Booking or visitor lifecycle event delivered to your registered listener URL
Booking or visitor lifecycle event delivered to your registered listener URL. Always HMAC-signed (X-Keyspace-Signature). If your endpoint requires its own auth, Keyspace also sends a credential per the webhook's authStrategy: 'signature-only' (none), 'bearer' (Authorization: Bearer ), 'custom-header' (one or more : headers), or 'jwt' (Authorization: Bearer <short-lived HS256 JWT signed with the shared secret; claims iss=keyspace, aud=projectId, jti=delivery id, exp>).
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Body POSTed to a registered partner webhook listener. Covers booking (ROOM_/DESK_) and visitor (VMS_) lifecycle events on one channel. Headers: X-Keyspace-Event (type), X-Keyspace-Delivery (= id, unique per delivery — de-duplicate on it), X-Keyspace-Timestamp (epoch ms), X-Keyspace-Signature: sha256=HEX(HMAC-SHA256(secret, timestamp + '.' + rawBody)) computed over the exact raw bytes. Respond 2xx within 10s; retries: 5 attempts exponential from ~60s; 20 consecutive exhausted deliveries auto-disable the webhook. data is a change signal — for booking events fetch authoritative state via GET /meetings/{id}; visitor events are terminal (no partner GET). data never carries a meeting pinCode/tokens, EXCEPT VMS_INVITE_SENT which deliberately includes qrCardCode (the visitor's access QR, to relay to the invitee — treat as a credential). VMS_INVITE_SENT / VMS_HOST_CANCELLED data.endDateTime is null when the invite has no end time (valid the whole start day). Tolerate unknown data fields.
Response Body
Example Requests
/bookingLifecycleDeclaratively set the member’s cards and face PUT
Applies, in order: face (set / erase), the physical card set (enroll missing, revoke absent), then the auto-generated card rule — if the member now has a face and ZERO active physical cards, Keyspace mints ONE virtual card with a random unique number and returns it with generated: true so you can print/label a card. Card numbers default to Hikvision decimal-reversed. Supplying a face REQUIRES faceConsentAt. The member must be active (409 if offboarded — PUT the member first). Devices receive the credentials only through the access groups your app was provisioned with.
Build with AI agents
Everything on this site is also published in machine-readable form, so an AI assistant or coding agent can read the actual integration contract instead of guessing it. Point your tool at the files…