[{"data":1,"prerenderedAt":1644},["ShallowReactive",2],{"navigation":3,"\u002Fapi\u002Fwebhooks\u002Foverview":547,"\u002Fapi\u002Fwebhooks\u002Foverview-surround":1639},[4,28,62,92,117,146,253,292,325,349,385,421,459,488],{"title":5,"path":6,"stem":7,"children":8,"icon":27},"Getting Started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,12,17,22],{"title":10,"path":6,"stem":7,"icon":11},"Introduction","i-lucide-house",{"title":13,"path":14,"stem":15,"icon":16},"Usage","\u002Fgetting-started\u002Fusage","1.getting-started\u002F3.usage","i-lucide-sliders",{"title":18,"path":19,"stem":20,"icon":21},"Signing in on the mobile app","\u002Fgetting-started\u002Fmobile-app-sign-in","1.getting-started\u002F4.mobile-app-sign-in","i-lucide-smartphone",{"title":23,"path":24,"stem":25,"icon":26},"Running without email","\u002Fgetting-started\u002Frunning-without-email","1.getting-started\u002F5.running-without-email","i-lucide-mail-x",false,{"title":29,"icon":27,"path":30,"stem":31,"children":32,"page":27},"Security & Privacy","\u002Fsecurity","10.security",[33,38,43,47,52,57],{"title":34,"path":35,"stem":36,"icon":37},"Security Overview","\u002Fsecurity\u002Foverview","10.security\u002F1.overview","i-lucide-shield-check",{"title":39,"path":40,"stem":41,"icon":42},"Authentication","\u002Fsecurity\u002Fauthentication","10.security\u002F2.authentication","i-lucide-log-in",{"title":44,"path":45,"stem":46,"icon":21},"Two-Factor & Devices","\u002Fsecurity\u002Ftwo-factor-and-devices","10.security\u002F3.two-factor-and-devices",{"title":48,"path":49,"stem":50,"icon":51},"Audit & Monitoring","\u002Fsecurity\u002Faudit-and-monitoring","10.security\u002F4.audit-and-monitoring","i-lucide-scroll-text",{"title":53,"path":54,"stem":55,"icon":56},"Account Deletion & Privacy","\u002Fsecurity\u002Faccount-deletion-and-privacy","10.security\u002F5.account-deletion-and-privacy","i-lucide-user-x",{"title":58,"path":59,"stem":60,"icon":61},"Roles & Permissions","\u002Fsecurity\u002Froles-and-permissions","10.security\u002F6.roles-and-permissions","i-lucide-key-round",{"title":63,"icon":27,"path":64,"stem":65,"children":66,"page":27},"Billing & Plans","\u002Fbilling","11.billing",[67,72,77,82,87],{"title":68,"path":69,"stem":70,"icon":71},"Plans","\u002Fbilling\u002Fplans","11.billing\u002F1.plans","i-lucide-credit-card",{"title":73,"path":74,"stem":75,"icon":76},"Limits & Usage","\u002Fbilling\u002Flimits-and-usage","11.billing\u002F2.limits-and-usage","i-lucide-gauge",{"title":78,"path":79,"stem":80,"icon":81},"Managing Your Subscription","\u002Fbilling\u002Fmanaging-your-subscription","11.billing\u002F3.managing-your-subscription","i-lucide-receipt",{"title":83,"path":84,"stem":85,"icon":86},"Add-ons","\u002Fbilling\u002Fadd-ons","11.billing\u002F4.add-ons","i-lucide-puzzle",{"title":88,"path":89,"stem":90,"icon":91},"Integrations","\u002Fbilling\u002Fintegrations","11.billing\u002F5.integrations","i-lucide-plug",{"title":93,"icon":27,"path":94,"stem":95,"children":96,"page":27},"Settings","\u002Fsettings","12.settings",[97,101,105,109,113],{"title":98,"path":99,"stem":100},"General","\u002Fsettings\u002Fgeneral","12.settings\u002F1.general",{"title":102,"path":103,"stem":104},"Leave Types","\u002Fsettings\u002Fleavetype","12.settings\u002F2.leaveType",{"title":106,"path":107,"stem":108},"Carry Forward","\u002Fsettings\u002Fcarryforward","12.settings\u002F3.carryForward",{"title":110,"path":111,"stem":112},"Department Management","\u002Fsettings\u002Fdepartments","12.settings\u002F4.departments",{"title":114,"path":115,"stem":116},"Public Holidays","\u002Fsettings\u002Fpublicholiday","12.settings\u002F5.publicholiday",{"title":118,"path":119,"stem":120,"children":121,"page":27},"Mcp","\u002Fmcp","13.mcp",[122,127,131,136,141],{"title":123,"path":124,"stem":125,"icon":126},"Overview","\u002Fmcp\u002Foverview","13.mcp\u002F1.overview","i-lucide-bot",{"title":128,"path":129,"stem":130,"icon":91},"Connecting","\u002Fmcp\u002Fconnecting","13.mcp\u002F2.connecting",{"title":132,"path":133,"stem":134,"icon":135},"Tools Reference","\u002Fmcp\u002Ftools","13.mcp\u002F3.tools","i-lucide-wrench",{"title":137,"path":138,"stem":139,"icon":140},"Security","\u002Fmcp\u002Fsecurity","13.mcp\u002F4.security","i-lucide-shield",{"title":142,"path":143,"stem":144,"icon":145},"Integrating Your Own MCP Client","\u002Fmcp\u002Fcustom-client","13.mcp\u002F5.custom-client","i-lucide-code",{"title":147,"icon":27,"path":148,"stem":149,"children":150,"page":27},"Public API","\u002Fapi","14.api",[151,156,160,164,169,174,179,183,208,238,243,248],{"title":152,"path":153,"stem":154,"icon":155},"API Overview","\u002Fapi\u002Foverview","14.api\u002F1.overview","i-lucide-code-xml",{"title":5,"path":157,"stem":158,"icon":159},"\u002Fapi\u002Fgetting-started","14.api\u002F2.getting-started","i-lucide-rocket",{"title":161,"path":162,"stem":163,"icon":61},"Authentication & Tokens","\u002Fapi\u002Fauthentication","14.api\u002F3.authentication",{"title":165,"path":166,"stem":167,"icon":168},"API Roles & Scopes","\u002Fapi\u002Froles-and-scopes","14.api\u002F4.roles-and-scopes","i-lucide-layers",{"title":170,"path":171,"stem":172,"icon":173},"Requests & Responses","\u002Fapi\u002Frequests-and-responses","14.api\u002F5.requests-and-responses","i-lucide-arrow-left-right",{"title":175,"path":176,"stem":177,"icon":178},"Errors","\u002Fapi\u002Ferrors","14.api\u002F6.errors","i-lucide-circle-alert",{"title":180,"path":181,"stem":182,"icon":76},"Rate Limits","\u002Fapi\u002Frate-limits","14.api\u002F7.rate-limits",{"title":184,"icon":185,"path":186,"stem":187,"children":188,"page":27},"Guides","i-lucide-book-marked","\u002Fapi\u002Fguides","14.api\u002F8.guides",[189,194,199,204],{"title":190,"path":191,"stem":192,"icon":193},"People","\u002Fapi\u002Fguides\u002Fpeople","14.api\u002F8.guides\u002F1.people","i-lucide-users",{"title":195,"path":196,"stem":197,"icon":198},"Leave","\u002Fapi\u002Fguides\u002Fleave","14.api\u002F8.guides\u002F2.leave","i-lucide-calendar-days",{"title":200,"path":201,"stem":202,"icon":203},"Time","\u002Fapi\u002Fguides\u002Ftime","14.api\u002F8.guides\u002F3.time","i-lucide-clock",{"title":205,"path":206,"stem":207,"icon":81},"Expenses & Documents","\u002Fapi\u002Fguides\u002Fexpenses-and-documents","14.api\u002F8.guides\u002F4.expenses-and-documents",{"title":209,"icon":210,"path":211,"stem":212,"children":213,"page":27},"Webhooks","i-lucide-webhook","\u002Fapi\u002Fwebhooks","14.api\u002F9.webhooks",[214,218,223,228,233],{"title":215,"path":216,"stem":217,"icon":210},"Webhooks Overview","\u002Fapi\u002Fwebhooks\u002Foverview","14.api\u002F9.webhooks\u002F1.overview",{"title":219,"path":220,"stem":221,"icon":222},"Events Reference","\u002Fapi\u002Fwebhooks\u002Fevents","14.api\u002F9.webhooks\u002F2.events","i-lucide-list",{"title":224,"path":225,"stem":226,"icon":227},"Verifying Signatures","\u002Fapi\u002Fwebhooks\u002Fverifying-signatures","14.api\u002F9.webhooks\u002F3.verifying-signatures","i-lucide-badge-check",{"title":229,"path":230,"stem":231,"icon":232},"Retries & Failures","\u002Fapi\u002Fwebhooks\u002Fretries-and-failures","14.api\u002F9.webhooks\u002F4.retries-and-failures","i-lucide-refresh-cw",{"title":234,"path":235,"stem":236,"icon":237},"Best Practices","\u002Fapi\u002Fwebhooks\u002Fbest-practices","14.api\u002F9.webhooks\u002F5.best-practices","i-lucide-list-checks",{"title":239,"path":240,"stem":241,"icon":242},"Postman & OpenAPI","\u002Fapi\u002Fpostman-and-openapi","14.api\u002F91.postman-and-openapi","i-lucide-file-json",{"title":244,"path":245,"stem":246,"icon":247},"Versioning & Changes","\u002Fapi\u002Fversioning","14.api\u002F92.versioning","i-lucide-git-branch",{"title":249,"path":250,"stem":251,"icon":252},"API Reference","\u002Fapi\u002Freference","14.api\u002F93.reference","i-lucide-book-open",{"title":254,"icon":27,"path":255,"stem":256,"children":257,"page":27},"Data Import & Migration","\u002Fdata-import","2.data-import",[258,262,267,272,277,282,287],{"title":123,"path":259,"stem":260,"icon":261},"\u002Fdata-import\u002Foverview","2.data-import\u002F1.overview","i-lucide-database",{"title":263,"path":264,"stem":265,"icon":266},"Importing a File","\u002Fdata-import\u002Fimporting-a-file","2.data-import\u002F2.importing-a-file","i-lucide-file-up",{"title":268,"path":269,"stem":270,"icon":271},"Supported Platforms","\u002Fdata-import\u002Fsupported-platforms","2.data-import\u002F3.supported-platforms","i-lucide-layout-grid",{"title":273,"path":274,"stem":275,"icon":276},"Direct Connections","\u002Fdata-import\u002Fdirect-connections","2.data-import\u002F4.direct-connections","i-lucide-plug-zap",{"title":278,"path":279,"stem":280,"icon":281},"Custom Templates","\u002Fdata-import\u002Fcustom-templates","2.data-import\u002F5.custom-templates","i-lucide-layout-template",{"title":283,"path":284,"stem":285,"icon":286},"Rollback & Import History","\u002Fdata-import\u002Frollback-and-history","2.data-import\u002F6.rollback-and-history","i-lucide-undo-2",{"title":288,"path":289,"stem":290,"icon":291},"Troubleshooting","\u002Fdata-import\u002Ftroubleshooting","2.data-import\u002F7.troubleshooting","i-lucide-life-buoy",{"title":293,"icon":27,"path":294,"stem":295,"children":296,"page":27},"Leave Management","\u002Fleave-management","3.leave-management",[297,302,307,312,316,321],{"title":298,"path":299,"stem":300,"icon":301},"Leave Management Overview","\u002Fleave-management\u002Foverview","3.leave-management\u002F1.overview","i-lucide-palmtree",{"title":303,"path":304,"stem":305,"icon":306},"Requesting Leave","\u002Fleave-management\u002Frequesting-leave","3.leave-management\u002F2.requesting-leave","i-lucide-calendar-plus",{"title":308,"path":309,"stem":310,"icon":311},"Leave Balances","\u002Fleave-management\u002Fleave-balances","3.leave-management\u002F3.leave-balances","i-lucide-wallet",{"title":313,"path":314,"stem":315,"icon":193},"Group Booking","\u002Fleave-management\u002Fgroup-booking","3.leave-management\u002F4.group-booking",{"title":317,"path":318,"stem":319,"icon":320},"Editing and Cancelling Leave","\u002Fleave-management\u002Fediting-and-cancelling","3.leave-management\u002F5.editing-and-cancelling","i-lucide-pencil",{"title":322,"path":323,"stem":324,"icon":291},"Leave