The Lessonluma API

Webhooks

Add an endpoint (dashboard or POST /webhooks) and choose events, or * for all. Each delivery is a JSON POST with headers Lessonluma-Event, Lessonluma-Delivery and Lessonluma-Signature: t=<unix>,v1=<hex>, where v1 is an HMAC-SHA256 of <t>.<raw body> with the endpoint secret. Failed deliveries retry after 1, 5, 30, 120 and 720 minutes. Return any 2xx to acknowledge.

import crypto from "node:crypto";

// rawBody: the exact request body string; header: req.headers["lessonluma-signature"]
export function verifyLessonluma(rawBody, header, secret) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const expected = crypto.createHmac("sha256", secret).update(`${parts.t}.${rawBody}`).digest("hex");
  const a = Buffer.from(expected), b = Buffer.from(parts.v1 || "");
  const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < 300;
  return fresh && a.length === b.length && crypto.timingSafeEqual(a, b);
}

Payload: { "id", "type", "created", "business_id", "data" }. Every coach account also has a built-in test endpoint that records what it receives, so you can see real payloads before wiring up Zapier or your own code.

Events: family.created family.updated person.created person.updated lesson.created lesson.updated lesson.moved lesson.cancelled lesson.rained_out booking.created booking.waitlisted booking.promoted booking.cancelled booking.skipped booking.attended booking.no_show recurring.created recurring.ended pack.purchased credits.added credits.low payment.created payment.succeeded payment.failed payment.refunded etransfer.matched etransfer.unmatched waiver.signed note.sent review.requested review.submitted lesson_type.created lesson_type.updated pack.created pack.updated business.created business.updated business.setup_applied business.plan_changed site.published site.unpublished