Look-ups that apply
across all four products.

The API prefix is /api/v1 and appears once — e.g. {API_BASE_URL}/api/v1/partner/jobs.

Auth models

Three, depending on what you're calling. You never hold a parent's credential in any of them.

Response envelope

All API responses are wrapped in a data envelope with a timestamp:

{ "data": { /* payload */ }, "timestamp": "2026-08-06T17:57:02.785Z" }

Request shape

POST /your/webhook/path
Content-Type: application/json
X-TGG-Signature: t=1780000000,v1=9f86d081884c7d659a2feaa0c55ad015a3bf4f1b...
X-TGG-Event-Type: offer.accepted
X-TGG-Delivery-Id: 3f2a9c10-1111-4222-8333-444455556666

{
  "id": "3f2a9c10-1111-4222-8333-444455556666",
  "type": "offer.accepted",
  "data": { /* event-specific payload */ },
  "createdAt": "2026-08-06T17:12:04.001Z"
}

Verifying the signature

X-TGG-Signature is t=<unix seconds>,v1=<hex>, where the hex is an HMAC-SHA256 over the exact string <t>.<raw request body> keyed with your webhook secret. Verify against the raw body — re-serializing the JSON changes the bytes and breaks the check.

const crypto = require('crypto');

function verifyTggWebhook(rawBody, signatureHeader, secret, toleranceSec = 300) {
  const parts = {};
  for (const kv of signatureHeader.split(',')) {
    const i = kv.indexOf('=');
    parts[kv.slice(0, i).trim()] = kv.slice(i + 1).trim();
  }

  // Reject replays.
  const age = Math.abs(Math.floor(Date.now() / 1000) - Number(parts.t));
  if (!Number.isFinite(age) || age > toleranceSec) return false;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${parts.t}.${rawBody}`)
    .digest('hex');

  const a = Buffer.from(expected, 'utf8');
  const b = Buffer.from(parts.v1 ?? '', 'utf8');
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

Event types

Registration has no webhooks — in the embedded drawer you get the in-page booking-complete callback instead. Registration webhooks are on the roadmap alongside booking writes.

Delivery & retries

That table is exactly what GET {API_BASE_URL}/api/v1/pp/org/{organization_id}/config returns, so you can inspect what's set for your org rather than asking. It's live in production and authenticated as a parent — call it with a signed-in session, not a partner key.

Configured elsewhere, not on that endpoint

Customization limits

The honest answer to "how much can I change?", surface by surface. Deeper white-labeling than what's listed is a conversation, not a config flag — but it's a conversation we have regularly.

Copy isn't a column because the answer is the same everywhere: all event-facing text — titles, descriptions, policies, custom questions, FAQs — comes from your own event data on every surface. Only the surrounding UI chrome is ours, and it's localized.

Questions worth answering before you start

1. Whose domain should rank in search? If yours, you need fragments or the event API — an overlay drawer is invisible to crawlers by design, and our hosted pages earn the credit for us.
2. Who handles "I need to change my registration"? If you don't want that queue, the parent portal isn't optional.
3. Do you want to be in payments? If not, keep the transaction in the drawer. It's the single largest scope reduction available to you.
4. Do you need clearance to be portable? Ours already is. Rebuilding it means re-collecting documents your users have already provided elsewhere.
5. How much of this is your differentiator? Go API on that one; let us run the rest.