Troubleshooting","\u002Fleave-management\u002Ftroubleshooting","3.leave-management\u002F6.troubleshooting",{"title":326,"icon":27,"path":327,"stem":328,"children":329,"page":27},"Approvals","\u002Fapprovals","4.approvals",[330,335,340,344],{"title":331,"path":332,"stem":333,"icon":334},"Approvals Overview","\u002Fapprovals\u002Foverview","4.approvals\u002F1.overview","i-lucide-check-check",{"title":336,"path":337,"stem":338,"icon":339},"Leave Approvals","\u002Fapprovals\u002Fleave-approvals","4.approvals\u002F2.leave-approvals","i-lucide-calendar-check",{"title":341,"path":342,"stem":343,"icon":81},"Expense Approvals","\u002Fapprovals\u002Fexpense-approvals","4.approvals\u002F3.expense-approvals",{"title":345,"path":346,"stem":347,"icon":348},"Time Approvals","\u002Fapprovals\u002Ftime-approvals","4.approvals\u002F4.time-approvals","i-lucide-clock-9",{"title":350,"icon":27,"path":351,"stem":352,"children":353,"page":27},"Time tracking & monitoring","\u002Ftime-tracking","5.Time Tracking",[354,359,364,369,373,377,381],{"title":355,"path":356,"stem":357,"icon":358},"Clocking In & Location","\u002Ftime-tracking\u002Fclock-in-and-location","5.Time Tracking\u002F5.clock-in-and-location","i-lucide-map-pin",{"title":360,"path":361,"stem":362,"icon":363},"Overtime & Pay-Period Lockdown","\u002Ftime-tracking\u002Fovertime-and-lockdown","5.Time Tracking\u002F6.overtime-and-lockdown","i-lucide-lock",{"title":365,"path":366,"stem":367,"icon":368},"Geofencing","\u002Ftime-tracking\u002Fgeofencing","5.Time Tracking\u002F7.geofencing","i-lucide-map",{"title":370,"path":371,"stem":372},"Time & Projects","\u002Ftime-tracking\u002Ftimeandprojects","5.Time Tracking\u002FTime&Projects",{"title":374,"path":375,"stem":376},"Time Tracking","\u002Ftime-tracking\u002Ftime-tracking","5.Time Tracking\u002FTime-tracking",{"title":378,"path":379,"stem":380},"Timeboard","\u002Ftime-tracking\u002Ftimeboard","5.Time Tracking\u002FTimeBoard",{"title":382,"path":383,"stem":384},"Timesheets","\u002Ftime-tracking\u002Ftimesheets","5.Time Tracking\u002FTimesheets",{"title":386,"icon":27,"path":387,"stem":388,"children":389,"page":27},"Expenses","\u002Fexpenses","6.expenses",[390,394,398,402,406,411,416],{"title":391,"path":392,"stem":393},"Expense Claims","\u002Fexpenses\u002Foverview","6.expenses\u002F1.overview",{"title":395,"path":396,"stem":397},"Add & Manage Purchases","\u002Fexpenses\u002Fpurchases","6.expenses\u002F2.purchases",{"title":399,"path":400,"stem":401},"Travel & Mileage Entry","\u002Fexpenses\u002Ftravelentries","6.expenses\u002F3.travelentries",{"title":403,"path":404,"stem":405,"icon":71},"Company Card Expenses","\u002Fexpenses\u002Fcompany-cards","6.expenses\u002F4.company-cards",{"title":407,"path":408,"stem":409,"icon":410},"Per Diems","\u002Fexpenses\u002Fper-diems","6.expenses\u002F5.per-diems","i-lucide-utensils",{"title":412,"path":413,"stem":414,"icon":415},"Receipt Scanning","\u002Fexpenses\u002Freceipt-scanning","6.expenses\u002F6.receipt-scanning","i-lucide-scan-line",{"title":417,"path":418,"stem":419,"icon":420},"Statuses & Submission","\u002Fexpenses\u002Fstatuses-and-submission","6.expenses\u002F7.statuses-and-submission","i-lucide-git-pull-request-arrow",{"title":422,"icon":27,"path":423,"stem":424,"children":425,"page":27},"Documents & E-Signatures","\u002Fdocuments","7.documents",[426,430,435,440,445,449,454],{"title":123,"path":427,"stem":428,"icon":429},"\u002Fdocuments\u002Foverview","7.documents\u002F1.overview","i-lucide-folder-open",{"title":431,"path":432,"stem":433,"icon":434},"Uploading Documents","\u002Fdocuments\u002Fuploading","7.documents\u002F2.uploading","i-lucide-upload",{"title":436,"path":437,"stem":438,"icon":439},"E-Signatures","\u002Fdocuments\u002Fe-signatures","7.documents\u002F3.e-signatures","i-lucide-pen-tool",{"title":441,"path":442,"stem":443,"icon":444},"Audit Trail & Certificate","\u002Fdocuments\u002Faudit-trail","7.documents\u002F4.audit-trail","i-lucide-file-check",{"title":446,"path":447,"stem":448,"icon":281},"Templates & Bulk Send","\u002Fdocuments\u002Ftemplates-and-bulk-send","7.documents\u002F5.templates-and-bulk-send",{"title":450,"path":451,"stem":452,"icon":453},"Onboarding","\u002Fdocuments\u002Fonboarding","7.documents\u002F6.onboarding","i-lucide-user-plus",{"title":455,"path":456,"stem":457,"icon":458},"Offboarding","\u002Fdocuments\u002Foffboarding","7.documents\u002F7.offboarding","i-lucide-user-minus",{"title":460,"icon":27,"path":461,"stem":462,"children":463,"page":27},"People & HR","\u002Fpeople","8.people",[464,468,473,478,483],{"title":465,"path":466,"stem":467,"icon":193},"Directory & Profiles","\u002Fpeople\u002Fdirectory-and-profiles","8.people\u002F1.directory-and-profiles",{"title":469,"path":470,"stem":471,"icon":472},"Managing Users","\u002Fpeople\u002Fmanaging-users","8.people\u002F2.managing-users","i-lucide-user-cog",{"title":474,"path":475,"stem":476,"icon":477},"HR