Webhooks

Subscribe

Register an endpoint from Panel → Settings → Webhooks or directly via the API.

POST /api/webhook-endpoints
Authorization: Bearer glv_...
Content-Type: application/json

{
  "url": "https://example.com/hooks/glanevo",
  "events": ["appointment.created", "payment.received"]
}

Event types

Payload

POST https://example.com/hooks/glanevo
X-Glanevo-Signature: sha256=ab12cd...
X-Glanevo-Event: appointment.created
X-Glanevo-Delivery: 8b2e9c6f-...
Content-Type: application/json

{
  "id": "evt_...",
  "type": "appointment.created",
  "createdAt": "2026-05-05T14:30:00Z",
  "data": {
    "id": "appt_...",
    "customerId": "cus_...",
    "staffId": "stf_...",
    "date": "2026-05-06",
    "time": "10:00"
  }
}

Signature verification

We generate a secret for every endpoint you register. Glanevo sends the HMAC-SHA256 hash of the request's raw body in theX-Glanevo-Signature header. Never trust the payload before verifying it.

// Node.js
import crypto from "crypto";

function verify(secret: string, body: string, header: string) {
  const expected = "sha256=" + crypto
    .createHmac("sha256", secret)
    .update(body)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(header)
  );
}

Retry policy

• 2xx response = success (10 second timeout).
• If non-2xx: 1m → 5m → 15m → 1h → 6h → 24h (6 attempts total).
• If all retries fail, the endpoint is automatically set to paused mode.
• Replay is available with a single click from the panel.