Webhooks

Rekaz can send business-event notifications to one HTTPS endpoint configured for a tenant.

Configure a receiver

1. Open Settings > API Keys in the Rekaz dashboard.
2. Open the webhook tab.
3. Enter a publicly reachable HTTPS URL.
4. Enable outbound webhooks and save.

The receiver should accept JSON POST requests and return a 2xx response quickly. Queue real processing and acknowledge first.

Rekaz sends:

Content-Type: application/json
User-Agent: RekazWebhookClient/1.0

Payload and casing

Webhook JSON uses PascalCase. This differs from the camelCase used by the public REST API.

{
  "Id": "4676383d-768f-4140-8cbc-50c45ce61051",
  "EventName": "ReservationCreatedEvent",
  "CreatedAt": "2026-07-30T11:15:22.123Z",
  "Data": {
    "Id": "0f826f69-b86e-4503-ad55-fe689fd9b1f2",
    "Status": "Pending",
    "Customer": {
      "Name": "Sara",
      "MobileNumber": "+966501234567"
    }
  }
}

Ignore unknown fields and tolerate nullable properties so handlers remain forward-compatible.

Event names

Reservations

• ReservationCreatedEvent
• ReservationConfirmedEvent
• ReservationDoneEvent
• ReservationCancelledEvent
• ReservationUpdatedEvent

Subscriptions

• SubscriptionCreatedEvent
• SubscriptionActivatedEvent
• SubscriptionCancelledEvent
• SubscriptionExpiredEvent
• SubscriptionPausedEvent
• SubscriptionResumedEvent
• SubscriptionPauseScheduledEvent
• SubscriptionTransferedEvent
• SubscriptionUpdatedEvent

SubscriptionTransferedEvent intentionally uses the existing spelling with one r in Transfered.

Merchandise orders

• MerchandiseOrderCreatedEvent
• MerchandiseOrderCompletedEvent
• MerchandiseOrderCanceledEvent

Gifts

• GiftCreatedEvent
• GiftActivatedEvent
• GiftRedeemedEvent
• GiftCancelledEvent

Delivery behavior

• Any 2xx response is treated as success.
• Failed delivery jobs can be retried, but retry timing is not a public contract.
• Duplicate deliveries are possible.
• Delivery order is not guaranteed.

Store Id with a unique constraint before applying side effects. When correctness depends on current state, fetch the reservation or subscription through the authenticated API.

Security

Outbound webhooks are not currently HMAC-signed. Treat each webhook as a notification, not proof of payment or authorization.

Until signed delivery is introduced:

• Require HTTPS.
• Use a long, unguessable receiver path.
• Accept only JSON POST requests with a reasonable body-size limit.
• Re-read supported resources before sensitive actions.
• Do not log full customer payloads.
• Rotate the receiver path if it is exposed.

Receiver example

app.post("/webhooks/rekaz/unguessable-path", async (request, response) => {
  const event = request.body;

  if (!event || typeof event.Id !== "string" || typeof event.EventName !== "string") {
    return response.sendStatus(400);
  }

  const inserted = await webhookInbox.insertIfAbsent({
    id: event.Id,
    eventName: event.EventName,
    payload: event,
  });

  if (inserted) {
    await jobs.enqueue("process-rekaz-webhook", { id: event.Id });
  }

  return response.sendStatus(200);
});