Introducing Webhooks: Real-Time Integrations for Your Restaurant

Restaurants don't operate in isolation. Between POS systems, inventory management, accounting software, marketing tools, and team communication channels, modern restaurants rely on a web of connected systems. Until now, keeping those systems in sync with Gustaio meant manual effort or scheduled polling.

Today, we're launching Webhooks — a developer-friendly feature that pushes real-time event notifications to any HTTPS endpoint whenever something changes in your Gustaio account.

What Are Webhooks?

A webhook is a simple concept: when something happens in Gustaio (a new order comes in, a menu item is updated, an experience is deleted), we immediately send an HTTP POST request to a URL you configure. Your system receives the event data instantly and can react to it — no polling, no delays, no manual sync.

Think of it as Gustaio tapping your system on the shoulder and saying: "Hey, something just happened — here are the details."

Supported Events

Webhooks are available for all core resource types:

Event	Trigger
order.create	A new order is placed, including experience bookings
order.update	An order is updated (status change, payment captured, etc.)
experience.create	A new experience is created
experience.update	An experience's details are modified
experience.delete	An experience is removed
menu_item.create	A new menu item is added
menu_item.update	A menu item's details are changed
menu_item.delete	A menu item is removed

Each webhook can subscribe to any combination of events — receive everything, or only what matters to your integration.

Security by Design

Every webhook delivery is signed using HMAC-SHA256. When you create a webhook, Gustaio generates a unique signing secret that is shown exactly once. Each POST request includes two verification headers:

• X-Webhook-Signature — the HMAC-SHA256 hex digest of {timestamp}.{body}
• X-Webhook-Timestamp — the Unix timestamp of the delivery

Your endpoint can verify the signature to ensure the request genuinely came from Gustaio and hasn't been tampered with. Replay attacks can be mitigated by rejecting requests with stale timestamps.

// Example: Verifying a webhook signature in Node.js
const crypto = require('crypto');

function verifyWebhook(secret, timestamp, body, signature) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${body}`)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

If your secret is ever compromised, you can regenerate it instantly from the dashboard — the old secret is immediately invalidated.

Delivery Logging

Every webhook delivery is logged. Expand the "Recent deliveries" panel on any webhook to see:

• Status code — green for 2xx success, red for errors
• Duration — round-trip time in milliseconds
• Response body — what your endpoint returned (truncated to 500 characters)
• Timestamp — when the delivery was attempted

This makes debugging straightforward — you can see at a glance whether your endpoint is receiving and processing events correctly.

Managing Webhooks

The new Developers section in the Gustaio dashboard gives you full control:

• Create webhooks with a target URL, description, and event selection
• Enable/Disable webhooks with a toggle — pausing delivery without deleting the configuration
• Edit the URL, description, or subscribed events at any time
• Regenerate the signing secret if needed
• Delete webhooks you no longer need

Each event type in the creation dialog includes a description so you know exactly what triggers it — including the important detail that order.create covers experience bookings as well as regular orders.

An example payload is shown directly in the creation dialog, complete with HTTP headers and a formatted JSON body, so you know exactly what to expect before writing a single line of code.

Use Cases

Sync Orders to Your POS

Subscribe to order.create and order.update to push new orders and status changes directly to your point-of-sale system — no manual re-entry.

Notify Your Team on Google Chat or Slack

Point your webhook at a small relay function that reformats the event data for Google Chat or Slack. Your kitchen team gets instant notifications when a new order or booking arrives.

Update Inventory

Listen for menu_item.update events to keep external inventory systems in sync. When a menu item's price or availability changes in Gustaio, your other systems reflect it immediately.

Trigger Marketing Automations

Use order.create events to trigger post-visit email campaigns, loyalty point awards, or review request flows in your CRM.

Experience Booking Alerts

Since experience bookings fire as order.create events (with an experienceDetails field in the payload), you can set up dedicated alerts for high-value prepaid bookings.

Getting Started

1. Open the Gustaio Dashboard and navigate to the Developers section in the sidebar
2. Click Create Webhook
3. Enter your HTTPS endpoint URL
4. Select the events you want to receive
5. Click Create — and copy the signing secret (shown only once!)
6. Your endpoint will start receiving events immediately

That's it. No API keys to manage, no OAuth flows to configure, no SDKs to install.

What's Next

This is just the beginning of our developer platform. On the roadmap:

• Retry policies — automatic retry with exponential backoff for failed deliveries
• Event filtering — filter by specific properties (e.g., only orders above a certain amount)
• Webhook templates — pre-built integrations for popular tools like Slack, Google Chat, and Zapier
• API access — a full REST API for programmatic access to your Gustaio data

---

Webhooks are available now on all Gustaio plans at no additional cost. Head to the Dashboard to create your first webhook, or contact us if you need help with your integration.