Webhooks

Push booking, invoice, lease and customer events to your other systems automatically, within seconds of them happening.

When You'd Use Webhooks

Webhooks connect Camper BMS to systems that live outside it - a CRM, a staff chat, a spreadsheet, or a no-code tool like Zapier (which can pass events on to hundreds of other apps without any code). You don't need a developer, and if you don't connect anything, nothing depends on this feature.

Accessing Webhooks

Navigate to Integrations > Webhooks from the main navigation.

Adding an Endpoint

1. Click to add an endpoint and enter the secure (HTTPS) web address that should receive the events.

2. Choose which events it should receive, or leave them all selected to receive everything.

3. Tick the acceptance checkbox to confirm you accept responsibility for data sent to this endpoint.

4. Copy the signing secret so your receiving system can verify incoming messages.

5. Click Send test to fire a sample event and confirm the other end is receiving it.

You can pause, resume or delete a connection at any time.

Events You Can Listen For

• Bookings - created, reserved, pending, confirmed, cancelled, or changed (a new check-in, check-out or site)

• Arrivals and departures - checked in, checked out

• Invoices - issued, paid, refunded

• Leases - created, activated, renewed, ended, or changed (a new date, site, access code or vehicle registration)

• Customers - a new guest record created

What's in the Data

Each message includes the event name, when it happened, and which campground it relates to, plus the details for that event (the guest and booking for a booking event, the invoice for an invoice event, the lease and its tenants for a lease event).

• Consent travels with the data. Every guest in a payload carries a marketing-consent flag so your receiving system can respect it.

• The IDs are safe to share. Identifiers in the payload are public reference codes, never internal database IDs.

• Arrival details travel with the booking. Every booking payload carries the check-in and check-out dates and times, your park's timezone, and the access code and vehicle registration when they are set.

Security and Reliability

• HTTPS only - endpoints must be secure web addresses.

• Every message is signed with HMAC-SHA256 using your endpoint's secret. Your receiving system can recompute the signature to confirm the message genuinely came from Camper BMS. The Webhooks page provides copy-ready PHP, Node and Python verification examples.

• Automatic retries - if your endpoint doesn't respond, Camper BMS retries a couple of times over the next few minutes. Each connection shows its consecutive-failure count, and a persistently broken endpoint is automatically paused (and you're emailed) so it isn't hammered.

• Destination checks - Camper BMS verifies the destination is a genuine external server, blocking attempts to point webhooks at internal addresses.

Delivery Log

Every delivery attempt is recorded - the event, where it went, whether it succeeded, the response, and the exact data sent. Each delivery has a Resend button to re-fire a payload if the other system was down. Delivery records are kept for 90 days, then automatically deleted.

Billing and Consent

• Webhooks are included at no extra charge - not metered. Like the API, they're available on every account and pause automatically while an account is restricted (for example, an unpaid invoice).

• Webhooks are not gated behind marketing consent - they're operator-directed data flows, so the consent decision belongs to your receiving system (which is why the consent flag travels in every payload).

Developer Detail

Every webhook is an HTTP POST to your endpoint with a JSON body. Payloads are built at the moment the event happens.

Delivery

Verify the signature over the exact bytes received, comparing in constant time:

// PHP
$expected = hash_hmac('sha256', $rawBody, $secret);
$valid = hash_equals($expected, $request->header('X-CamperBMS-Signature'));

// Node
const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
const valid = crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(req.get('X-CamperBMS-Signature')));

Events

Every payload starts with the envelope below, followed by the block named in the Payload column. To act only on paid bookings, use booking_confirmed. booking_created also fires for unpaid holds and drafts.

Envelope

Present on every payload.

Booking payload

Events: booking_created, booking_reserved, booking_pending, booking_confirmed, booking_cancelled, booking_changed, checked_in, checked_out.

{
  "event": "booking_confirmed",
  "test": false,
  "occurred_at": "2026-09-09T04:09:39+00:00",
  "campground": {
    "id": "CMG9Q6MGG72J",
    "name": "Equinox Foreshore Reserve",
    "timezone": "Australia/Melbourne"
  },
  "guest": {
    "id": "CT3K8VQ2PL",
    "email": "guest@example.com",
    "first_name": "Sam",
    "last_name": "Taylor",
    "marketing_consented": true
  },
  "booking": {
    "id": "BKZ57Y950WQK",
    "check_in": "2026-09-18",
    "check_out": "2026-09-19",
    "check_in_time": "15:00",
    "check_out_time": "11:00",
    "site_type": "Powered Site",
    "guests": 3,
    "children": 1,
    "infants": 1,
    "status": "confirmed_paid",
    "access_code": "6173",
    "vehicle_registration": "XYZ-123"
  }
}

Invoice payload

Events: invoice_issued, invoice_paid, invoice_refunded.

{
  "event": "invoice_paid",
  "test": false,
  "occurred_at": "2026-09-09T04:09:39+00:00",
  "campground": { "id": "CMG9Q6MGG72J", "name": "Equinox Foreshore Reserve", "timezone": "Australia/Melbourne" },
  "guest": {
    "id": "CT3K8VQ2PL",
    "email": "guest@example.com",
    "first_name": "Sam",
    "last_name": "Taylor",
    "marketing_consented": true
  },
  "invoice": {
    "id": "IN7H2M4QWX",
    "amount": 248.00,
    "currency": "AUD",
    "status": "paid",
    "booking_id": "BKZ57Y950WQK",
    "lease_id": null
  }
}

Lease payload

Events: lease_created, lease_activated, lease_renewed, lease_ended, lease_changed.

{
  "event": "lease_activated",
  "test": false,
  "occurred_at": "2026-09-09T04:09:39+00:00",
  "campground": { "id": "CMG9Q6MGG72J", "name": "Equinox Foreshore Reserve", "timezone": "Australia/Melbourne" },
  "lease": {
    "id": "LS4P9X1RQ7",
    "start_date": "2026-07-01",
    "end_date": "2027-06-30",
    "status": "active",
    "site_type": "Powered Site",
    "end_of_lease_action": "renew_same_term",
    "occupancy_started_at": "2019-03-15",
    "access_code": "4321",
    "vehicle_registration": "ABC 123"
  },
  "tenants": [
    {
      "id": "CT3K8VQ2PL",
      "email": "tenant@example.com",
      "first_name": "Sam",
      "last_name": "Taylor",
      "marketing_consented": false
    }
  ]
}

Customer payload

Events: customer_created. The guest block is as described under the booking payload.

{
  "event": "customer_created",
  "test": false,
  "occurred_at": "2026-09-09T04:09:39+00:00",
  "campground": { "id": "CMG9Q6MGG72J", "name": "Equinox Foreshore Reserve", "timezone": "Australia/Melbourne" },
  "guest": {
    "id": "CT3K8VQ2PL",
    "email": "guest@example.com",
    "first_name": "Sam",
    "last_name": "Taylor",
    "marketing_consented": false
  }
}

Test payload

The Send test action posts a booking payload with "test": true, "id": "test" on the guest and the booking, dates seven and ten days ahead, the park's default check-in and check-out times, and null for access_code and vehicle_registration. Its fields are identical to a real booking payload.