# WeTravel Webhooks

WeTravel is a group travel booking and payments platform. Its webhooks tell
your system when bookings, payments, transactions, trips and leads change, so
you can sync a CRM, accounting system or ops tooling.

## When to Use This Skill

* How do I receive WeTravel webhooks?
* How do I verify a WeTravel webhook signature?
* Why is my WeTravel `svix-signature` verification failing?
* How do I handle `booking.created`, `payment.created` or `transaction.created`?
* Why can't I see the "Webhooks" section in my WeTravel profile?

## Verification (core)

> **Caveat: WeTravel publishes no signature verification docs.** Its webhook
> endpoints are managed in an embedded **Svix App Portal** ("Manage Webhooks",
> which shows a masked **Signing Secret**), so deliveries are inferred to use
> standard Svix signing. Accept both `svix-*` and Standard Webhooks `webhook-*`
> header names, and confirm with a test event from the portal before going live.

* Headers: `svix-id`, `svix-timestamp` (Unix seconds), `svix-signature`
  (space-separated `v1,<base64>` entries)
* Signed content: `{svix-id}.{svix-timestamp}.{raw body}`
* Algorithm: HMAC-SHA256, base64 digest, key = base64-decoded secret after `whsec_`

Use the official `svix` library (Node and Python). It handles the key decoding,
multiple signatures, a 5-minute timestamp window and constant-time comparison:

```javascript
import { Webhook } from 'svix'; // svix 2.x: ESM-only, Node 22+

const h = (n) => req.headers[`svix-${n}`] ?? req.headers[`webhook-${n}`];
new Webhook(process.env.WETRAVEL_WEBHOOK_SECRET).verify(rawBody, {
  'svix-id': h('id'),
  'svix-timestamp': h('timestamp'),
  'svix-signature': h('signature'),
}); // throws WebhookVerificationError -> respond 400
const event = JSON.parse(rawBody.toString('utf8')); // { type, data }

```

```python
from svix.webhooks import Webhook  # raises WebhookVerificationError
Webhook(os.environ["WETRAVEL_WEBHOOK_SECRET"]).verify(raw_body, {
    "svix-id": msg_id, "svix-timestamp": timestamp, "svix-signature": signature,
})

```

> **For complete handlers with tests**, see [examples/express/](https://github.com/hookdeck/webhook-skills/tree/main/skills/wetravel-webhooks/examples/express/), [examples/nextjs/](https://github.com/hookdeck/webhook-skills/tree/main/skills/wetravel-webhooks/examples/nextjs/), [examples/fastapi/](https://github.com/hookdeck/webhook-skills/tree/main/skills/wetravel-webhooks/examples/fastapi/).

A manual (no-SDK) implementation is in [references/verification.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/wetravel-webhooks/references/verification.md).

## Event Types

These are all the event types on WeTravel's webhooks page. Payload schemas and
samples for each are in **Manage Webhooks → Event Catalog**.

| Event | Fired when |
| --- | --- |
| `booking.created` | A new booking is made (trip page, widget, or "Add Participant") |
| `booking.updated` | A booking changes: date change, refund, cancellation, new payment, failed/disputed payment, package switch, eSignature, and more |
| `payment.created` | A new payment is initiated |
| `payment.updated` | Payment status changes (pending → successful/failed, successful → refunded/disputed) or moves to a new trip on rebooking |
| `transaction.created` | Money moves: payment received, refund, dispute, payout, card/wire transfer, vendor payment, top-up, balance adjustment |
| `transaction.updated` | A transaction moves to a new trip on rebooking |
| `trip.published` | A trip is published (trip builder or Trip Builder API) |
| `lead.created` | A brochure is downloaded or a question is asked on a trip/profile page |
| `lead.updated` | The same lead downloads another brochure or asks another question |

## Environment Variables

```bash
WETRAVEL_WEBHOOK_SECRET=whsec_xxxxx   # Manage Webhooks → your endpoint → Signing Secret

```

## Local Development

```bash
npx hookdeck-cli listen 3000 wetravel --path /webhooks/wetravel

```

No account required. Paste the printed URL into **Manage Webhooks → + Add Endpoint**.

## Reference Materials

* [references/overview.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/wetravel-webhooks/references/overview.md) - Event types, triggers and payload envelope
* [references/setup.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/wetravel-webhooks/references/setup.md) - Enable webhooks, add an endpoint, get the signing secret
* [references/verification.md](https://github.com/hookdeck/webhook-skills/blob/main/skills/wetravel-webhooks/references/verification.md) - Svix signing details, manual fallback, gotchas