API reference

Webhooks

3 endpoints

Outbound webhook subscriptions. record.created / record.updated / record.deleted fire for every booking an integration deals in and carry an ImportedRecord body — the same shape GET /api/v1/imports/{entity}/records/{external_id} returns, including YOUR external_id when the record came in through an import. record.updated fires only when a meaningful field moves (status, or a field the read-back publishes), not on every recalculation.

A subscription narrows on two axes. events picks which of the three you receive; entities picks which record types, using the same keys as /api/v1/imports/{entity} — tickets, hotel_stays, transfers, cruises, car_rentals, tour_bookings, tour_departures, charters, visa_cases, events.

An empty or omitted entities means all of them, which is what every subscription registered before the filter existed carries, so nothing has to be re-registered — and it means a type added later starts arriving at that endpoint too. Pick the types explicitly if that matters to you. An entity that cannot fire a webhook (customers, operator_invoices, …) is refused with 422 rather than accepted into an endpoint that would then never be called.

Broadcasting is not the same permission as importing. charters, visa_cases and events are read-only over /api/v1/imports: they broadcast, they page through GET /api/v1/imports/{entity}/records, and a POST to them answers 422 entity_not_writable.

tour_departures is inventory rather than a booking, and subscribing to it is the only way to hear that a departure was cancelled or sold out: that does not move the status of the seats sold on it, so tour_bookings alone stays silent.

One name appears on both axes of the same body, so read it carefully: the events FIELD picks which of record.created / record.updated / record.deleted you receive, while "events" inside entities is the event-project vertical — {"events": ["record.created"], "entities": ["events", "charters"]}.

List webhook subscriptions

GET/api/v1/webhooks

Needs a key with the full scope.

Parameters

Query

limitintegerdefault 25
Rows per page.
cursorstring
Opaque; take it from the previous response's page.next_cursor.

Response · 200

dataobject[]required
Show fieldsHide fields
- iduuid
- urluri
- eventsstring[]
- entitiesstring[]
  Record types this endpoint receives. [] means ALL of them, not none — including types added after the subscription was created. Same keys as /api/v1/imports/{entity}, whether or not that entity accepts a push: charters, visa_cases and events are read-only over the import endpoint and still broadcast.
- activeboolean
- created_atdate-time
pageobjectrequired
The cursor for the list beside it. Re-send the same request with ?cursor=<next_cursor> while has_more is true. next_cursor is null on the last page.
Show fieldsHide fields
- next_cursorstringrequirednullable
- has_morebooleanrequired
- limitintegerrequired

Responses

401Missing or invalid Bearer token
403Policy denied or account has no owner
429Rate limit exceeded

curl -X GET 'https://YOUR-CELL.lydira.com/api/v1/webhooks' \
  -H 'Authorization: Bearer sek_YOUR_API_KEY'

const response = await fetch(
  "https://YOUR-CELL.lydira.com/api/v1/webhooks",
  {
    method: "GET",
    headers: {
      "Authorization": "Bearer sek_YOUR_API_KEY",
    },
  },
);

if (!response.ok) throw new Error(`${response.status} ${await response.text()}`);
const data = await response.json();

import requests

response = requests.get(
    "https://YOUR-CELL.lydira.com/api/v1/webhooks",
    headers={
        "Authorization": "Bearer sek_YOUR_API_KEY",
    },
)
response.raise_for_status()
data = response.json()

require "net/http"
require "json"

uri = URI("https://YOUR-CELL.lydira.com/api/v1/webhooks")
request = Net::HTTP::Get.new(uri)
request["Authorization"] = "Bearer sek_YOUR_API_KEY"

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { it.request(request) }
raise response.body unless response.is_a?(Net::HTTPSuccess)
data = JSON.parse(response.body)

<?php
$ch = curl_init("https://YOUR-CELL.lydira.com/api/v1/webhooks");
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST  => "GET",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        "Authorization: Bearer sek_YOUR_API_KEY",
    ],
]);

