Events API

Trevo sends booking and payment updates as HTTPS POST requests with a JSON body to your configured webhook URL. Read the same events from your company’s private feed.

Receive your first event

1. In company settings, open API and save your webhook URL. For example, if you enter https://example.com/notifications, your server must accept POST /notifications with Content-Type: application/json. Copy the signing key shown once.
2. Verify the signature, persist the event ID and payload, then return a 2xx response. Use Send test to check delivery.
3. Select Enable integration to start capturing new events. Capture is off by default, including on Enterprise.

Self-hosted receivers are supported. The endpoint must be publicly reachable on port 443 and support TLS 1.2 or later. On every delivery, Trevo verifies that the certificate is valid for the hostname in the URL, is within its validity period and chains to a trusted certificate authority.

Event catalogue

reservation.created · updated · cancelled

One reservation or manual appointment, with its time, service, resource and available customer contact. Use the revision to handle late deliveries.

payment.succeeded

Confirmed Tpay payment. Amounts use minor currency units. A deposit can leave an outstanding on-site balance.

refund.succeeded

A completed Tpay refund. Partial refunds have separate refund IDs. External refunds may have no associated line item.

Example · partial refund

{
  "eventId": "77fd5810-62f9-4b0c-b843-5b61bf2ccacc",
  "schemaVersion": 1, "revision": "42",
  "type": "refund.succeeded",
  "occurredAt": "2026-11-08T14:30:00Z",
  "data": {
    "checkoutId": "7d346b28-7a33-4f5e-98d3-7b1b9697dfe2",
    "refundId": "example-refund", "currency": "PLN",
    "amount": 2500, "customer": {}
  }
}

Authentication

Use a company read token in the Bearer header for REST. The optional Basic client ID and secret authenticate outgoing requests at your endpoint. To rotate, generate a pending secret, configure your receiver to accept it, test it, then activate it.

Verify each webhook-signature using HMAC-SHA256 over webhook-id.webhook-timestamp.raw_body. Remove the whsec_ prefix and Base64-decode the signing key. Compare the Base64 result with the v1, signature using constant-time comparison. Reject timestamps outside a five-minute tolerance and deduplicate by event ID.

Delivery & recovery

Respond within three seconds. Retries preserve the event ID. Automatic retries for transient failures run for up to 72 hours. Check the company dashboard for acknowledgements or retry a failed delivery. The feed retains events for 30 days.

REST reference

GET /v1/events

Returns up to 100 events in feed order. Pass the previous response’s nextCursor as the cursor query parameter.

GET /v1/events/{eventId}

Returns one event in the authenticated company. An unavailable event returns 404.

curl https://api.trevo.me/v1/events \
  -H "Authorization: Bearer $TREVO_READ_TOKEN"