> For the complete documentation index, see [llms.txt](https://bonzai.gitbook.io/bonzai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://bonzai.gitbook.io/bonzai/webhooks.md).

# Webhooks

Webhooks allow you to receive real-time notifications whenever specific events occur on your Bonzai account — enabling you to trigger custom actions on your side.

{% hint style="info" %}
Webhooks are only available for **Bonzai Premium** creators.
{% endhint %}

## ⚙️ Setup

To configure your webhook:

1. Go to [bonzai.pro/business](https://www.bonzai.pro/business).
2. Scroll to the **Webhook** section.
3. Enter the **`Endpoint`** where you want to receive webhook events.

Once set, you can use the interface to manually test both available event types (`granted` and `revoked`) by clicking the test buttons.

## 📬 Event Types

Two types of events are currently supported:

* `product_access_granted`: triggered when a user is granted access to a product (via order or manual unlock).
* `product_access_revoked`: triggered when a user’s access is removed (e.g. subscription ends or access is manually revoked).

Each event is sent as a `POST` request with the following structure:

```json
{
  "event_type": "product_access_granted",
  "object": "product_access",
  "id": 1234,
  "type": "granted",
  "order_id": 12345,
  "timestamp": 1754055687,
  "order": {
    "id": 12345,
    "metadata": null
  },
  "vendor": {
    "id": "t_e93ffe9",
    "slug": "superstore",
    "name": "Super Store"
  },
  "user": {
    "id": 12345,
    "name": "John Doe",
    "email": "john.doe@gmail.com"
  },
  "product": {
    "id": "dXm3_9999",
    "name": "testwh"
  }
}
```

#### 🔎 Field Notes

* `event_type` is either `product_access_granted` or `product_access_revoked`
* `type` indicates whether the access was `"granted"` (manual or free) or `"purchased"`
* `order_id` is `null` if the access wasn’t tied to a paid order
* `vendor` identifies the creator account that triggered the event
* `user` and `product` objects give context about who got access to what

⚠️ **Security notice**: Webhooks are currently **not signed**, so make sure to use a **non-guessable URL** (e.g. with a long random token) to prevent unauthorized access.

## ♻️ Resend Events

Webhooks are sent **only once** per event — no retries are performed automatically.

You can manually resend any access event from the **"Manage accesses"** section of your product.

<figure><img src="/files/DKBWsN5NfWpePLWB6Sbi" alt="" width="304"><figcaption></figcaption></figure>

<figure><img src="/files/k8Tp7JxVo2H0XdIeLz83" alt="" width="375"><figcaption></figcaption></figure>