$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response

200

{
  "data": [
    {
      "id": "9d2f7c3a-1b4e-4a7d-8e51-2c0f6b9a4d18",
      "url": "https://example.com/hook",
      "events": [
        "record.created"
      ],
      "entities": [
        "tickets"
      ],
      "active": true,
      "created_at": "2026-03-14T09:30:00Z"
    }
  ],
  "page": {
    "next_cursor": "MjAyNi0wMy0xNFQwOTozMDowMC4wMDAwMDBafDk0MQ",
    "has_more": true,
    "limit": 25
  }
}

Create webhook subscription

POST/api/v1/webhooks

Needs a key with the full scope.

Returns signing_secret once (whsec_ prefix). Empty or omitted events defaults to all allowed events, and empty or omitted entities to all booking types — so a body carrying only url subscribes to everything.

Parameters

Headers

Idempotency-Keystring
Your own unique string for this write (a UUID is the obvious choice), max 255 characters. Optional: omit it and nothing changes. Send it and a repeat of the same request returns this call's response verbatim, with Idempotent-Replay: true, instead of writing again.

Body

urlurirequired
eventsstring[]
entitiesstring[]
Record types this endpoint receives. [] means ALL of them, not none — including types added after the subscription was created. Same keys as /api/v1/imports/{entity}, whether or not that entity accepts a push: charters, visa_cases and events are read-only over the import endpoint and still broadcast.

Response · 201

iduuidrequired
urlurirequired
eventsstring[]required
entitiesstring[]required
[] means every booking type.
signing_secretstringrequired
Shown once; whsec_ prefix
created_atdate-timerequired

Responses

401Missing or invalid Bearer token
403Policy denied or account has no owner
422Validation error
429Rate limit exceeded

curl -X POST 'https://YOUR-CELL.lydira.com/api/v1/webhooks' \
  -H 'Authorization: Bearer sek_YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: 8f14e45f-ea2c-4f33-9a3b-6d0c1b7e5a90' \
  -d '{
  "url": "https://example.com/hook",
  "events": [
    "record.created"
  ],
  "entities": [
    "tickets"
  ]
}'

const response = await fetch(
  "https://YOUR-CELL.lydira.com/api/v1/webhooks",
  {
    method: "POST",
    headers: {
      "Authorization": "Bearer sek_YOUR_API_KEY",
      "Content-Type": "application/json",
      "Idempotency-Key": "8f14e45f-ea2c-4f33-9a3b-6d0c1b7e5a90",
    },
    body: JSON.stringify({
      "url": "https://example.com/hook",
      "events": [
        "record.created"
      ],
      "entities": [
        "tickets"
      ]
    }),
  },
);

if (!response.ok) throw new Error(`${response.status} ${await response.text()}`);
const data = await response.json();

import requests

response = requests.post(
    "https://YOUR-CELL.lydira.com/api/v1/webhooks",
    headers={
        "Authorization": "Bearer sek_YOUR_API_KEY",
        "Content-Type": "application/json",
        "Idempotency-Key": "8f14e45f-ea2c-4f33-9a3b-6d0c1b7e5a90",
    },
    json={
      "url": "https://example.com/hook",
      "events": [
        "record.created"
      ],
      "entities": [
        "tickets"
      ]
    },
)
response.raise_for_status()
data = response.json()

require "net/http"
require "json"

uri = URI("https://YOUR-CELL.lydira.com/api/v1/webhooks")
request = Net::HTTP::Post.new(uri)
request["Authorization"] = "Bearer sek_YOUR_API_KEY"
request["Content-Type"] = "application/json"
request["Idempotency-Key"] = "8f14e45f-ea2c-4f33-9a3b-6d0c1b7e5a90"
request.body = JSON.generate({
  url: "https://example.com/hook",
  events: [
    "record.created"
  ],
  entities: [
    "tickets"
  ]
})

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { it.request(request) }
raise response.body unless response.is_a?(Net::HTTPSuccess)
data = JSON.parse(response.body)

