Webhooks

How webhooks work

When something happens in your Atlas account, for example a new booking, Atlas sends a POST request to an address you choose. Your server answers with status 200 within ten seconds, and the event counts as delivered.

Failed deliveries are retried six times over 24 hours, with growing pauses in between.

What an event looks like

Every event has the same shape. The type tells you what happened, data holds the object it happened to.

1{2  "id": "evt_3b81",3  "type": "booking.created",4  "created": "2026-10-20T09:14:02Z",5  "data": {6    "booking": "bk_7f2a",7    "starts": "2026-10-24T15:00:00+02:00",8    "service": "Haircut and wash"9  }10}

Check the signature

Each request carries the header Atlas-Signature. Compare it with your own hash of the body before you trust the event.

1import { createHmac, timingSafeEqual } from 'node:crypto';2 3export function isFromAtlas(body, signature, secret) {4  const expected = createHmac('sha256', secret).update(body).digest('hex');5  return timingSafeEqual(Buffer.from(expected), Buffer.from(signature));6}

Test without real bookings

In the dashboard under Developers you can send a sample event of any type to your endpoint and watch the response.