Webhooks

Webhooks

What Are Webhooks?

Webhooks send real-time HTTP notifications to your server when events happen in your account. This lets you integrate with external systems (CRMs, marketing tools, accounting software) without polling the API.

Creating a Webhook Endpoint

Go to Settings > Webhooks and click Add Webhook. Configure:

• URL — the HTTPS endpoint to receive notifications (required, must use HTTPS, max 2,048 characters)
• Events — select which events trigger this webhook (at least one required)

Available Events (13 total)

• contact.created — a new contact was created
• contact.updated — a contact was modified
• contact.deleted — a contact was deleted
• document.sent — a document was sent to its recipient
• document.viewed — a document was viewed by its recipient
• document.status_changed — a document’s status changed (e.g., draft to sent, sent to signed)
• signature.completed — a signature was completed on a document
• signature.declined — a signer declined to sign
• payment.recorded — a payment was recorded on a document
• form.submitted — a form submission was received
• record.created — a custom entity record was created
• record.updated — a custom entity record was updated
• record.deleted — a custom entity record was deleted

Advanced Configuration

Each webhook endpoint has additional settings:

• HTTP Method — POST (default), GET, PUT, PATCH, or DELETE
• Custom Headers — up to 20 key-value pairs added to every request (useful for API keys or authentication tokens on your receiving server)
• Payload Format — json (default) or form (URL-encoded)
• Include Event Data — when enabled (default), the full event payload is included. Disable to send only the event type and ID.
• Custom Payload — optional, a custom JSON template (max 10,000 characters) to override the default payload structure
• Timeout — how long to wait for a response (1–30 seconds, default 15)
• Max Retries — how many times to retry on failure (0–10, default 5)

Conditions

Add up to 10 conditions to filter when the webhook fires. Each condition checks a field in the event data:

• Field — dot-notation path into the event data (e.g., data.status, data.email)
• Operator — equals, not_equals, contains, not_contains, is_empty, is_not_empty
• Value — the value to compare against

Choose whether all conditions must match (AND logic) or any condition can match (OR logic). Default is all.

HMAC Signatures

Every webhook endpoint gets a unique signing secret (prefixed with whsec_). Each delivery includes an X-Webhook-Signature header containing an HMAC-SHA256 signature of the request body. Use this to verify the request came from the platform and wasn’t tampered with.

Delivery & Retries

Each webhook delivery is tracked with:

• HTTP response status code
• Response body (first 10 KB)
• Attempt number
• Request duration (in milliseconds)
• Delivery timestamp

If a delivery fails (non-2xx response or timeout), it is retried up to your configured max retries. Delivery statuses: Pending, Success, Failed.

Auto-Disable

After 10 consecutive failures, the webhook endpoint is automatically disabled to prevent continued failed requests. You can re-enable it from the webhooks page after fixing the receiving endpoint.

Webhook Statuses

• Active — webhook is listening and will fire on matching events
• Paused — manually paused, will not fire until resumed
• Disabled — auto-disabled after 10 consecutive failures