

Body is a JSON object including the event type, id, timestamp, and payload data for that event.

Verify signatures (HMAC)

Every delivery is signed. The X-Webhook-Signature header looks like:

t=<unix_seconds>,v1=<hex_hmac_sha256>

Compute HMAC-SHA256 over the string ${t}.${rawBody} using your webhook secret. Reject if the timestamp is too old (recommend ±5 minutes) or the digest does not match.

Node.js example

import crypto from 'crypto';

function verifyAspWebhook(rawBody, signatureHeader, secret, toleranceSeconds = 300) {
  const [tPart, v1Part] = signatureHeader.split(',');
  const timestamp = Number(tPart.split('=')[1]);
  const received = v1Part.split('=')[1];
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - timestamp) > toleranceSeconds) return false;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  return crypto.timingSafeEqual(Buffer.from(received), Buffer.from(expected));
}

Always verify against the raw request body bytes, not a re-serialized JSON object.

Retries

Non-2xx responses are retried with backoff up to your webhook’s maxRetries setting. Keep handlers idempotent using X-Webhook-Id.

Related