Set Up Outbound Webhook Delivery

Quick Setup

Most hotels finish this in 5 to 10 minutes.

This guide helps you send a JSON guest_verified event after guest verification and PMS sync.

Go to: Settings → Outbound Webhook

Signature header

Every delivery includes X-Vouch-Signature. Your receiver should validate that header before trusting the payload.

Sensitive values

Anyone with access to this page can see saved header values and the HMAC signing secret. Delivery logs show full request payloads and response details. Audit change records continue to redact these values. Protect access to Settings → Outbound Webhook and avoid sharing screenshots.

Quick Reference

Setting	What It Controls	What You See
Enabled	Turns outbound webhook delivery on or off	The toggle stays on after you save
Webhook URL	The destination URL for deliveries	AVA accepts your receiver URL
Headers	Static auth headers for your receiver	Saved values remain visible after save
Payload Fields	Which guest fields are sent	Only checked fields appear in deliveries
Marketing consent	Top-level marketingConsent inclusion	Status card shows Included or Omitted
Max attempts	Retry count for failed deliveries	The value stays between 1 and 10
HMAC signing secret	Payload signing for each delivery	Saved value remains visible; required when enabled or testing
Send Test	Sends one test delivery	The latest test appears in Delivery Logs
Delivery Logs	Recent delivery status and payloads	You see 10 records per page, plus status, attempts, HTTP status, response body, payload details, and page navigation

Before You Start

Confirm these basics:

• You have settings:write permission
• You know the receiver URL
• You know any static auth headers
• You have an HMAC signing secret
• You know which guest fields the receiver needs

Saved secret values

Saved header values and the HMAC signing secret remain visible after you save. Enter a new value when you need to rotate a secret.

When It Sends

AVA sends the webhook after guest verification succeeds. The event name is guest_verified. AVA does not send the webhook if PMS sync fails.

The request uses JSON POST. AVA includes your static headers on every delivery.

Configure the Webhook

Turn It On

1. Go to Settings → Outbound Webhook.

2. Turn on Enabled.

3. Enter the Webhook URL.

4. Click Save.

   ✓ AVA stores the endpoint for future deliveries.

Add Custom Headers

Use headers when your receiver expects static authentication. AVA sends them on every JSON POST. For example, you can send Authorization: token api_key:api_secret.

1. Click Add.

2. Enter the header name.

3. Enter the header value.

4. Turn on Secret for sensitive values.

5. Click Save.

   ✓ Saved header values remain visible after save.

Choose Payload Fields

Select the fields your receiver needs from the Payload Fields card. The catalog includes reservation fields and all fields from Settings → Check-In → Registration Form. Marketing consent is not part of this checklist.

1. Check each field you want to send.

2. Clear any field your receiver does not need.

3. Click Save.

   ✓ Only checked fields appear in future deliveries.

Payload Fields Available

Group	Field in AVA	JSON property
Reservation	Confirmation number	reservation.confirmationNumber
Reservation	Arrival date	reservation.arrivalDate
Reservation	Departure date	reservation.departureDate
Guest	First name	guest.firstName
Guest	Last name	guest.lastName
Guest	Email	guest.email
Guest	Phone	guest.phone
Guest	Nationality	guest.nationality
Guest	Document number	guest.documentNumber
Guest	Date of birth	guest.birthDate
Guest	Postal code	guest.postalCode
Guest	Country of residence	guest.countryCode
Guest	Address	guest.addressLine
Guest	City	guest.cityName
Guest	State or province	guest.stateProv
Guest	Purpose of stay	guest.purposeOfStay
Guest	Estimated arrival time	guest.preCheckInTime
Guest	Gender	guest.gender
Guest	Occupation	guest.occupation
Guest	Place of departure	guest.placeOfDeparture
Guest	Next destination	guest.nextDestination
Guest	Departure time	guest.departureTime

If a selected field is blank, AVA may omit that property from the JSON. Purpose of stay and Estimated arrival time can use saved check-in values. AVA combines address parts for Place of departure and Next destination. If guests choose their current address, AVA uses that address for the destination.

Check Marketing Consent Status

The Marketing consent card shows four values:

• Guest prompt — whether guests see the marketing opt-in
• Collection setting — the consent model used by your PMS
• Registration field — whether Marketing consent is visible
• Webhook payload — whether AVA includes marketingConsent

The Payload Fields checklist does not change these values.

1. Go to Settings → Check-In → Card & Consent.

2. For detailed consent, enable Promotional Mailing List.

3. For generic consent, enable Show marketing email opt-in during signature.

4. Go to Settings → Check-In → Registration Form.

5. Set Show to to All guests for Marketing consent.

6. Save both settings pages.

   ✓ The status card shows Included when both prerequisites are ready. ✓ AVA sends true or false, based on the guest's choice.

