Webhooks carry guest names, emails, phone numbers, and payment amounts, so the URL that receives them deserves care. This page covers how to protect your endpoint, and which destinations TripWorks refuses to call.
In this article
Protect your endpoint
- Treat the URL as a secret. Use a long, unguessable path and don't post it in chat, tickets, or public code.
- Use HTTPS. The payload is encrypted in transit and your certificate proves the server is yours.
-
Add your own token. Put a secret in the path or query string, such as
https://hooks.example.com/tripworks/k3j9x..., and reject requests that don't carry it. - Answer 200 only for requests you trust. Return 401 or 403 for anything else. That stops TripWorks from retrying a request that was never valid.
- Treat the data as personal information. Store and log it the way you would any guest record.
What TripWorks refuses to call
For safety, TripWorks won't deliver webhooks to internal or private destinations. These are refused, and the delivery is cancelled without a retry:
- Addresses that aren't
httporhttps - Addresses that point back to the same machine
- Private networks (10.x, 172.16 to 172.31, and 192.168.x)
- Link-local and cloud metadata addresses
- Other reserved ranges
This also applies after a redirect. If your URL redirects somewhere private, or from https to http, the delivery is refused. A host name that can't be found isn't refused, but it can't be reached either, so it's retried.
Examples
-
Reject strangers: add
?token=followed by a long random value to your URL, and have your server return 403 when it doesn't match. - Keep a test URL private: when you point a webhook.site address at an event, delete it after testing.
- Move a receiver behind a firewall: expose a public HTTPS address that forwards to your internal system, since TripWorks can't call private addresses.
- Rotate a leaked URL: create a new URL with a new token, replace it on the setup screen, then retire the old one.
Frequently asked questions
How do I make sure a request came from TripWorks?
Keep the URL secret, use HTTPS, and add your own token to the URL path or query string. Reject any request that doesn't carry it.
Can I restrict by IP address?
TripWorks doesn't publish a fixed set of sending addresses, so an IP allowlist isn't a reliable control. Use a token in the URL instead.
Can I send webhooks to a server on my office network?
Not directly. Private addresses are refused. Put a public HTTPS endpoint in front and forward to your network.
Is HTTP allowed?
TripWorks will call http URLs, but use HTTPS. Without it, guest details travel unencrypted.
Why was a delivery cancelled?
Usually because the address was refused for safety, such as a private address or a redirect to one. Use a public HTTPS URL.
Related
Built for attractions, tours & activities
Wire TripWorks into everything else
See how attractions, tours, and activities push bookings, payments, and waivers into their own systems in real time on TripWorks. Book a demo and make the switch.