ShotVista webhooks and Zapier: delivery and booking events

What it does

• Add up to 10 endpoints under Settings, Integrations: Webhooks for any HTTPS URL, Zapier for a Catch Hook URL.
• Choose which events each endpoint receives; with none selected it receives every event.
• Sign every request with HMAC-SHA256 in the X-ShotVista-Signature header, using a secret shown once when you create the endpoint.
• Send a test ping, see recent deliveries with their status, and resend an event.
• Rotate the signing secret with New secret.

When it runs

• delivery.ready: a listing is marked delivered, so its delivery page is ready to share.
• delivery.paid: a client pays for a delivery page through Stripe Checkout.
• booking.created: a booking is created from the dashboard, the public order form or a location booking page.
• ping: you press Test webhook.

Set it up

1. Open Settings, Integrations in the ShotVista dashboard and choose Webhooks or Zapier.
2. For Zapier, create a Zap with Webhooks by Zapier, Catch Hook as the trigger and copy its URL.
3. Paste the HTTPS URL, pick the events and save. Copy the signing secret now; it is shown only once.
4. Press Test webhook so your server or Zapier receives a sample event.
5. On your server, verify the signature and ignore events whose id you have already processed.

Example

An agent books a shoot on your order form. ShotVista posts booking.created with the date, time, address and the client’s name, email and phone to your Zapier Catch Hook, and the Zap adds a row to your bookings sheet and a message in your team chat.

Limits

• Outbound only: there is no public API to create listings or read data from ShotVista.
• HTTPS URLs on public addresses only; private, loopback and cloud metadata addresses are refused.
• Any 2xx answer within 10 seconds counts as delivered. Redirects are not followed.
• The same event can arrive more than once (retries or a resend), so deduplicate on the event id, which is also sent as Idempotency-Key.
• There is no ShotVista app in the Zapier directory; use Webhooks by Zapier.

Troubleshooting

My endpoint shows Failed.

Failed deliveries are retried after 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours and 12 hours, then marked Failed. Fix the endpoint, then resend the event from Recent deliveries. A 410 Gone answer stops retries at once.

The signature does not match.

Compute HMAC-SHA256 over the timestamp, a dot and the raw request body exactly as received, before any JSON parsing, and compare it with v1 in X-ShotVista-Signature. Reject requests whose timestamp is more than 5 minutes off.

Zapier does not see any fields.

Press Test webhook in ShotVista after the Catch Hook is created, then test the trigger in Zapier so it picks up the sample event.