Records","\u002Fpeople\u002Fhr-records","8.people\u002F3.hr-records","i-lucide-folder-archive",{"title":479,"path":480,"stem":481,"icon":482},"Performance","\u002Fpeople\u002Fperformance","8.people\u002F4.performance","i-lucide-target",{"title":484,"path":485,"stem":486,"icon":487},"Training","\u002Fpeople\u002Ftraining","8.people\u002F5.training","i-lucide-graduation-cap",{"title":489,"icon":27,"path":490,"stem":491,"children":492,"page":27},"Features","\u002Ffeatures","9.features",[493,497,501,505,510,515,519,523,527,531,535,539,543],{"title":494,"path":495,"stem":496,"icon":11},"Home","\u002Ffeatures\u002Fhome","9.features\u002F1.home",{"title":498,"path":499,"stem":500},"Email Configuration (SMTP)","\u002Ffeatures\u002Femail-configuration","9.features\u002F10.email-configuration",{"title":502,"path":503,"stem":504},"SMTP troubleshoot","\u002Ffeatures\u002Fsmtp-troubleshoot","9.features\u002F11.smtp-troubleshoot",{"title":506,"path":507,"stem":508,"icon":509},"Notifications","\u002Ffeatures\u002Fnotifications","9.features\u002F12.notifications","i-lucide-bell",{"title":511,"path":512,"stem":513,"icon":514},"Reports","\u002Ffeatures\u002Freports","9.features\u002F13.reports","i-lucide-bar-chart-3",{"title":516,"path":517,"stem":518},"Dashboard","\u002Ffeatures\u002Fdashboard","9.features\u002F2.dashboard",{"title":520,"path":521,"stem":522},"Calendar & Leave Overview","\u002Ffeatures\u002Fcalendar","9.features\u002F3.calendar",{"title":524,"path":525,"stem":526},"Calendar Integration","\u002Ffeatures\u002Fcalendar-integration","9.features\u002F4.calendar-integration",{"title":528,"path":529,"stem":530},"Schedules","\u002Ffeatures\u002Fschedules","9.features\u002F5.schedules",{"title":532,"path":533,"stem":534},"Project Management","\u002Ffeatures\u002Fprojects","9.features\u002F6.projects",{"title":536,"path":537,"stem":538},"Expense Settings","\u002Ffeatures\u002Fexpense-settings","9.features\u002F7.expense-settings",{"title":540,"path":541,"stem":542},"Auth0 SSO Integration","\u002Ffeatures\u002Fauth0-integration","9.features\u002F8.auth0-integration",{"title":544,"path":545,"stem":546},"Password & Authentication Policy","\u002Ffeatures\u002Fpolicies","9.features\u002F9.policies",{"id":548,"title":215,"body":549,"description":1632,"extension":1633,"links":1634,"meta":1635,"navigation":1636,"path":216,"seo":1637,"stem":217,"__hash__":1638},"docs\u002F14.api\u002F9.webhooks\u002F1.overview.md",{"type":550,"value":551,"toc":1614},"minimark",[552,556,564,569,591,595,602,605,627,632,635,686,689,693,707,775,795,803,807,866,874,878,896,900,907,1181,1274,1280,1284,1287,1291,1311,1317,1321,1344,1348,1363,1366,1369,1372,1410,1439,1540,1560,1567,1588,1592,1610],[553,554,555],"p",{},"Webhooks send an HTTPS request to your server when something happens in BookYourPTO, such as a leave request being approved, so your integration does not have to poll the API for changes.",[553,557,558,559,563],{},"Webhooks follow the same rules as the REST API. An endpoint only receives events about records its ",[560,561,562],"strong",{},"owner"," could read through the API, and a payload never contains more than the matching API endpoint returns.",[565,566,568],"h2",{"id":567},"requirements","Requirements",[570,571,572,580],"ul",{},[573,574,575,576,579],"li",{},"The same conditions as the API: a paid plan (Pro, Business or Enterprise), the API switched on, and a subscription in good standing. They are checked again ",[560,577,578],{},"before every delivery attempt",", not only when the endpoint is created. If the API is switched off, the plan no longer includes it or the subscription lapses, nothing more is sent: queued deliveries are cancelled, not sent later.",[573,581,582,583,586,587,590],{},"Only ",[560,584,585],{},"Administrators"," and ",[560,588,589],{},"Executives"," can create, own and manage webhook endpoints. This is fixed: allowing other roles to create API tokens does not let them manage webhooks.",[565,592,594],{"id":593},"endpoint-owner","Endpoint owner",[553,596,597,598,601],{},"Every endpoint is owned by one person. By default that is the person who creates it. They can instead choose someone whose role is ",[560,599,600],{},"below"," their own: an Executive can create an endpoint owned by an Administrator, but an Administrator cannot create one owned by another Administrator or by an Executive.",[553,603,604],{},"Payloads are built with the owner's visibility, exactly as a token owned by that person would read them:",[570,606,607,614,617,620],{},[573,608,609,610,613],{},"An event about a record the owner cannot see is ",[560,611,612],{},"not delivered"," to that endpoint. Nothing is sent: no empty payload, no id.",[573,615,616],{},"A private leave is redacted the same way it is for the owner in the API.",[573,618,619],{},"The owner must still be eligible when each delivery is attempted. If the owner is deactivated, offboarded or no longer an Administrator or Executive, queued deliveries are cancelled instead of sent.",[573,621,622,623,626],{},"When the owner is offboarded, or their personal data is deleted, every endpoint they own is ",[560,624,625],{},"turned off"," at the same moment. Reactivating the person later does not turn it back on: an Administrator or Executive gives the endpoint a new owner and resumes