Cal.com BOOKING_CREATED webhook payload example

Cal.com · event: BOOKING_CREATED · content type: application/json

This is a representative sample — fake IDs, real structure. To see a payload with your data, point the provider at a capture URL (button below).

See it live, not frozen

One click creates a free capture bin with this exact payload already in it — pretty-printed, headers inspectable, replayable to your own endpoint:

Then paste the bin's URL into Cal.com's webhook settings to capture a real delivery. No signup.

Headers

content-type: application/json
x-cal-signature-256: 6f4e5f64f35197db8e7eb53ea435c67b65f2766e5b48ff74a715442e7453fe1e
x-cal-webhook-version: 2021-10-20

Body

{
  "triggerEvent": "BOOKING_CREATED",
  "createdAt": "2026-08-30T14:00:01.204Z",
  "payload": {
    "bookerUrl": "https://cal.com",
    "title": "30 Min Meeting between Ada Deveraux and Sam Carter",
    "startTime": "2026-09-02T15:00:00Z",
    "endTime": "2026-09-02T15:30:00Z",
    "additionalNotes": "Wants to talk about the webhook integration.",
    "type": "30min",
    "description": "",
    "eventTypeId": 4821,
    "hideCalendarNotes": false,
    "schedulingType": null,
    "organizer": {
      "id": 1042,
      "name": "Ada Deveraux",
      "email": "ada@acme.dev",
      "username": "ada",
      "timeZone": "Europe/Paris",
      "language": {
        "locale": "en"
      },
      "utcOffset": 120
    },
    "attendees": [
      {
        "email": "sam@example.com",
        "name": "Sam Carter",
        "timeZone": "America/New_York",
        "language": {
          "locale": "en"
        },
        "utcOffset": -240
      }
    ],
    "location": "https://app.cal.com/video/nGh8K2mPq4TzXvLd",
    "destinationCalendar": [
      {
        "id": 2201,
        "integration": "google_calendar",
        "externalId": "ada@acme.dev"
      }
    ],
    "uid": "nGh8K2mPq4TzXvLdWc7RbYe3",
    "conferenceCredentialId": null,
    "iCalUID": "nGh8K2mPq4TzXvLdWc7RbYe3@Cal.com",
    "eventTitle": "30 Min Meeting",
    "length": 30,
    "bookingId": 91834,
    "status": "ACCEPTED",
    "metadata": {
      "videoCallUrl": "https://app.cal.com/video/nGh8K2mPq4TzXvLd"
    }
  }
}

Things that bite people

This example's signature actually verifies: plain hex HMAC-SHA256 of the raw body with the webhook secret — here cal_wh_sample_secret_Vd8mQ2xTk5p. Paste body + header value into the signature debugger (generic scheme), or set the same secret on a capture bin for a live ✓/✗ badge.
No sha256= prefix. Cal.com's sender (createWebhookSignature in sendPayload.ts) emits the bare hex digest; several third-party references — including AI-generated ones — show a sha256=-prefixed value, and comparing against that never matches. If no secret is configured, the header is the literal string no-secret-provided.
Most triggers wrap fields as { triggerEvent, createdAt, payload }, but MEETING_STARTED / MEETING_ENDED are flat — booking fields sit at the top level with no payload wrapper. Payloads are versioned via the x-cal-webhook-version header.
Cal.com SaaS rejects subscriber URLs that are HTTP, localhost, or private/internal IPs — so you can't point it at your dev machine directly; relay to localhost instead. The sender also uses redirect: "manual", so a 301/302 from your endpoint is a failed delivery, not a follow.
If a custom payload template is set on the webhook, this entire structure is replaced by the rendered template ({{title}}, {{organizer.name}}, …) — your handler sees whatever the template produced, and the signature covers those bytes instead.

Send it yourself

Reproduce this delivery against any endpoint (your handler, a bin, staging):

$ curl -X POST https://your-endpoint.example/hook \
  -H 'content-type: application/json' \
  -H 'x-cal-signature-256: 6f4e5f64f35197db8e7eb53ea435c67b65f2766e5b48ff74a715442e7453fe1e' \
  -H 'x-cal-webhook-version: 2021-10-20' \
 -d '{
  "triggerEvent": "BOOKING_CREATED",
  "createdAt": "2026-08-30T14:00:01.204Z",
  "payload": {
    "bookerUrl": "https://cal.com",
    "title": "30 Min Meeting between Ada Deveraux and Sam Carter",
    "startTime": "2026-09-02T15:00:00Z",
    "endTime": "2026-09-02T15:30:00Z",
    "additionalNotes": "Wants to talk about the webhook integration.",
    "type": "30min",
    "description": "",
    "eventTypeId": 4821,
    "hideCalendarNotes": false,
    "schedulingType": null,
    "organizer": {
      "id": 1042,
      "name": "Ada Deveraux",
      "email": "ada@acme.dev",
      "username": "ada",
      "timeZone": "Europe/Paris",
      "language": {
        "locale": "en"
      },
      "utcOffset": 120
    },
    "attendees": [
      {
        "email": "sam@example.com",
        "name": "Sam Carter",
        "timeZone": "America/New_York",
        "language": {
          "locale": "en"
        },
        "utcOffset": -240
      }
    ],
    "location": "https://app.cal.com/video/nGh8K2mPq4TzXvLd",
    "destinationCalendar": [
      {
        "id": 2201,
        "integration": "google_calendar",
        "externalId": "ada@acme.dev"
      }
    ],
    "uid": "nGh8K2mPq4TzXvLdWc7RbYe3",
    "conferenceCredentialId": null,
    "iCalUID": "nGh8K2mPq4TzXvLdWc7RbYe3@Cal.com",
    "eventTitle": "30 Min Meeting",
    "length": 30,
    "bookingId": 91834,
    "status": "ACCEPTED",
    "metadata": {
      "videoCallUrl": "https://app.cal.com/video/nGh8K2mPq4TzXvLd"
    }
  }
}'

← All payload examples · Signature debugger · Docs