> ## Documentation Index
> Fetch the complete documentation index at: https://partner.headout.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhooks

> The two webhook channels — booking-status updates and product event subscriptions — and how to verify each.

Headout delivers webhooks over two channels:

| | Booking-status webhook (legacy) | Event subscriptions |
| - | - | - |
| **What it carries** | Booking lifecycle updates — ticket generation, cancellation, reschedule, failures | Product events, e.g. `product.listing_status_changed`, `product.variant_listing_status_changed` |
| **Setup** | Endpoint configured via the [webhook configuration API](https://partner.headout.com/docs/api-partner/v2/webhooks/get.md) or your Headout SPOC | Self-serve via the [Event Subscriptions API](https://partner.headout.com/docs/api-partner/v2/event-subscriptions/create.md) |
| **Authenticity** | Not signed — verify by IP whitelisting | Signed with HMAC-SHA256 (`X-Headout-Signature`) |
| **Reference** | [Booking status event](https://partner.headout.com/docs/api-partner/v2/webhooks/booking-event.md) | [Event subscription notification](https://partner.headout.com/docs/api-partner/v2/event-subscriptions/webhook-event.md) |

## Booking-status webhook

Booking-status webhooks are essential to:

* Track ticket generation
* Receive cancellation or reschedule updates
* Handle failures
* Keep booking state in sync

Partners must assume:

* Status transitions are non-linear
* Completed bookings can still be cancelled (ex: in case of venue closures etc)

### Verifying authenticity

Headout does not yet sign booking-status webhook payloads. The supported workaround is **IP whitelisting** — accept incoming webhook traffic only from Headout's known source IPs listed below. Signature-based verification for this channel is in progress.

| Environment | Outbound IP |
| - | - |
| Production | `34.224.248.1` |
| Sandbox | `54.211.17.142` |

## Event subscriptions

Event subscriptions notify you of product changes without polling: register an HTTPS endpoint once and receive a signed webhook the moment a product's listing status flips. Manage endpoints, pause and resume delivery, and rotate signing secrets entirely through the [API](https://partner.headout.com/docs/api-partner/v2/event-subscriptions/create.md).

### Verifying authenticity

Every delivery is signed: the `X-Headout-Signature` header carries a timestamped HMAC-SHA256 over the exact request body. Verification steps and ready-made samples (Go, Java, Kotlin, Node, Python) are on the [Event subscription notification](https://partner.headout.com/docs/api-partner/v2/event-subscriptions/webhook-event.md) page.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.