it.",[628,629,631],"h3",{"id":630},"who-can-change-an-endpoint","Who can change an endpoint",[553,633,634],{},"Because an endpoint reads with its owner's visibility, changing where it sends or what it receives is held to the same rule as choosing its owner:",[636,637,638,651],"table",{},[639,640,641],"thead",{},[642,643,644,648],"tr",{},[645,646,647],"th",{},"Action",[645,649,650],{},"Who may do it",[652,653,654,663,670,678],"tbody",{},[642,655,656,660],{},[657,658,659],"td",{},"See the endpoint and its delivery log",[657,661,662],{},"Any Administrator or Executive",[642,664,665,668],{},[657,666,667],{},"Pause or delete it",[657,669,662],{},[642,671,672,675],{},[657,673,674],{},"Resume it, send a test event, redeliver",[657,676,677],{},"The owner, or anyone whose role is the same as or above the owner's",[642,679,680,683],{},[657,681,682],{},"Change its URL, events or owner, or rotate its signing secret",[657,684,685],{},"The owner, or anyone whose role is above the owner's",[553,687,688],{},"The full receiver URL is shown only to people who may change the endpoint; everyone else sees the host name, because a receiver URL often works as a credential.",[565,690,692],{"id":691},"creating-an-endpoint","Creating an endpoint",[553,694,695,696,698,699,702,703,706],{},"Endpoints are managed on the ",[560,697,209],{}," tab under ",[560,700,701],{},"Settings > API",". Choose ",[560,704,705],{},"Add endpoint",", then fill in:",[636,708,709,719],{},[639,710,711],{},[642,712,713,716],{},[645,714,715],{},"Setting",[645,717,718],{},"Rules",[652,720,721,736,755,765],{},[642,722,723,728],{},[657,724,725],{},[560,726,727],{},"Endpoint URL",[657,729,730,731,735],{},"Must start with ",[732,733,734],"code",{},"https:\u002F\u002F",", use port 443 or 8443, contain no user name or password, and name a public host rather than an IP address. At most 2048 characters. Every address the host name resolves to must be public; this is checked when you save and again before every delivery attempt.",[642,737,738,743],{},[657,739,740],{},[560,741,742],{},"Events",[657,744,745,746,750,751,754],{},"One or more event types from the ",[747,748,749],"a",{"href":220},"events reference",", or ",[560,752,753],{},"Every event",", which subscribes to every event the owner's role may receive, including event types added later.",[642,756,757,762],{},[657,758,759],{},[560,760,761],{},"Description",[657,763,764],{},"Optional, up to 200 characters.",[642,766,767,772],{},[657,768,769],{},[560,770,771],{},"Owner",[657,773,774],{},"You, or someone whose role is below yours (see above).",[553,776,777,778,781,782,785,786,789,790,794],{},"When you save, the ",[560,779,780],{},"signing secret"," is shown ",[560,783,784],{},"once",". It starts with ",[732,787,788],{},"whsec_",". Copy it into your receiver's secret store; it cannot be displayed again. If it is lost, ",[747,791,793],{"href":792},"\u002Fapi\u002Fwebhooks\u002Fverifying-signatures#rotating-the-signing-secret","rotate it",".",[553,796,797,798,802],{},"You can also manage endpoints through the API itself, which is how integration platforms subscribe with \"REST hooks\". See ",[747,799,801],{"href":800},"#managing-endpoints-through-the-api","Managing endpoints through the API"," below.",[628,804,806],{"id":805},"status","Status",[636,808,809,821],{},[639,810,811],{},[642,812,813,815,818],{},[645,814,806],{},[645,816,817],{},"Shown as",[645,819,820],{},"Meaning",[652,822,823,836,849],{},[642,824,825,830,833],{},[657,826,827],{},[732,828,829],{},"active",[657,831,832],{},"Active",[657,834,835],{},"Receives events.",[642,837,838,843,846],{},[657,839,840],{},[732,841,842],{},"paused",[657,844,845],{},"Paused",[657,847,848],{},"Paused by an Administrator or Executive. Pausing cancels every queued delivery.",[642,850,851,856,859],{},[657,852,853],{},[732,854,855],{},"disabled",[657,857,858],{},"Turned off",[657,860,861,862,865],{},"Turned off automatically, either after a long run of failed deliveries (see ",[747,863,229],{"href":864},"\u002Fapi\u002Fwebhooks\u002Fretries-and-failures#automatic-disabling",") or because its owner was offboarded.",[553,867,868,869,873],{},"Resuming an endpoint replays nothing. Events raised while it was paused or turned off are not queued for it; failed deliveries can be ",[747,870,872],{"href":871},"\u002Fapi\u002Fwebhooks\u002Fretries-and-failures#redelivering-events","redelivered"," from the delivery log.",[628,875,877],{"id":876},"limits","Limits",[570,879,880,887],{},[573,881,882,883,886],{},"Up to ",[560,884,885],{},"10"," webhook endpoints per organization.",[573,888,882,889,892,893,895],{},[560,890,891],{},"50"," event types per endpoint. ",[560,894,753],{}," is a single entry and cannot be combined with individual events.",[565,897,899],{"id":898},"the-payload","The payload",[553,901,902,903,906],{},"Every delivery is a ",[732,904,905],{},"POST"," with a JSON body:",[908,909,914],"pre",{"className":910,"code":911,"language":912,"meta":913,"style":913},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"id\": \"evt_01JABCDEFGHJKMNPQRSTVWXYZ\",\n  \"type\": \"leave.approved\",\n  \"api_version\": \"v1\",\n  \"created_at\": \"2026-10-12T17:04:11.512Z\",\n  \"organization_id\": \"cmorg0000000000000000000\",\n  \"data\": {\n    \"object\": {\n      \"id\": \"cmlve0hmarsh2026080300\",\n      \"status\": \"APPROVED\",\n      \"...