Create a webhook subscription

cURL

curl -X POST "https://api.fitsociety.io/public/v1/webhooks" \
  -H "Authorization: Bearer <access_token>" \
  -H "Idempotency-Key: webhook-create-crm-sync-20260714" \
  -H "Content-Type: application/json" \
  -d '{"name":"CRM sync","url":"https://example.com/fitsociety/webhooks","events":["client.created","client.updated"]}'

const options = {
  method: 'POST',
  headers: {
    'Idempotency-Key': '<idempotency-key>',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    name: 'CRM sync',
    url: 'https://example.com/fitsociety/webhooks',
    events: ['client.created', 'client.updated']
  })
};

fetch('https://api.fitsociety.io/public/v1/webhooks', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.fitsociety.io/public/v1/webhooks"

payload = {
    "name": "CRM sync",
    "url": "https://example.com/fitsociety/webhooks",
    "events": ["client.created", "client.updated"]
}
headers = {
    "Idempotency-Key": "<idempotency-key>",
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "data": {
    "subscription": {
      "id": "66f7b8b1e13c8d25f4d3d90a",
      "name": "CRM sync",
      "status": "active",
      "events": [
        "client.created",
        "client.updated"
      ],
      "target": {
        "type": "url",
        "url": "https://example.com/fitsociety/webhooks"
      },
      "secret": {
        "prefix": "whsec_12",
        "last4": "9abc",
        "rotatedAt": "2026-07-14T09:30:00.000Z"
      },
      "lastDeliveryAt": "2023-11-07T05:31:56Z",
      "lastSuccessAt": "2023-11-07T05:31:56Z",
      "lastFailureAt": "2023-11-07T05:31:56Z",
      "createdAt": "2023-11-07T05:31:56Z",
      "updatedAt": "2023-11-07T05:31:56Z",
      "signingSecret": "whsec_0123456789abcdefghijklmnopqrstuvwxyz"
    }
  },
  "meta": {
    "requestId": "4f849d7d-f4f1-45cc-b4b7-3984a3d17f83",
    "rateLimit": {
      "limit": 10,
      "remaining": 9,
      "resetSeconds": 1,
      "retryAfterSeconds": 1
    },
    "idempotency": {
      "replayed": true
    }
  }
}

{
  "error": {
    "code": 401,
    "key": "auth.invalid_token",
    "message": "The access token is invalid.",
    "details": {}
  },
  "meta": {
    "requestId": "4f849d7d-f4f1-45cc-b4b7-3984a3d17f83",
    "rateLimit": {
      "limit": 10,
      "remaining": 9,
      "resetSeconds": 1,
      "retryAfterSeconds": 1
    }
  }
}

{
  "error": {
    "code": 401,
    "key": "auth.invalid_token",
    "message": "The access token is invalid.",
    "details": {}
  },
  "meta": {
    "requestId": "4f849d7d-f4f1-45cc-b4b7-3984a3d17f83",
    "rateLimit": {
      "limit": 10,
      "remaining": 9,
      "resetSeconds": 1,
      "retryAfterSeconds": 1
    }
  }
}

{
  "error": {
    "code": 401,
    "key": "auth.invalid_token",
    "message": "The access token is invalid.",
    "details": {}
  },
  "meta": {
    "requestId": "4f849d7d-f4f1-45cc-b4b7-3984a3d17f83",
    "rateLimit": {
      "limit": 10,
      "remaining": 9,
      "resetSeconds": 1,
      "retryAfterSeconds": 1
    }
  }
}

{
  "error": {
    "code": 401,
    "key": "auth.invalid_token",
    "message": "The access token is invalid.",
    "details": {}
  },
  "meta": {
    "requestId": "4f849d7d-f4f1-45cc-b4b7-3984a3d17f83",
    "rateLimit": {
      "limit": 10,
      "remaining": 9,
      "resetSeconds": 1,
      "retryAfterSeconds": 1
    }
  }
}

POST

public

webhooks

cURL

curl -X POST "https://api.fitsociety.io/public/v1/webhooks" \
  -H "Authorization: Bearer <access_token>" \
  -H "Idempotency-Key: webhook-create-crm-sync-20260714" \
  -H "Content-Type: application/json" \
  -d '{"name":"CRM sync","url":"https://example.com/fitsociety/webhooks","events":["client.created","client.updated"]}'

const options = {
  method: 'POST',
  headers: {
    'Idempotency-Key': '<idempotency-key>',
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    name: 'CRM sync',
    url: 'https://example.com/fitsociety/webhooks',
    events: ['client.created', 'client.updated']
  })
};

fetch('https://api.fitsociety.io/public/v1/webhooks', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.fitsociety.io/public/v1/webhooks"

