Glofox supports webhooks for real-time updates. Configure each webhook to send events to one or more target URLs.
Delivery model
Glofox sends each webhook to the configured URL as an HTTP POST request with a JSON payload. Your endpoint should respond with HTTP 200 when the event is accepted.
Timeouts and retries
Timeout: the receiving endpoint must complete processing and return a response within 1 second, measured from connection establishment through delivery of the response. If the endpoint does not return a successful response within that interval, Glofox treats the delivery as failed.
Retries: when a delivery fails, Glofox retries up to three times in total for the same event. Delivery is at-least-once; Glofox may POST the same logical event multiple times. Make your implementation idempotent: key processing on a stable event identifier or message identifier and no-op (or return success) when you already processed that identifier successfully.
Payload structure
Each webhook payload is a JSON object with common fields:
| Field | Description |
|---|---|
Type | Event type identifier (for example, MEMBER_CREATED) |
Metadata | Context such as trace_id, location_id, and payload version |
Timestamp | ISO 8601 timestamp when the event occurred |
Payload | Event-specific data |
Event-specific fields and behaviour are documented per webhook in the API Reference.
Signature validation
Each webhook includes a signature HTTP header for source validation. Glofox provides the secret key for webhooks with your API credentials. The signature is a hexadecimal string that uses hash-based message authentication code with the 256-bit Secure Hash Algorithm, computed as Signature = Hex( HMAC-SHA256( YourSecretKey, StringToSign )).
Validate the signature before processing the payload so you accept only authentic Glofox events.
Webhook types
For event-specific behaviour, payload schemas, and available event types, see the API Reference—Webhooks.