<?php
$ch = curl_init("https://YOUR-CELL.lydira.com/api/v1/webhooks");
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST  => "POST",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        "Authorization: Bearer sek_YOUR_API_KEY",
        "Content-Type: application/json",
        "Idempotency-Key: 8f14e45f-ea2c-4f33-9a3b-6d0c1b7e5a90",
    ],
    CURLOPT_POSTFIELDS     => json_encode([
        "url" => "https://example.com/hook",
        "events" => [
            "record.created",
        ],
        "entities" => [
            "tickets",
        ],
    ]),
]);

$data = json_decode(curl_exec($ch), true);
curl_close($ch);

Response

201

{
  "id": "9d2f7c3a-1b4e-4a7d-8e51-2c0f6b9a4d18",
  "url": "https://example.com/hook",
  "events": [
    "string"
  ],
  "entities": [
    "string"
  ],
  "signing_secret": "whsec_2f3e4c1b4a2e9f3d7b1c2d3e4f501a2b",
  "created_at": "2026-03-14T09:30:00Z"
}

Delete webhook subscription

DELETE/api/v1/webhooks/{id}

Needs a key with the full scope.

Parameters

Path

iduuidrequired

Headers

Idempotency-Keystring
Your own unique string for this write (a UUID is the obvious choice), max 255 characters. Optional: omit it and nothing changes. Send it and a repeat of the same request returns this call's response verbatim, with Idempotent-Replay: true, instead of writing again.

Responses

204Deleted
401Missing or invalid Bearer token
403Policy denied or account has no owner
404Resource not found
429Rate limit exceeded

curl -X DELETE 'https://YOUR-CELL.lydira.com/api/v1/webhooks/9d2f7c3a-1b4e-4a7d-8e51-2c0f6b9a4d18' \
  -H 'Authorization: Bearer sek_YOUR_API_KEY' \
  -H 'Idempotency-Key: 8f14e45f-ea2c-4f33-9a3b-6d0c1b7e5a90'

const response = await fetch(
  "https://YOUR-CELL.lydira.com/api/v1/webhooks/9d2f7c3a-1b4e-4a7d-8e51-2c0f6b9a4d18",
  {
    method: "DELETE",
    headers: {
      "Authorization": "Bearer sek_YOUR_API_KEY",
      "Idempotency-Key": "8f14e45f-ea2c-4f33-9a3b-6d0c1b7e5a90",
    },
  },
);

if (!response.ok) throw new Error(`${response.status} ${await response.text()}`);
// 204 No Content

import requests

response = requests.delete(
    "https://YOUR-CELL.lydira.com/api/v1/webhooks/9d2f7c3a-1b4e-4a7d-8e51-2c0f6b9a4d18",
    headers={
        "Authorization": "Bearer sek_YOUR_API_KEY",
        "Idempotency-Key": "8f14e45f-ea2c-4f33-9a3b-6d0c1b7e5a90",
    },
)
response.raise_for_status()

require "net/http"
require "json"

uri = URI("https://YOUR-CELL.lydira.com/api/v1/webhooks/9d2f7c3a-1b4e-4a7d-8e51-2c0f6b9a4d18")
request = Net::HTTP::Delete.new(uri)
request["Authorization"] = "Bearer sek_YOUR_API_KEY"
request["Idempotency-Key"] = "8f14e45f-ea2c-4f33-9a3b-6d0c1b7e5a90"

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { it.request(request) }
raise response.body unless response.is_a?(Net::HTTPSuccess)

<?php
$ch = curl_init("https://YOUR-CELL.lydira.com/api/v1/webhooks/9d2f7c3a-1b4e-4a7d-8e51-2c0f6b9a4d18");
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST  => "DELETE",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        "Authorization: Bearer sek_YOUR_API_KEY",
        "Idempotency-Key: 8f14e45f-ea2c-4f33-9a3b-6d0c1b7e5a90",
    ],
]);

$data = json_decode(curl_exec($ch), true);
curl_close($ch);