payload = {
    "name": "CRM sync",
    "url": "https://example.com/fitsociety/webhooks",
    "events": ["client.created", "client.updated"]
}
headers = {
    "Idempotency-Key": "<idempotency-key>",
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "data": {
    "subscription": {
      "id": "66f7b8b1e13c8d25f4d3d90a",
      "name": "CRM sync",
      "status": "active",
      "events": [
        "client.created",
        "client.updated"
      ],
      "target": {
        "type": "url",
        "url": "https://example.com/fitsociety/webhooks"
      },
      "secret": {
        "prefix": "whsec_12",
        "last4": "9abc",
        "rotatedAt": "2026-07-14T09:30:00.000Z"
      },
      "lastDeliveryAt": "2023-11-07T05:31:56Z",
      "lastSuccessAt": "2023-11-07T05:31:56Z",
      "lastFailureAt": "2023-11-07T05:31:56Z",
      "createdAt": "2023-11-07T05:31:56Z",
      "updatedAt": "2023-11-07T05:31:56Z",
      "signingSecret": "whsec_0123456789abcdefghijklmnopqrstuvwxyz"
    }
  },
  "meta": {
    "requestId": "4f849d7d-f4f1-45cc-b4b7-3984a3d17f83",
    "rateLimit": {
      "limit": 10,
      "remaining": 9,
      "resetSeconds": 1,
      "retryAfterSeconds": 1
    },
    "idempotency": {
      "replayed": true
    }
  }
}

{
  "error": {
    "code": 401,
    "key": "auth.invalid_token",
    "message": "The access token is invalid.",
    "details": {}
  },
  "meta": {
    "requestId": "4f849d7d-f4f1-45cc-b4b7-3984a3d17f83",
    "rateLimit": {
      "limit": 10,
      "remaining": 9,
      "resetSeconds": 1,
      "retryAfterSeconds": 1
    }
  }
}

{
  "error": {
    "code": 401,
    "key": "auth.invalid_token",
    "message": "The access token is invalid.",
    "details": {}
  },
  "meta": {
    "requestId": "4f849d7d-f4f1-45cc-b4b7-3984a3d17f83",
    "rateLimit": {
      "limit": 10,
      "remaining": 9,
      "resetSeconds": 1,
      "retryAfterSeconds": 1
    }
  }
}

{
  "error": {
    "code": 401,
    "key": "auth.invalid_token",
    "message": "The access token is invalid.",
    "details": {}
  },
  "meta": {
    "requestId": "4f849d7d-f4f1-45cc-b4b7-3984a3d17f83",
    "rateLimit": {
      "limit": 10,
      "remaining": 9,
      "resetSeconds": 1,
      "retryAfterSeconds": 1
    }
  }
}

{
  "error": {
    "code": 401,
    "key": "auth.invalid_token",
    "message": "The access token is invalid.",
    "details": {}
  },
  "meta": {
    "requestId": "4f849d7d-f4f1-45cc-b4b7-3984a3d17f83",
    "rateLimit": {
      "limit": 10,
      "remaining": 9,
      "resetSeconds": 1,
      "retryAfterSeconds": 1
    }
  }
}

Authorizations

Authorization

string

header

required

Public API access token issued by /public/v1/oauth/token. Example: Authorization: Bearer fspt_....

Headers

Idempotency-Key

string

required

Required for Public API write requests. Reusing the same key with the same method, path, and body replays the stored successful response; reusing it with a different request returns 409 idempotency.conflict.

Required string length: 1 - 200

Example:

"booking-create-20260714-001"

Body

application/json

name

string

required

Maximum string length: 120

Example:

"CRM sync"

url

string<uri>

required

Public HTTPS URL that receives outbound FITsociety webhook deliveries.

Example:

"https://example.com/fitsociety/webhooks"

events

enum<string>[]

required

Minimum array length: 1

Available options:

subscription.test,

client.created,

client.updated,

client.archived,

client.invited,

client.portal_access.changed,

client.relationship.approved,

client.relationship.rejected,

client.note.created,

client.note.updated,

client.note.deleted,

booking.created,

booking.updated,

booking.cancelled,

booking_request.created,

booking_request.approved,

booking_request.rejected,

recurring_booking.changed,

calendar_task.created,

calendar_task.updated,

calendar_task.cancelled,

invoice.created,

invoice.sent,

invoice.overdue,

invoice.cancelled,

invoice.paid,

payment.succeeded,

payment.failed,

payment.request.created,

payment.request.cancelled,

chargeback.created,

subscription.changed,

subscription.cancelled,

client_product.assigned,

client_product.revoked,

credit.assigned,

credit.adjusted,

credit.revoked,

membership.assigned,

form.assigned,

form.submitted,

intake.submitted,

checkup.assigned,

checkup.submitted,

measurement.created,

measurement.updated,

progress_photo.created,

goal.updated,

habit_entry.created,

document.linked,

document.updated,

document.archived

Example:

["client.created", "client.updated"]

Response

Webhook subscription created

data

object

required

Show child attributes

Health

OAuth

Platform

Company catalog

Clients

Calendar and bookings

Finance

Progress

Forms and documents

Reports

Webhooks

Authorizations

Headers

Body

Response