# Integrations
> Send booking events to Zapier, Make, Slack, a CRM or a door lock with webhooks, and connect other tools through the Session API.
Who can do this: admins only.
## Connect to other tools
Webhooks notify any URL when something happens in Session. Zapier and Make can route them to Mailchimp, Slack, a Google Sheet, a CRM or a door lock, with no code.
To see your sessions in Google Calendar, Apple Calendar or Outlook, you don't need a webhook: each team member can add a [calendar link](/docs/calendar-feed) from **My account**.
## Setting up a webhook
Add webhooks from [Settings → Data](/go/admin/settings/data), up to 10 per venue, each with its own URL and events.
1. In the Integrations section, click **Add webhook**
2. Paste your endpoint URL, add a description, select the events you want, and click **Create endpoint**
3. Copy the **signing secret**. It isn't shown again; if you lose it, open the webhook and click **Regenerate secret**
Session sends a JSON POST to your URL each time one of those events fires. The `X-Webhook-Signature` header is a hex HMAC-SHA256 of the request body, signed with your secret.
If your endpoint doesn't answer with a 2xx status within 10 seconds, Session tries again - up to 5 attempts in all, over roughly three hours - and then marks the delivery failed.
## Available events
- `contact.created` - a new user or guest signs up
- `contact.updated` - a profile changes
- `booking.created` - a booking is confirmed, online or from the admin, or a cancelled booking is restored
- `booking.updated` - a booking is rescheduled or its spaces change, with a `changes` list (`rescheduled`, `spaces`) and a `previous` block of the old values
- `booking.cancelled` - a booking is cancelled
- `membership.created` - a new membership subscription starts
- `membership.cancelled` - a membership is cancelled (it stays active until the period ends)
- `membership.expired` - a membership fully ends
- `session.attended` - a session has ended, with who checked in and who was a no-show
- `voucher.purchased` - someone buys a gift voucher
## Reading a booking event
- `id` - the booking's permanent identifier. Use it to match events, not `reference_code` (the `BK-XXXXXX` reference your customer sees).
- `payment_status` - `completed` when the booking was paid for, `not_required` when nothing was charged.
- `created_by_admin` - `true` when your team added the booking, `false` when the customer booked online.
- `payment_method` - `card_terminal`, `cash`, `bank_transfer` or `other` when you took payment yourselves; empty for online payments and free bookings.
- `amount_paid`, `unit_price`, `discount_amount`, `refund_amount` - in minor units, so `2500` is £25.00. The customer actually paid `amount_paid` minus `refund_amount`.
- `currency` - the three-letter code in capitals (`GBP`, `AUD`, `EUR`).
`booking.created` also fires for free bookings, such as ones covered by a membership or bundle. To count sales, count only events where `payment_status` is `completed` and `created_by_admin` isn't `true`, and ignore any `id` you've already counted, because a retried delivery can arrive twice.
## Tracking ad conversions
Booking events carry an `attribution` object, so you can send paid bookings back to Google Ads or Meta as conversions:
- `click_id` and `click_id_kind` - the ad click id the customer arrived with: `gclid`, `gbraid`, `wbraid` or `fbclid`.
- `utm_source`, `utm_medium`, `utm_campaign`, `utm_content`.
- `referrer_host` - the site they came from.
- `entry_point` - `booking_page` or `embed`.
Point your ad at your booking page or a page with the [booking widget](/docs/embed). To upload Google Ads conversions without code, see [Google Ads conversion tracking](/docs/google-ads). `attribution` is empty for bookings your team adds, imported bookings, and bookings with no source. `utm_term` and Google Analytics client ids aren't kept.
## Door access and locks
- **Kisi**: connect it directly and every booking gets an **Open the door** button. See [Kisi door access](/docs/kisi-door-access).
- **A connected lock** (with an app or API): use `booking.created` to open the lock or issue a time-limited code for the booking's start and end, `booking.updated` with `rescheduled` to move it, and `booking.cancelled` to close it. The lock platform sends any code itself, after Session's confirmation.
- **A standalone keypad**: put one shared code in the session's **Visit instructions** (under **Messages** in the session editor), which only people who have booked see. Change it now and then, and don't share one for [private hire](/docs/private-sessions).
Session doesn't control heaters. Check with your installer that anyone inside can always get out, even if the power fails.
## The API
The API lets another tool **create a discount code** (optionally restricted to certain sessions or booking types), **read a day's sessions** with capacity, who's booked, waiver status and add-ons, and **record attendance**.
It needs a developer to wire up. Keys are issued per venue and only work on your venue's data. Get in touch and we'll issue one with the endpoint documentation; contact us to replace it if it's exposed.
Call the API on `bookasession.org`, not `www.bookasession.org`. The `www` address redirects, which drops the body of a POST request, so the call silently does nothing.
## Connect an AI assistant
To ask Claude about your reports and schedule, see [Connect Claude](/docs/connect-ai). It needs no developer and no API key.
## Common questions
1. **My endpoint isn't receiving anything.** Fire a test event with the send icon in the integrations table, then check the history icon. No attempt at all means you didn't subscribe to that event.
2. **A customer checked out twice for the same session - do I get two `booking.created` events?** No. The second checkout adds spaces to their existing booking, so you get a `booking.updated` with `changes: ["spaces"]`.
3. **Which smart lock works with Session?** We don't recommend a brand. Look for remote control (an app, an API, or Zapier and Make) and time-limited codes.