AVA omits marketingConsent when the opt-in is disabled or the field is hidden. Phone and email contact consent do not enable marketing consent by themselves.

Set Retry Attempts and Signing Secret

Use retries for temporary delivery failures. Set the signing secret so your receiver can verify each payload.

1. Enter a value in Max attempts.

2. Use a value from 1 to 10.

3. Enter your HMAC signing secret.

4. Click Save.

   ✓ AVA retries 429, 5xx, and timeout failures. ✓ Validation and authentication errors stay in the log without retry.

Replace a Saved Secret

Use this when a header secret or signing secret already exists. The current saved value appears directly in its field.

1. Select the current value in the header or HMAC field.

2. Enter the new value.

3. Click Save.

   ✓ The new value appears after save and applies to future deliveries.

Send a Test Delivery

Use a test delivery after you save your settings. The test uses the latest saved configuration. It also uses the saved HMAC signing secret.

1. Click Send Test.

2. Wait for the success message.

3. Open Delivery Logs to confirm the new row appears.

   ✓ The newest row shows test delivery.

Save first

If you change anything on the page, save before you send a test. AVA disables the test button until saved changes are cleared.

Review Delivery Logs

Delivery logs help you check recent attempts. Each page shows 10 rows. Each row shows the delivery status, timestamp, attempts, HTTP status, and details. You can also open the full request payload and response body. Use the page controls to move between older and newer deliveries.

Status	What It Means
delivered	The receiver accepted the delivery
processing	AVA is still handling the delivery
retrying	AVA will try again later
pending	AVA has queued the delivery
failed	AVA stopped retrying the delivery

1. Click Refresh delivery logs to reload the current page.

2. Use First page, Previous, Next, or Last page when there are more results.

3. Open a row to review the response details.

4. Expand View request payload if you need the sent JSON.

5. Expand View response to inspect the receiver's exact response body.

   ✓ The page counter shows Page X of Y when multiple pages exist. ✓ The controls stay available until you reach the first or last page.

Sensitive log details

Delivery logs show the exact request payload and response body returned by your receiver. Payloads can include guest data, so expand details only when troubleshooting.

Troubleshooting

The page will not load

What you see: You see Unable to load outbound webhook settings.

Fix:

1. Click Retry.
2. Refresh the page.
3. Confirm you are in the correct property.
4. Try again after signing in again if needed.

Save fails when you enable the webhook

What you see: Save fails after you turn on Enabled.

Fix:

1. Enter an HMAC signing secret.
2. Save again.
3. If you already had one, replace it instead of clearing it.

Send Test stays disabled

What you see: Send Test is disabled after you edit the page.

Fix:

1. Click Save first.
2. Wait for the success message.
3. Try Send Test again.
4. Confirm you have settings permission.

The webhook URL is rejected

What you see: Save or test fails for some destination URLs.

Fix:

1. Use a public HTTPS URL.
2. Remove private, reserved, loopback, and site-local addresses.
3. Try again with a public receiver.

Delivery logs stay empty

What you see: Delivery Logs shows no rows yet.

Fix:

1. Click Send Test.
2. Wait for a guest verification event.
3. Click Refresh delivery logs.
4. Check the page counter and page controls if you expect older deliveries.
5. Check again after the next qualifying check-in.
6. Use Last page if you need to jump to older deliveries quickly.

New registration fields are missing

What you see: A registration field does not appear in Payload Fields.

Fix:

1. Refresh Settings → Outbound Webhook.
2. Confirm the page loaded without an error.
3. Check the field against the Payload Fields Available table above.
4. Open Settings → Check-In → Registration Form.
5. Set Show to to All guests if guests must provide its value.
6. Save the registration form and reload the webhook page.

Visibility controls guest data collection. It does not control whether the field appears in the webhook catalog.

Marketing consent is missing from the payload

What you see: The webhook does not include marketingConsent.

Fix:

1. Open Settings → Check-In → Card & Consent.
2. Enable the correct guest-facing marketing opt-in.
3. Open Settings → Check-In → Registration Form.
4. Set Show to to All guests for Marketing consent.
5. Save both settings pages.
6. Confirm the status card shows Included.
7. Complete a new guest verification.

AVA omits this property when guests cannot see the opt-in or field. Contact support if the setting is visible but the property remains missing.

Still Stuck?

Contact success@vouch-technologies.com if:

• ❌ The page still does not load after retrying
• ❌ Save fails after you add an HMAC signing secret
• ❌ Test deliveries do not appear in the logs

Include:

• The receiver URL you are using
• Any header names you added
• A screenshot of the Delivery Logs card with secrets and guest data redacted

Related Guides

• Registration Fields
• Registration Card Disclaimer
• Set Up Push Notifications