Developer API

Authorization: Bearer cs_your_api_key_here

{
  "event": "member.joined",
  "gym_id": "abc-123",
  "data": { ... },
  "timestamp": "2026-04-16T12:00:00.000Z"
}

const crypto = require('crypto');

function verifyWebhook(body, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(body) // raw JSON string, not parsed
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

{
  "event": "member.joined",
  "gym_id": "gym_abc123",
  "data": {
    "user_id": "user_xyz789"
  },
  "timestamp": "2026-04-16T14:30:00.000Z"
}

{
  "event": "member.left",
  "gym_id": "gym_abc123",
  "data": {
    "user_id": "user_xyz789"
  },
  "timestamp": "2026-04-16T14:30:00.000Z"
}

{
  "event": "payment.received",
  "gym_id": "gym_abc123",
  "data": {
    "user_id": "user_xyz789",
    "plan_id": "plan_456",
    "amount_cents": 9900
  },
  "timestamp": "2026-04-16T14:30:00.000Z"
}

{
  "event": "session.logged",
  "gym_id": "gym_abc123",
  "data": {
    "user_id": "user_xyz789",
    "session_id": "sess_001",
    "session_type": "no-gi",
    "date": "2026-04-16",
    "duration_mins": 90
  },
  "timestamp": "2026-04-16T14:30:00.000Z"
}

{
  "event": "attendance.checked_in",
  "gym_id": "gym_abc123",
  "data": {
    "user_id": "user_xyz789",
    "attendance_id": "att_001",
    "status": "approved"
  },
  "timestamp": "2026-04-16T14:30:00.000Z"
}

{
  "event": "class.scheduled",
  "gym_id": "gym_abc123",
  "data": {
    "schedule_id": "sched_001",
    "title": "Advanced No-Gi",
    "discipline": "no-gi",
    "day_of_week": 2,
    "start_time": "18:00"
  },
  "timestamp": "2026-04-16T14:30:00.000Z"
}

{
  "event": "lead.created",
  "gym_id": "gym_abc123",
  "data": {
    "lead_id": "lead_001",
    "first_name": "John",
    "last_name": "Doe",
    "source": "zapier"
  },
  "timestamp": "2026-04-16T14:30:00.000Z"
}

{
  "event": "contract.signed",
  "gym_id": "gym_abc123",
  "data": {
    "contract_id": "contract_001",
    "user_id": "user_xyz789"
  },
  "timestamp": "2026-04-16T14:30:00.000Z"
}

{ "error": "Human-readable error message" }

const API_KEY = "cs_your_key_here";
const BASE    = "https://combatscore.app";

// Poll for new members
const members = await fetch(`${BASE}/api/zapier/triggers?type=new_member`, {
  headers: { Authorization: `Bearer ${API_KEY}` },
}).then(r => r.json());

// Create a lead
const lead = await fetch(`${BASE}/api/zapier/actions?type=create_lead`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    first_name: "Jane",
    last_name: "Doe",
    email: "jane@example.com",
  }),
}).then(r => r.json());

import requests

API_KEY = "cs_your_key_here"
BASE    = "https://combatscore.app"
HEADERS = {"Authorization": f"Bearer {API_KEY}"}

# Poll for new members
members = requests.get(
    f"{BASE}/api/zapier/triggers",
    params={"type": "new_member"},
    headers=HEADERS,
).json()

# Create a lead
lead = requests.post(
    f"{BASE}/api/zapier/actions",
    params={"type": "create_lead"},
    headers={**HEADERS, "Content-Type": "application/json"},
    json={"first_name": "Jane", "last_name": "Doe", "email": "jane@example.com"},
).json()

require "net/http"
require "json"
require "uri"

API_KEY = "cs_your_key_here"
BASE    = "https://combatscore.app"

# Poll for new members
uri = URI("#{BASE}/api/zapier/triggers?type=new_member")
req = Net::HTTP::Get.new(uri)
req["Authorization"] = "Bearer #{API_KEY}"
res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(req) }
members = JSON.parse(res.body)

const express = require("express");
const crypto  = require("crypto");

const app = express();
app.use(express.json({ verify: (req, _res, buf) => { req.rawBody = buf; } }));

const WEBHOOK_SECRET = "your_webhook_secret";

app.post("/webhooks/combatscore", (req, res) => {
  const signature = req.headers["x-combatscore-signature"];
  const expected  = crypto.createHmac("sha256", WEBHOOK_SECRET)
    .update(req.rawBody)
    .digest("hex");

  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    return res.status(401).send("Bad signature");
  }

  const { event, data } = req.body;
  console.log("Received event:", event, data);

  res.sendStatus(200);
});

app.listen(3000);

https://combatscore.app/openapi.json