The Webhook integration pushes EvTrack events to any HTTP endpoint you control - visit lifecycle events (registered, approved, checked-in, checked-out, cancelled) are delivered as JSON payloads, letting you build custom automations without polling the API.

Prerequisites

• An HTTPS endpoint you control that accepts POST requests
• Optionally, an HMAC key for verifying payload signatures

Step 1: Add the integration

Open Configuration > System Settings > Apps and click Add, then choose Webhook from the integration catalogue.

Step 2: Configure the endpoint

Give the integration a name, then provide a target URL for each event you want delivered - visit created, check-in, check-out, updated, no-show, cancelled and denied. An HMAC Key (with a Generate button) signs the payloads, and optional encryption settings protect them in transit. Under Security Configuration, Connection Security sets how EvTrack connects to your endpoint: HTTP (Not Recommended), HTTPS without Verification (Dev Only) or HTTPS with Strict Verification (Production), which is the default for a new app. Strict verification checks the certificate and host name, so the endpoint needs a certificate from a publicly trusted authority; the unverified option accepts self-signed certificates. Every event URL must match the choice: http:// for HTTP, https:// for either HTTPS option.

Note: When an HMAC key is configured, every request carries an X-Evtrack-Hmac-Sha256 signature header and an X-Evtrack-Hmac-Timestamp header so your endpoint can verify integrity and reject stale (replayed) requests. If your endpoint requires its own authentication - Basic Auth or a JWT bearer token - add it under Optional HTTP Headers and it is included on every request.

Note: Changing Connection Security on a saved app asks for the HMAC key again. The key is generated and hidden, so in practice you generate a new key and update your receivers to use it.

Payload formats, signature verification and the full event catalogue are documented in the API > Webhooks section.