Webhooks

Send GymMaster events to your system immediately

A webhook is a message that GymMaster sends to your system when an event occurs. For example, GymMaster can tell your system when a member checks in, when a member gets a new membership, or when a payment fails.

GymMaster sends each message as an HTTPS request to a URL that you supply. Your system receives the message and does the action that you want. You do not need to ask GymMaster for changes again and again.

This page contains technical information. Your web developer or IT specialist must do the work on the system that receives the webhooks. GymMaster staff can answer questions, but we do not write the receiving system for you.

How webhooks work

• An event occurs in GymMaster. For example, a staff member adds a member.
• The GymMaster database records the event.
• The GymMaster webhook service finds each URL that must receive this event type for this club.
• The webhook service sends the event to each URL as an HTTP POST request with a JSON body.
• If the delivery fails, the webhook service tries again later. Refer to Delivery and retries.

GymMaster records events in the database, not in each screen of the application. Thus, GymMaster sends the event for each change, for example a change from the staff application, the member portal, the member app, an import, or the API.

The webhook service operates separately from the GymMaster application. A slow receiving system does not make GymMaster slow.

Before you start

You must have:

• Admin access to Settings. Without this access, you cannot open the Webhook Manager.
• A URL on your system that can receive an HTTP POST request with a JSON body. Use an HTTPS URL.
• A plan for what your system must do with each event.

GymMaster sends events only to URLs that exist when the event occurs. GymMaster does not send events that occurred before you added the URL.

Add a webhook endpoint

• Go to Settings > Integrations.
• Find Webhook Manager and click Webhook Manager.
• Click Add.
• In URL, type the full URL of your receiving system. For example, https://example.com/gymmaster/webhook.
• In Event Type, select one or more events. Refer to Events.
• In Club, select one or more clubs. GymMaster sends events only for the clubs that you select.
• Optional: in Secret Token, type a long random value. Refer to Secret token.
• Click Save.

You can add more than one URL. Each URL can receive different events for different clubs.

Change an endpoint: Click the pencil button in the row of the endpoint. Change the values. Click Save.

Delete an endpoint: Click the X button in the row of the endpoint. Click Delete to confirm. GymMaster stops sending new events to that URL immediately.

Send a test webhook

Use the Test Send section on the Webhook Manager page to make sure that your system receives webhooks correctly.

• Select an event type.
• Click Send.
• Look at the table below the button. It shows the status of each test delivery.
• Click View payload to see the data that GymMaster sent.

The Test Webhook event type sends a basic message to all of your URLs. All other event types send a test message only to the URLs that receive that event type. These tests use the most recent record in your database as test data. For example, the Member Add test uses the newest member. If your database does not have the necessary data, the test fails. Then use the Test Webhook event type.

Each test message contains "test_webhook": true in the payload. Make sure that your system does not do real actions for test messages.

Events

GymMaster sends events only for the clubs that you select. The companyid field in each payload is the ID of the club.

Notes:

• member_update: GymMaster sends a maximum of one event for each member in each save. Changes to fields that only GymMaster uses do not cause an event.
• member_checkin: Only door check-ins cause this event. Check-ins to a class or service cause the booking_checkin event.
• access_code is 1 when GymMaster gives access. Other values tell you that GymMaster denied access. access_state gives the reason as text, for example Granted.
• booking_type is one of SERVICE, CLASS, CLASS_ATTENDEE, GROUP, GROUP_ATTENDEE or MEETING.
• Dates have the format YYYY-MM-DD.

Request format

GymMaster sends each webhook as an HTTP POST request.

Headers:

• Content-type: application/json
• X-Gymmaster-Token: <your secret token>. GymMaster sends this header only if you set a secret token.

Body:

{
	"event_id": 338514,
	"event_type": "membership_cancel",
	"event_timestamp": "2026-05-22T19:28:10.472+12",
	"processed_at": "2026-05-22T19:28:25.608+12",
	"payload": {
		"memberid": 9226,
		"membershipid": 18803,
		"membership_end_date": "2026-06-30",
		"companyid": 4
	}
}

Times have the ISO 8601 format and include the time zone of your GymMaster site. The difference between event_timestamp and processed_at tells you about delays in the delivery.

The payload contains IDs, not all of the details. To get more data, use the IDs with the GymMaster Staff API. Refer to Settings > Integrations > Staff API.

Secret token

A secret token lets your system make sure that a request comes from GymMaster.

• GymMaster sends the token in the X-Gymmaster-Token header of each request.
• You can set a token only for an HTTPS URL. GymMaster does not send the token over HTTP.
• After you save the token, you cannot see it again on the Webhook Manager page. Keep a copy in a safe location.

Your system must compare the header with the token that you saved. If the header is missing or different, your system must not accept the request. Send a 401 response.

To change the token, edit the endpoint and type a new token. Change the token on your system at the same time.

Delivery and retries

GymMaster thinks that a delivery is successful when your system sends a 2xx response.

GymMaster thinks that a delivery failed when:

• GymMaster cannot connect to your URL.
• Your system sends a 4xx or 5xx response.
• Your system does not send a response in 10 seconds.

When a delivery fails, GymMaster tries again. The time between tries increases:

After 8 failed tries, GymMaster stops. GymMaster also stops if more than 12 hours pass without a try. GymMaster does not send that event again.

Guidance for your receiving system

Use these rules when you make the system that receives webhooks.

Send a response quickly. Send a 2xx response immediately after you receive the request. Do slow work after the response, for example in a queue. If your system takes more than 10 seconds, GymMaster thinks that the delivery failed and sends the event again.

Make sure that you do not do an action two times. GymMaster can send the same event more than one time. For example, this occurs when your system does the work but sends the response too late. Keep the event_id of each event that you process. If you receive an event_id again, send a 2xx response and do nothing.

Do not use the order of arrival. GymMaster sends events in parallel and tries failed events again later. Thus, events can arrive in a different order from the order in which they occurred. Use event_timestamp to put events in the correct order.

Get the current data from the API. The payload contains IDs. Use the Staff API to get the current data, for example the name and email address of the member. The data can change between the event and your API request.

Accept new fields. GymMaster can add fields to the payload. Your system must ignore fields that it does not know.

Do not do real actions for tests. If the payload contains "test_webhook": true, the message is a test.

Use HTTPS and a secret token. Webhooks contain member IDs and payment information. Use an HTTPS URL and set a secret token. Do a check of the token in each request.

Monitor failures. Record each request that your system receives and each error. If your system is not available for more than 12 hours, you lose the events from that time. To find changes that you did not receive, use the Staff API or a report.

Troubleshooting

The test shows “Failed”. Look at the HTTP status and the error in the Details column. Make sure that the URL is correct and that your system is available from the internet. Make sure that your system sends a 2xx response.

The test shows “Timed out”. Your system did not send a response in 10 seconds. Send the response before you do slow work.

The test fails for a specific event type. Your database possibly does not have the necessary data. Try the Test Webhook event type.

I do not receive events for a club. Edit the endpoint. Make sure that the club and the event type are selected.

I receive the same event two times. This is normal after a retry. Use the event_id to find and ignore duplicates.

The payload contains fields that this page does not show. Some sites have a changed payload. Ignore the fields that you do not need.

If you cannot find the answer, contact our support team.

Related pages

• Integrations
• Setting up Zapier with GymMaster