Webhooks: send events to your other systems

What a webhook is

A webhook is an automatic message elastudio sends to an address of yours the moment something happens: a new member, a booking, a payment, a check-in. Your developer, or a tool like Make, n8n or Zapier’s webhook step, receives it and does the rest, for example adding the member to your CRM or a row to a spreadsheet.

Who can use it

• Webhooks come with the Pro plan.
• On Growth, you can add them as an add-on, billed with the plan: US$21.90 a month, or US$219 a year on a yearly plan. The owner adds it in Settings, Plan and usage, tab Add-ons. See Add-ons on your elastudio plan.
• The owner and admins open the page. Only the owner adds or removes the add-on.

Note: If your studio used elastudio before 27 October 2026, webhooks start switched off. The owner or an admin turns them on in Settings, Tools, Features: switch on Outgoing webhooks.

Add an endpoint

An endpoint is the address that receives the events.

1. Open Settings and choose Webhooks, under Developers. Select Add endpoint.
2. In Endpoint address, paste the address that receives the events. It must start with https:// and be public on the internet: an address on a private network, an IP address, a local name or another port is refused.
3. Under Events to send, tick the events you want, or Every event. A Note (optional) helps you remember what receives it.
4. Select Add endpoint. Your Signing secret appears: copy it into the receiving system now, then select I copied it. It is shown only this once.
5. Select Send test. Your system should get a webhook.test event and answer with a 2xx status.

You can have up to 10 endpoints. Each one has Edit, Switch off or Switch on, Delete and Delivery log.

The events

Event	Name in the admin	Sent when
member.created	New member	a member profile is created (by the member, at the desk or by an import)
member.updated	Member updated	a member’s profile changes
booking.created	Booking made	a member has a confirmed place in a class (after payment, or from the waiting list)
booking.cancelled	Booking cancelled	a class booking is cancelled by the member or the studio
checkin.created	Check-in	a member is marked as attended in a class, or checked in at an event
order.paid	Order paid	a sale is paid in full, online or at the desk
order.refunded	Refund	money is refunded on an order, in full or in part
membership.started	Membership started	a membership begins
membership.renewed	Membership renewed	a membership is paid for another period
membership.paused	Membership paused	a membership pause is scheduled
membership.ended	Membership ended	a membership is cancelled or expires
event_ticket.sold	Event ticket sold	event tickets are paid
appointment.confirmed	Private session confirmed	a private session is confirmed

Each event carries ids and only the few fields it needs. Member events carry the name, e-mail and language; the others carry ids (member, class, order, membership). elastudio never sends card details, phone numbers, addresses, birth dates, tax numbers, health information or notes.

The signature, in plain words

Anyone who knows your endpoint’s address could send it a fake message. The signing secret stops that. elastudio signs every delivery with it, like a wax seal on a letter, and your system checks the seal before trusting the message. Only elastudio and your system know the secret.

If the secret may have leaked, select Rotate secret. You get a new one at once; for 24 hours each delivery is signed with both, so you have time to update your system.

If your system is down

Your system has 10 seconds to answer with a 2xx status. Otherwise elastudio tries again after 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours, 12 hours and 24 hours: 8 tries over about 2 days.

If nothing gets through for 3 days, elastudio switches the endpoint off and e-mails the studio owner. The endpoint shows Failing before that. Fix the receiver, select Switch on and send a test. Test sends do not count toward switching off.

The delivery log

Select Delivery log on an endpoint to see the last 30 days, newest first: each event, whether it was Delivered, Waiting or Failed, how many tries, the answer your system gave (its status and the start of its message) and when the next try is. Resend sends one again with the same id. elastudio keeps the answer, never what it sent.

If you change plan

On a plan without webhooks, or once the add-on ends, nothing more is sent, and nothing is kept to send later. Your endpoints and their log stay, and you can switch them off or delete them. Before the add-on or a plan with webhooks ends, the Webhooks page shows Webhooks stop on with the date and the owner gets an e-mail.

For developers

Each delivery is a POST with a JSON body:

{
  "id": "8b0c6c1e-...",
  "type": "order.paid",
  "createdAt": "2026-10-27T12:00:00.000Z",
  "studioId": "e1a00000-...",
  "apiVersion": "2026-10-27",
  "data": { "object": { "object": "order", "id": "...", "memberId": "...", "total": { "amount": 7000, "currency": "USD" }, "method": "card", "complimentary": false } }
}

• Money is in cents (7000 is 70.00). Times are ISO 8601 in UTC; dates are the studio’s local dates.
• Headers: webhook-id (the same on every try of one delivery), webhook-timestamp (seconds) and webhook-signature.
• The signature is v1, followed by the base64 HMAC-SHA256 of webhook-id.webhook-timestamp.body, keyed with the part of your secret after whsec_, decoded from base64. During a rotation the header holds two signatures, separated by a space; accept either.
• This is the Standard Webhooks format, so its free libraries check it for you.
• Refuse a timestamp more than 5 minutes old, and skip a webhook-id you already handled.
• Redirects are never followed.