\": \"the other fields GET \u002Fleaves\u002F{id} returns\"\n    }\n  },\n  \"previous\": { \"status\": \"PENDING\" }\n}\n","json","",[732,915,916,925,953,974,995,1016,1037,1052,1068,1090,1110,1130,1136,1142,1175],{"__ignoreMap":913},[917,918,921],"span",{"class":919,"line":920},"line",1,[917,922,924],{"class":923},"sMK4o","{\n",[917,926,928,931,935,938,941,944,948,950],{"class":919,"line":927},2,[917,929,930],{"class":923},"  \"",[917,932,934],{"class":933},"spNyl","id",[917,936,937],{"class":923},"\"",[917,939,940],{"class":923},":",[917,942,943],{"class":923}," \"",[917,945,947],{"class":946},"sfazB","evt_01JABCDEFGHJKMNPQRSTVWXYZ",[917,949,937],{"class":923},[917,951,952],{"class":923},",\n",[917,954,956,958,961,963,965,967,970,972],{"class":919,"line":955},3,[917,957,930],{"class":923},[917,959,960],{"class":933},"type",[917,962,937],{"class":923},[917,964,940],{"class":923},[917,966,943],{"class":923},[917,968,969],{"class":946},"leave.approved",[917,971,937],{"class":923},[917,973,952],{"class":923},[917,975,977,979,982,984,986,988,991,993],{"class":919,"line":976},4,[917,978,930],{"class":923},[917,980,981],{"class":933},"api_version",[917,983,937],{"class":923},[917,985,940],{"class":923},[917,987,943],{"class":923},[917,989,990],{"class":946},"v1",[917,992,937],{"class":923},[917,994,952],{"class":923},[917,996,998,1000,1003,1005,1007,1009,1012,1014],{"class":919,"line":997},5,[917,999,930],{"class":923},[917,1001,1002],{"class":933},"created_at",[917,1004,937],{"class":923},[917,1006,940],{"class":923},[917,1008,943],{"class":923},[917,1010,1011],{"class":946},"2026-10-12T17:04:11.512Z",[917,1013,937],{"class":923},[917,1015,952],{"class":923},[917,1017,1019,1021,1024,1026,1028,1030,1033,1035],{"class":919,"line":1018},6,[917,1020,930],{"class":923},[917,1022,1023],{"class":933},"organization_id",[917,1025,937],{"class":923},[917,1027,940],{"class":923},[917,1029,943],{"class":923},[917,1031,1032],{"class":946},"cmorg0000000000000000000",[917,1034,937],{"class":923},[917,1036,952],{"class":923},[917,1038,1040,1042,1045,1047,1049],{"class":919,"line":1039},7,[917,1041,930],{"class":923},[917,1043,1044],{"class":933},"data",[917,1046,937],{"class":923},[917,1048,940],{"class":923},[917,1050,1051],{"class":923}," {\n",[917,1053,1055,1058,1062,1064,1066],{"class":919,"line":1054},8,[917,1056,1057],{"class":923},"    \"",[917,1059,1061],{"class":1060},"sBMFI","object",[917,1063,937],{"class":923},[917,1065,940],{"class":923},[917,1067,1051],{"class":923},[917,1069,1071,1074,1077,1079,1081,1083,1086,1088],{"class":919,"line":1070},9,[917,1072,1073],{"class":923},"      \"",[917,1075,934],{"class":1076},"sbssI",[917,1078,937],{"class":923},[917,1080,940],{"class":923},[917,1082,943],{"class":923},[917,1084,1085],{"class":946},"cmlve0hmarsh2026080300",[917,1087,937],{"class":923},[917,1089,952],{"class":923},[917,1091,1093,1095,1097,1099,1101,1103,1106,1108],{"class":919,"line":1092},10,[917,1094,1073],{"class":923},[917,1096,805],{"class":1076},[917,1098,937],{"class":923},[917,1100,940],{"class":923},[917,1102,943],{"class":923},[917,1104,1105],{"class":946},"APPROVED",[917,1107,937],{"class":923},[917,1109,952],{"class":923},[917,1111,1113,1115,1118,1120,1122,1124,1127],{"class":919,"line":1112},11,[917,1114,1073],{"class":923},[917,1116,1117],{"class":1076},"...",[917,1119,937],{"class":923},[917,1121,940],{"class":923},[917,1123,943],{"class":923},[917,1125,1126],{"class":946},"the other fields GET \u002Fleaves\u002F{id} returns",[917,1128,1129],{"class":923},"\"\n",[917,1131,1133],{"class":919,"line":1132},12,[917,1134,1135],{"class":923},"    }\n",[917,1137,1139],{"class":919,"line":1138},13,[917,1140,1141],{"class":923},"  },\n",[917,1143,1145,1147,1150,1152,1154,1157,1159,1161,1163,1165,1167,1170,1172],{"class":919,"line":1144},14,[917,1146,930],{"class":923},[917,1148,1149],{"class":933},"previous",[917,1151,937],{"class":923},[917,1153,940],{"class":923},[917,1155,1156],{"class":923}," {",[917,1158,943],{"class":923},[917,1160,805],{"class":1060},[917,1162,937],{"class":923},[917,1164,940],{"class":923},[917,1166,943],{"class":923},[917,1168,1169],{"class":946},"PENDING",[917,1171,937],{"class":923},[917,1173,1174],{"class":923}," }\n",[917,1176,1178],{"class":919,"line":1177},15,[917,1179,1180],{"class":923},"}\n",[636,1182,1183,1192],{},[639,1184,1185],{},[642,1186,1187,1190],{},[645,1188,1189],{},"Field",[645,1191,820],{},[652,1193,1194,1211,1222,1233,1242,1251,1261],{},[642,1195,1196,1200],{},[657,1197,1198],{},[732,1199,934],{},[657,1201,1202,1203,1206,1207,1210],{},"The event id: ",[732,1204,1205],{},"evt_"," followed by 26 characters. Unique per event and the same on every retry and redelivery. Use it to discard duplicates. It is also sent in the ",[732,1208,1209],{},"webhook-id"," header.",[642,1212,1213,1217],{},[657,1214,1215],{},[732,1216,960],{},[657,1218,1219,1220,794],{},"The event type, for