Bookings via webhook

In /admin/tools, Bookings tab, create a webhook resource with an HTTPS URL and a shared secret. Guidia sends signed JSON POST requests; redirects are rejected.

Signature

Verify the X-Guidia-Signature: sha256=<hex> header (HMAC-SHA256 of the raw body with your secret) using a constant-time comparison. Also check tenant_id, app_id and resource_id. The Idempotency-Key header equals request_id.

booking.availability

{
  "event": "booking.availability",
  "start_time": "2026-10-10T08:00:00+00:00",
  "end_time": "2026-10-10T18:00:00+00:00",
  "party_size": 2,
  "timezone": "Asia/Dubai"
}

Response: {"slots": [{"slot_id": "...", "status": "available", "start_time": "...", "end_time": "...", "visit_modes": ["physical", "video"]}]}. An empty list means no slots.

booking.confirm

Sent when the visitor confirms themselves. request_id is the Guidia booking ID: return the same receipt for a key that has already been processed. Response: {"status": "confirmed", "reference": "..."} or {"status": "unavailable"}.

booking.cancel

{
  "event": "booking.cancel",
  "request_id": "<booking id>:cancel",
  "booking": { "start_time": "...", "name": "...", "email": "..." },
  "reference": "your-reference"
}

Sent when the visitor confirms the cancellation (two clicks in the widget or two WhatsApp buttons). Cancel the booking and respond {"status": "cancelled"}, even if it is already cancelled. Any other response is a refusal: the booking stays confirmed. After a timeout, the visitor can retry with the same key.

Rescheduling

A reschedule is a new booking (availability then confirm, with booking.replaces_booking_id). Once the new one is confirmed, Guidia sends booking.cancel for the old one; if the new slot is unavailable, the old booking is kept.