Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.travelbase.ai/llms.txt

Use this file to discover all available pages before exploring further.

ā€‹
Webhook delivery format

Travelbase delivers webhook events as HTTP POST requests with a JSON payload. Example delivery 
{
"id": "evt_01hzy9k2yz",
"type": "order.ticketed",
"created_at": "2026-02-20T16:25:51.293Z",
"data": {
"order_id": "ord_123",
"status": "ticketed"
}
}

ā€‹
Delivery headers

Each webhook delivery includes security and metadata headers to help your system verify authenticity and process events safely.
HeaderDescription
x-webhook-idUnique identifier for the webhook delivery
x-webhook-eventEvent type (for example, order.ticketed)
x-webhook-timestampISO timestamp indicating when the event was generated
x-webhook-signatureHMAC SHA-256 signature used to verify authenticity
Always verify webhook signatures before processing events to prevent unauthorized requests.

ā€‹
Signature verification

Travelbase signs each webhook delivery using your webhook secret. Your system must verify this signature before accepting the event.

ā€‹
Signature format

The signature is generated using HMAC SHA-256: 
HMAC_SHA256(secret, `${timestamp}.${payload}`)

ā€‹
Signature components

The signature is generated using the following components:
ComponentDescription
secretYour webhook signing secret
timestampValue from the x-webhook-timestamp header
payloadRaw HTTP request body exactly as received

ā€‹
Delivery guarantees

Travelbase provides reliable and fault-tolerant webhook delivery to ensure your system receives critical events.

Automatic retries

Failed webhook deliveries are retried automatically using exponential backoff until successful.

At-least-once delivery

Webhooks are guaranteed to be delivered at least once. Your system must safely handle duplicate deliveries.
Best practices Follow these best practices to ensure secure, reliable, and production-ready webhook handling.

Verify signatures

Always verify the webhook signature before processing events.

Respond quickly

Return an HTTP 200 response immediately after receiving the webhook to prevent retries.

Implement idempotency

Store and track webhook event IDs to prevent duplicate processing.

Use secure endpoints

Only configure HTTPS endpoints to ensure secure communication.
```