example ",[732,1221,969],{},[642,1223,1224,1228],{},[657,1225,1226],{},[732,1227,981],{},[657,1229,1230,1231,794],{},"The API version the payload follows, currently ",[732,1232,990],{},[642,1234,1235,1239],{},[657,1236,1237],{},[732,1238,1002],{},[657,1240,1241],{},"When the event happened, as an ISO 8601 UTC instant.",[642,1243,1244,1248],{},[657,1245,1246],{},[732,1247,1023],{},[657,1249,1250],{},"The organization the event belongs to.",[642,1252,1253,1258],{},[657,1254,1255],{},[732,1256,1257],{},"data.object",[657,1259,1260],{},"The record, in the same shape the API returns it, as the endpoint's owner sees it.",[642,1262,1263,1267],{},[657,1264,1265],{},[732,1266,1149],{},[657,1268,1269,1270,1273],{},"On update and status-change events: the old values of the fields that changed, for example ",[732,1271,1272],{},"{ \"status\": \"PENDING\" }",". Left out when there is nothing to report.",[553,1275,1276,1277,1279],{},"The ",[747,1278,749],{"href":220}," has a complete example payload for every event type.",[628,1281,1283],{"id":1282},"what-a-payload-never-contains","What a payload never contains",[553,1285,1286],{},"Payloads carry only the standard fields of a record, whatever scopes the owner holds. Personal details (date of birth, home address, emergency contact), government identifiers, compensation, timesheet pay figures, clock-in and clock-out locations and document files are never sent by webhook, and neither are secrets, tokens or storage paths. Fetch those through the API if your integration needs them and its token is allowed to read them.",[628,1288,1290],{"id":1289},"large-records-and-deletions","Large records and deletions",[553,1292,1293,1294,1297,1298,1300,1301,1303,1304,1306,1307,1310],{},"A payload is limited to ",[560,1295,1296],{},"64 KB",". A record that would exceed it is sent as a thin event: ",[732,1299,1257],{}," contains only its ",[732,1302,934],{}," and an ",[732,1305,1061],{}," field naming the kind of record, for example ",[732,1308,1309],{},"{ \"id\": \"cmexp...\", \"object\": \"expense_report\" }",". Fetch the full record through the API.",[553,1312,1313,1316],{},[732,1314,1315],{},"department.deleted"," is always a thin event, because the department no longer exists.",[565,1318,1320],{"id":1319},"delivery-guarantees","Delivery guarantees",[570,1322,1323,1332,1341],{},[573,1324,1325,1326,1329,1330,794],{},"Delivery is ",[560,1327,1328],{},"at least once",": the same event can arrive more than once. De-duplicate on ",[732,1331,934],{},[573,1333,1325,1334,1337,1338,1340],{},[560,1335,1336],{},"not ordered",": a later event can arrive before an earlier one. Use ",[732,1339,1002],{},", or fetch the current record from the API, when order matters.",[573,1342,1343],{},"The first attempt is normally made within about a second of the change being saved. Anything that attempt does not send is picked up by a job that runs every minute.",[565,1345,1347],{"id":1346},"testing-an-endpoint","Testing an endpoint",[553,1349,1350,1351,1354,1355,1358,1359,1362],{},"Choose ",[560,1352,1353],{},"Send test event"," in the endpoint's menu to send a ",[732,1356,1357],{},"webhook.test"," event right away. The endpoint must be active. Open the endpoint's ",[560,1360,1361],{},"Delivery log"," to see the status code your server returned and how long it took.",[553,1364,1365],{},"A test event is signed exactly like every other event, so it is the quickest way to check your signature verification.",[565,1367,801],{"id":1368},"managing-endpoints-through-the-api",[553,1370,1371],{},"Tokens owned by an Administrator or Executive can manage webhook endpoints with two scopes:",[636,1373,1374,1384],{},[639,1375,1376],{},[642,1377,1378,1381],{},[645,1379,1380],{},"Scope",[645,1382,1383],{},"Allows",[652,1385,1386,1400],{},[642,1387,1388,1393],{},[657,1389,1390],{},[732,1391,1392],{},"webhooks:read",[657,1394,1395,1396,1399],{},"List endpoints, read one, read its delivery log, and list the event types (",[732,1397,1398],{},"GET \u002Fwebhook-events",")",[642,1401,1402,1407],{},[657,1403,1404],{},[732,1405,1406],{},"webhooks:write",[657,1408,1409],{},"Create, update, pause, resume and delete endpoints, send a test event and redeliver",[553,1411,1412,1414,1415,1418,1419,1421,1422,1425,1426,1429,1430,1432,1433,1436,1437,794],{},[732,1413,1406],{}," does not let a token read anything it could not read already. Subscribing an endpoint to an event, or changing an endpoint's URL, also needs the token to hold the ",[560,1416,1417],{},"read scope"," of every event the endpoint will receive (for ",[560,1420,753],{},", ",[732,1423,1424],{},"[\"*\"]",", all of them); otherwise the answer is ",[732,1427,1428],{},"403 SCOPE_MISSING",". The read scope for each event is listed in the ",[747,1431,749],{"href":220}," and returned as ",[732,1434,1435],{},"required_scope"," by ",[732,1438,1398],{},[908,1440,1444],{"className":1441,"code":1442,"language":1443,"meta":913,"style":913},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","curl -X POST https:\u002F\u002Fapp.bookyourpto.com\u002Fapi\u002Fv1\u002Fwebhooks \\\n  -H \"Authorization: Bearer $BOOKYOURPTO_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"Idempotency-Key: 0f8e2a41-6c3d-4b7e-9a15-2d4c6e8f1b30\" \\\n  -d '{\n    \"url\": \"https:\u002F\u002Fhooks.example.com\u002Fhr\u002Fevents\",\n    \"events\": [\"leave.approved\", \"leave.cancelled\"],\n    \"description\": \"Payroll system: leave changes\"\n  }'\n","bash",[732,1445,1446,1464,1481,1494,1507,1517,1522,1527,1532],{"__ignoreMap":913},[917,1447,1448,1451,1454,1457,1460],{"class":919,"line":920},[917,1449,1450],{"class":1060},"curl",[917,1452,1453],{"class":946}," -X",[917,1455,1456],{"class":946}," POST",[917,1458,1459],{"class":946}," https:\u002F\u002Fapp.bookyourpto.com\u002Fapi\u002Fv1\u002Fwebhooks",[917,1461,1463],{"class":1462},"sTEyZ"," \\\n",[917,1465,1466,1469,1471,1474,1477,1479],{"class":919,"line":927},[917,1467,1468],{"class":946},"  -H",[917,1470,943],{"class":923},[917,1472,1473],{"class":946},"Authorization: Bearer ",[917,1475,1476],{"class":1462},"$BOOKYOURPTO_TOKEN",[917,1478,937],{"class":923},[917,1480,1463],{"class":1462},[917,1482,1483,1485,1487,1490,1492],{"class":919,"line":955},[917,1484,1468],{"class":946},[917,1486,943],{"class":923},[917,1488,1489],{"class":946},"Content-Type: application\u002Fjson",[917,1491,937],{"class":923},[917,1493,1463],{"class":1462},[917,1495,1496,1498,1500,1503,1505],{"class":919,"line":976},[917,1497,1468],{"class":946},[917,1499,943],{"class":923},[917,1501,1502],{"class":946},"Idempotency-Key: 0f8e2a41-6c3d-4b7e-9a15-2d4c6e8f1b30",[917,1504,937],{"class":923},[917,1506,1463],{"class":1462},[917,1508,1509,1512,1515],{"class":919,"line":997},[917,1510,1511],{"class":946},"  -d",[917,1513,1514],{"class":923}," '",[917,1516,924],{"class":946},[917,1518,1519],{"class":919,"line":1018},[917,1520,1521],{"class":946},"    \"url\": \"https:\u002F\u002Fhooks.example.com\u002Fhr\u002Fevents\",\n",[917,1523,1524],{"class":919,"line":1039},[917,1525,1526],{"class":946},"    \"events\": [\"leave.approved\", \"leave.cancelled\"],\n",[917,1528,1529],{"class":919,"line":1054},[917,1530,1531],{"class":946},"    \"description\": \"Payroll system: leave changes\"\n",[917,1533,1534,1537],{"class":919,"line":1070},[917,1535,1536],{"class":946},"  }",[917,1538,1539],{"class":923},"'\n",[553,1541,1276,1542,1545,1546,1549,1550,1553,1554,1557,1558,794],{},[732,1543,1544],{},"201"," response includes ",[732,1547,1548],{},"signing_secret",", once. Through the API an endpoint's ",[732,1551,1552],{},"url"," is always returned masked to its host, for example ",[732,1555,1556],{},"https:\u002F\u002Fhooks.example.com\u002F…",". Rotating the signing secret and redelivering every failed delivery at once are done in ",[560,1559,701],{},[553,1561,1562,1563,794],{},"Every operation is listed under ",[747,1564,1566],{"href":1565},"\u002Fapi\u002Freference#tag\u002Fwebhooks","Webhooks in the API Reference",[1568,1569,1572],"callout",{"color":1570,"icon":1571},"blue","i-lucide-info",[553,1573,1574,1575,1577,1578,586,1581,1584,1585,1587],{},"If your organization had a document-signing webhook set up before webhook endpoints were available, it has been copied into a ",[560,1576,842],{}," endpoint subscribed to ",[732,1579,1580],{},"document.signed",[732,1582,1583],{},"document.declined",", with the same receiver URL. Deliveries now use the signature scheme described in ",[747,1586,224],{"href":225},". Update the receiver, then resume the endpoint.",[565,1589,1591],{"id":1590},"next-steps","Next steps",[570,1593,1594,1598,1602,1606],{},[573,1595,1596],{},[747,1597,219],{"href":220},[573,1599,1600],{},[747,1601,224],{"href":225},[573,1603,1604],{},[747,1605,229],{"href":230},[573,1607,1608],{},[747,1609,234],{"href":235},[1611,1612,1613],"style",{},"html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}",{"title":913,"searchDepth":920,"depth":927,"links":1615},[1616,1617,1620,1624,1628,1629,1630,1631],{"id":567,"depth":927,"text":568},{"id":593,"depth":927,"text":594,"children":1618},[1619],{"id":630,"depth":955,"text":631},{"id":691,"depth":927,"text":692,"children":1621},[1622,1623],{"id":805,"depth":955,"text":806},{"id":876,"depth":955,"text":877},{"id":898,"depth":927,"text":899,"children":1625},[1626,1627],{"id":1282,"depth":955,"text":1283},{"id":1289,"depth":955,"text":1290},{"id":1319,"depth":927,"text":1320},{"id":1346,"depth":927,"text":1347},{"id":1368,"depth":927,"text":801},{"id":1590,"depth":927,"text":1591},"How BookYourPTO webhooks push events to your HTTPS endpoint, who can create and own endpoints, what a payload contains and the limits that apply.","md",null,{},{"icon":210},{"title":215,"description":1632},"V5iMUhrX2aUQ2iCdJ9fdSjKv4wdgKwsZBqE2z7yj30w",[1640,1642],{"title":205,"path":206,"stem":207,"description":1641,"icon":81,"children":-1},"Export expense reports to accounting, approve or reject them, and read document metadata, signers and files through the API, with the visibility rules that apply.",{"title":219,"path":220,"stem":221,"description":1643,"icon":222,"children":-1},"Every webhook event type, when it fires, the read scope its endpoint's owner needs, and a complete example payload for each.",1791906546544]