# Webhooks
Webhooks allow you to receive real-time notifications whenever specific events occur on your Bonzai account — enabling you to trigger custom actions on your side.
{% hint style="info" %}
Webhooks are only available for **Bonzai Premium** creators.
{% endhint %}
## ⚙️ Setup
To configure your webhook:
1. Go to [bonzai.pro/business](https://www.bonzai.pro/business).
2. Scroll to the **Webhook** section.
3. Enter the **`Endpoint`** where you want to receive webhook events.
Once set, you can use the interface to manually test both available event types (`granted` and `revoked`) by clicking the test buttons.
## 📬 Event Types
Two types of events are currently supported:
* `product_access_granted`: triggered when a user is granted access to a product (via order or manual unlock).
* `product_access_revoked`: triggered when a user’s access is removed (e.g. subscription ends or access is manually revoked).
Each event is sent as a `POST` request with the following structure:
```json
{
"event_type": "product_access_granted",
"object": "product_access",
"id": 1234,
"type": "granted",
"order_id": 12345,
"timestamp": 1754055687,
"order": {
"id": 12345,
"metadata": null
},
"vendor": {
"id": "t_e93ffe9",
"slug": "superstore",
"name": "Super Store"
},
"user": {
"id": 12345,
"name": "John Doe",
"email": "john.doe@gmail.com"
},
"product": {
"id": "dXm3_9999",
"name": "testwh"
}
}
```
#### 🔎 Field Notes
* `event_type` is either `product_access_granted` or `product_access_revoked`
* `type` indicates whether the access was `"granted"` (manual or free) or `"purchased"`
* `order_id` is `null` if the access wasn’t tied to a paid order
* `vendor` identifies the creator account that triggered the event
* `user` and `product` objects give context about who got access to what
⚠️ **Security notice**: Webhooks are currently **not signed**, so make sure to use a **non-guessable URL** (e.g. with a long random token) to prevent unauthorized access.
## ♻️ Resend Events
Webhooks are sent **only once** per event — no retries are performed automatically.
You can manually resend any access event from the **"Manage accesses"** section of your product.
