Webhooks

Partner API (Arinbo ? your server)

Configure webhook_url and optional webhook_secret on the partner credential.

Event	When
`booking.confirmed`	After successful `POST /hotels/book`
`booking.cancelled`	After successful `POST /hotels/cancel`

HTTPS POST only. Body JSON:

{ "eventType", "timestampUtc", "correlationId", "tenantId", "agencyId", "data" }

Header X-Arinware-Signature: sha256={hex} when secret is set � HMAC-SHA256 of the raw JSON body. (Header name reflects the operating company; product brand is Arinbo.)

Verify signature (browser)

Webhook secret Raw JSON body X-Arinware-Signature (incoming)

Extranet (Arinbo ? supplier)

Property booking webhook via extranet connectivity settings. Same HMAC pattern with configured secret � details in EXTRANET_API.md.