Repull
DocumentationStudioAPI ReferenceBuild with AIChannelsKnowledge BaseWebhooks

reservation.request.updated

A booking request stopped waiting on you: accepted, declined, expired or voided.

When it fires

Fires when Airbnb reports the outcome, whoever acted and wherever: you through the API or the Airbnb app, the guest withdrawing, or Airbnb itself. requestStatus is accepted (it is now a booking and reservation.created fires too), declined, expired or voided (withdrawn by the guest, or voided by Airbnb, for example after failed verification). sourceStatus keeps Airbnb's own value and previousAttributes shows what changed.

Payload

Every delivery uses the same outer envelope (event, eventId, apiVersion, timestamp, data). Dedupe on eventId — it stays stable across retries and replays, while the X-Repull-Delivery-Id header changes on every attempt.

{
  "event": "reservation.request.updated",
  "eventId": "3f1c9a2e-8b7d-4c6a-9e0f-1a2b3c4d5e6f",
  "apiVersion": "2026-04",
  "timestamp": "2026-05-01T12:34:56.000Z",
  "data": {
    "object": {
      "id": "236354",
      "uid": "HMT3X9KQZ2",
      "channel": "airbnb",
      "listingId": "23892",
      "customerId": "1",
      "checkinDate": "2026-10-02",
      "checkoutDate": "2026-10-06",
      "status": "confirmed",
      "cancellationPolicy": "firm_14",
      "checkInTime": "16:00",
      "checkOutTime": "10:00",
      "checkIn": "2026-10-02",
      "checkOut": "2026-10-06",
      "platform": "airbnb",
      "confirmationCode": "HMT3X9KQZ2",
      "primaryGuest": {
        "id": "231877",
        "firstName": "Jordan",
        "lastName": "Ellis",
        "language": "en-US"
      },
      "createdAt": "2026-09-22T09:00:00.000Z",
      "updatedAt": "2026-09-22T11:42:10.000Z",
      "bookedAt": "2026-09-22T09:00:00.000Z"
    },
    "requestStatus": "accepted",
    "previousAttributes": {
      "status": "pending"
    },
    "sourceStatus": "accept",
    "occurredAt": "2026-09-22T11:42:10.000Z",
    "revision": "2026-09-22T11:42:10.000Z"
  }
}

Verifying signatures

Every delivery includes a timestamped X-Repull-Signature header of the form t=<unix_ts>,v1=<hex>, where v1 is HMAC-SHA256(signing_secret, `${t}.${raw_body}`). Verify it before processing — see Verify Signatures for full Node.js and Python examples.

Use the raw body

Sign the raw request body exactly as received, not a re-stringified JSON object. Re-serialisation can reorder keys or change whitespace and break the signature.

Common patterns

  • Close the request in your own system on any requestStatus; only accepted means the dates are now booked.
  • Deduplicate on eventId: an accepted request also arrives as reservation.created, which is the event to create the booking from.
  • A request that lapses without Airbnb saying so fires no event. GET /v1/reservations still reports it as cancelled with statusDetail: "request_expired", so if you track deadlines, schedule your own check at respondBy.

Related

Tip: Acknowledge with a 2xx status within 10 seconds. Failed deliveries are retried up to 5 times with exponential backoff.Webhook reliability →

AI