Webhooks
What account42 sends to connectors
Nothing, today. account42 does not post events to WordPress, Wix, Shopify or any other integration. A connector learns what it needs by asking: GET /api/v1/merchant with its key says whether the key is still valid, and the widget reads the studio's classes on every page load. When outbound webhooks exist they will be documented here, with a signing scheme, before any connector is asked to receive one.
What account42 receives
Every inbound webhook is verified before anything is read, and answered from its own route under /api/webhooks/. None of them accepts an api key, and an api key sent to any of them is refused.
Stripe — POST /api/webhooks/stripe
Signed with the endpoint's signing secret (Stripe-Signature). Events on a studio's connected account arrive as Connect events.
| Event | What it does |
|---|---|
checkout.session.completed | Marks the payment paid and confirms the booking, credit pack, membership or class bundle it was for. This is the only thing that confirms a paid booking. |
refund.created, refund.updated, charge.refunded | Records the refund against the payment (paid → refunded, partial or full). |
customer.subscription.updated, customer.subscription.deleted | Keeps a membership's status in step with the subscription. |
account.updated | Updates the studio's onboarding state (charges and payouts enabled, outstanding requirements). |
account.application.deauthorized | The studio disconnected account42 from Stripe: the provider is marked disconnected. |
PayPal — POST /api/webhooks/paypal
Verified through PayPal's webhook signature verification.
| Event | What it does |
|---|---|
CHECKOUT.ORDER.APPROVED | Captures the approved order. |
PAYMENT.CAPTURE.COMPLETED | Marks the payment paid and confirms what it was for. |
PAYMENT.CAPTURE.DENIED | Marks the payment failed; the seat hold expires on its own. |
PAYMENT.CAPTURE.REFUNDED | Records the refund. |
MERCHANT.PARTNER-CONSENT.REVOKED | The studio disconnected account42 from PayPal. |
Shopify — POST /api/webhooks/shopify/…
Verified with X-Shopify-Hmac-SHA256 over the raw body and the app's client secret; a bad signature is 401. Subscribed in the app's configuration (shopify.app.toml), API version 2026-04.
| Topic | Route | What it does |
|---|---|---|
app/uninstalled | /api/webhooks/shopify/app-uninstalled | Revokes the shop's embedded key and marks the shop uninstalled. |
customers/data_request | /api/webhooks/shopify/customers-data-request | Acknowledged. account42 holds no Shopify customer data: bookings are made with account42 directly, never through the shop's customer records. |
customers/redact | /api/webhooks/shopify/customers-redact | Acknowledged, for the same reason. |
shop/redact | /api/webhooks/shopify/shop-redact | Sent 48 hours after uninstall: the shop's connector record is erased. |
orders/paid | /api/webhooks/shopify/orders-paid | A store order was paid. When a line carries an account42 booking (the _booking_id property the widget set) and its paid amount equals the booking's, the payment is marked paid and the booking confirmed. The order is stored without its customer fields. |
refunds/create | /api/webhooks/shopify/refunds-create | A refund was created on such an order (in the Shopify admin, or by account42 itself): its successful transactions are recorded against the payment, idempotent on the refund's id. |
Wix — POST /api/webhooks/wix
The body is a JWT signed by Wix (RS256) and verified with the app's public key; a body that does not verify is 400 and nothing is written.
| Event | What it does |
|---|---|
| App Instance Installed | Creates the site's connector record (or clears a previous uninstall). |
| App Removed | Revokes the site's embedded key and marks the instance uninstalled. |
| Payment Status Updated (eCommerce orders) | An order's payment status changed. When it is PAID, the order's checkoutId is a cart account42 created and the line's price times quantity equals the booking's, the payment is marked paid and the booking confirmed. |
| Order Transactions Refund Completed | A refund on such an order completed (in the Wix dashboard, or by account42 itself): its SUCCEEDED transactions are recorded against the payment, idempotent on the refund's id. |
Twilio — POST /api/webhooks/twilio/status, …/inbound
Validated against X-Twilio-Signature. Delivery status is mirrored onto the outbox; an inbound STOP or START records the customer's opt-out or opt-in. These are account42's own messaging plumbing, listed here for completeness.