Webhook payload reference

For developers building a system that receives CoReceptionist webhooks. Webhooks is in beta: we will tell you before any change that could break an integration, and the api_version field changes when the format does.

How events are sentEach event is an HTTPS POST with a JSON body to the URL you configured. Every request carries these headers. X-CoReceptionist-Delivery is unique per delivery — use it to ignore a request you have already processed.

Request headers

POST /your/path HTTP/1.1
Content-Type: application/json
User-Agent: CoReceptionist-Webhooks/1.0 (+https://coreceptionist.co)
X-CoReceptionist-Event: visitor.checked_in
X-CoReceptionist-Delivery: 6acdc56ef38d945e9b0f53e7
X-CoReceptionist-Signature: t=1791869117,v1=5f2c…

Eventsvisitor.checked_in — a visitor checks in at a kiosk, is checked in from the dashboard, or a pre-registered or touchless visitor arrives. visitor.checked_out — self check-out at a kiosk, check-out by staff, or the nightly automatic check-out. delivery.received — a courier signs in a delivery at the kiosk. Each visitor in a group check-in gets their own event. Employee check-ins are not sent.

Example: visitor.checked_inThis is a real check-in at our demo company with the default settings, so photos, ID scans, citizenship and temperature answers are left out.

JSON body

{
  "id": "evt_6acdc56df38d945e9b0f53e5",
  "type": "visitor.checked_in",
  "api_version": "2026-10-13",
  "created_at": "2026-10-11T21:13:07.675Z",
  "test": false,
  "data": {
    "account": { "id": "6a59c05c06f7026b0243660f", "name": "Acme Corporation" },
    "location": {
      "id": "6a59c05c06f7026b0243660f",
      "name": "Acme Corporation",
      "address": { "street1": "10250", "street2": "Century City", "city": "Los Angeles",
                   "state": "California", "postal_code": "90067", "country": "United States" },
      "timezone": "America/Los_Angeles"
    },
    "visit": {
      "id": "6acbfbe34df218eb99bf1ff0",
      "visitor_uuid": "2fd86646-f906-40ce-b17c-7d42624dffb5",
      "visitor_type": { "id": "6a757ac54d06b0791aa190f8", "name": "Visitor Check-In", "category": "checkin" },
      "check_in_time": "2026-10-11T21:13:07.675Z",
      "check_out_time": null,
      "check_out_type": null,
      "check_in_device": { "id": "6a59c45e0bd250e152d8b36b", "name": "Front Desk iPad" },
      "check_out_device": null,
      "notes": null,
      "pre_registered": false
    },
    "visitor": {
      "first_name": "Bryce",
      "last_name": "Anderson",
      "full_name": "Bryce Anderson",
      "email": "bryce@example.com",
      "phone": "+15555550100",
      "company": "Orafox",
      "photo_url": null,
      "fields": [
        { "key": "business_name", "label": "Business Name", "type": "string", "value": "Orafox" }
      ]
    },
    "host": {
      "id": "6a59c26906f7026b02436698",
      "first_name": "Grant", "last_name": "Rios", "full_name": "Grant Rios",
      "email": "grant@example.com", "job_title": "Data Analyst"
    },
    "omitted": ["photos_and_id_scans", "citizenship_and_health_answers"]
  }
}

Fieldsaccount — the company account (for a single-location company it is the same as location). location — the site where the event happened, with its address and timezone. visit — the visit record: visitor type, check-in and check-out times in UTC (ISO 8601), check_out_type (self, manual or auto), and the kiosk used to check in and to check out (they can differ; check_out_device is null for a check-out from the dashboard or the nightly automatic check-out). visitor — name, email, phone, company, photo_url, and fields: every other sign-in answer with the label your form uses. host — the employee being visited, or null. delivery — on delivery.received only: carrier and message. omitted — data categories this webhook is not set to receive.

Photos, ID scans and sensitive answersWith Include photos and ID scans turned on, visitor.photo_url and ID-scan fields contain secure links that work for one hour from the moment that delivery is sent; download the file in that time if you need to keep it. With Include citizenship and health answers turned on, those answers appear in fields. When a category is off, it is listed in omitted instead. The visitor's signature and their visitor code are never sent.

Respond quicklyReply with any 2xx status within 10 seconds, then do slow work afterwards. Anything else — a different status, a timeout or no connection — is retried after 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours (six attempts in all). Reply 410 Gone to tell us to stop sending to that URL. Events can arrive out of order and, rarely, more than once — use the timestamps in visit and the X-CoReceptionist-Delivery header.

TIPUse Send test event on the Webhooks page while building — the sample uses your location's real name and sign-in form with a fictional visitor, and is marked "test": true.

Was this helpful?

Still stuck? Talk to a human

Schedule a demo Start your free trial