Register an HTTPS endpoint for the events you choose. Lodgestory POSTs a signed JSON envelope to it for every matching event — the Webhooks API reference has the envelope, the X-Webhook-Signature check, retries and every event's payload.

The response carries the endpoint's signing secret. No other API response returns it, so store it now (admins can also see it in Settings → Webhooks).

An organisation can have up to 30 endpoints, counting the ones created in Settings → Webhooks. Automation platforms register one endpoint per workflow: for a Zapier REST Hook trigger, call this from the subscribe step with url = bundle.targetUrl, keep the returned webhookId, and delete it from the unsubscribe step.

Security:

• The organisationId in the URL must match the organisation your JWT was issued for — requests for a different organisation fail with 401.
• Requires CRM_ADMIN, ACCOUNT_OWNER, or CRM_BOT role; other roles receive 403.