Event IngestionAuth: None

Webhooks & Real-time Events

Inbound webhook handlers for payment gateway callbacks (Stripe, Paystack) and Online Travel Agency (OTA) booking synchronizations. Webhooks are server-to-server and cryptographically verified.

POSThttps://api.thegrandeur.vip/api/v1/payments/webhook

Header Parameters

Stripe-Signature / x-paystack-signaturestringrequired

Cryptographic HMAC signature generated by the provider to verify event authenticity.

Example: t=1690000000,v1=5257a869e7e...

Content-Typestringrequired

application/json

Example: application/json

Request Body Schema (JSON)

type / eventstringrequired

Standard event identifier (e.g. checkout.session.completed, charge.success).

Example: checkout.session.completed

dataobjectrequired

Provider-specific event payload containing payment status, metadata, and amounts.

Active Inbound Endpoints

POST /api/v1/payments/webhook — payment provider callbacks for automated folio settlement.
POST /api/v1/ota/webhooks/booking — OTA channel manager events for automated inventory hold.

Note: Guest-facing sites use X-API-Key for hotel binding. Webhooks are server-to-server and rely on cryptographic signature headers rather than client API keys.

# Simulating payment webhook verification
curl -s -X POST "https://api.thegrandeur.vip/api/v1/payments/webhook" \
  -H "Content-Type: application/json" \
  -H "Stripe-Signature: t=1690000000,v1=..." \
  -d '{
    "type": "checkout.session.completed",
    "data": {
      "object": {
        "id": "cs_live_99182a",
        "amount_total": 28000,
        "currency": "usd",
        "metadata": {
          "booking_id": "bk_9812a"
        }
      }
    }
  }'

Response Preview

{
  "received": true,
  "event": "checkout.session.completed",
  "reconciled_booking": "bk_9812a"
}

Hardware Bridge

Authentication