Webhooks

Overview

Webhooks let your application receive real-time notifications when events happen in SpitShake. Instead of polling the API, SpitShake sends an HTTP POST request to your configured endpoint whenever a relevant event fires. Each webhook delivery includes a JSON payload describing the event, a cryptographic signature for verification, and a unique delivery ID for deduplication.

Supported Events

SpitShake emits 14 event types across four resource categories:

Form Events

Triggered when a submitter interacts with a signing form.

Event	Description
`form.created`	A new signing form was generated and assigned to a submitter.
`form.started`	The submitter began filling out the form (first field interaction).
`form.viewed`	The submitter opened the signing link.
`form.completed`	The submitter finished and submitted the form.
`form.declined`	The submitter declined to sign the document.
`form.expired`	The form’s expiration date passed without completion.
`signing.complete`	Identity-bound only. Fires after `form.completed` when the submission was signed via the SpitShake Identity Engine handoff (JWT with `verified_name` + `stripe_verification_id`). Payload includes an `identity` block with the verified tuple. See Identity-bound signing.

Field Events

Event	Description
`field.updated`	A submitter changed the value of a field in a form.

Submission Events

Triggered when the overall submission (containing one or more submitters) changes state.

Event	Description
`submission.created`	A new submission was created from a template.
`submission.completed`	All submitters in the submission have completed their forms.
`submission.archived`	The submission was archived by an admin.
`submission.expired`	The submission expired before all submitters completed.

Template Events

Event	Description
`template.created`	A new template was created.
`template.updated`	A template’s fields, documents, or settings were modified.
`template.archived`	A template was archived.

Event Payloads

Every webhook delivery is an HTTP POST with Content-Type: application/json. The top-level structure is always:

{
  "event": "event.type",
  "timestamp": "ISO-8601 timestamp",
  "data": { }
}

Form Event Payload

All form events (form.created, form.started, form.viewed, form.completed, form.declined, form.expired) share this structure:

{
  "event": "form.completed",
  "timestamp": "2026-04-09T14:32:00Z",
  "data": {
    "submitter": {
      "id": 142,
      "uuid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
      "email": "jane.doe@example.com",
      "name": "Jane Doe",
      "role": "First Party",
      "status": "completed",
      "external_id": "cust_12345",
      "metadata": {
        "department": "Legal"
      },
      "opened_at": "2026-04-09T14:20:00Z",
      "completed_at": "2026-04-09T14:32:00Z",
      "declined_at": null
    },
    "submission": {
      "id": 89,
      "slug": "abc123def456",
      "status": "completed",
      "template_id": 15
    },
    "template": {
      "id": 15,
      "name": "Employment Agreement"
    }
  }
}

For form.declined events, the declined_at field will contain a timestamp and completed_at will be null. For form.expired events, both completed_at and declined_at will be null.

Submission Event Payload

Submission events include the full list of submitters and their statuses:

{
  "event": "submission.completed",
  "timestamp": "2026-04-09T14:35:00Z",
  "data": {
    "submission": {
      "id": 89,
      "slug": "abc123def456",
      "status": "completed",
      "created_at": "2026-04-09T10:00:00Z",
      "completed_at": "2026-04-09T14:35:00Z",
      "template_id": "tmpl_7VQhP2tM9xA1kR8bN",
      "metadata": {
        "partner_reference": "case_8675309"
      },
      "submitters": [
        {
          "id": 142,
          "uuid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
          "email": "jane.doe@example.com",
          "name": "Jane Doe",
          "role": "First Party",
          "status": "completed",
          "external_id": "signer_12345"
        },
        {
          "id": 143,
          "uuid": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
          "email": "john.smith@acme.com",
          "name": "John Smith",
          "role": "Second Party",
          "status": "completed",
          "external_id": null
        }
      ],
      "documents": [
        {
          "id": 301,
          "document_type": "signed_pdf",
          "filename": "employment-agreement.pdf",
          "download_url": "https://your-instance.com/api/v1/submissions/89/documents/301"
        }
      ]
    },
    "template": {
      "id": 15,
      "name": "Employment Agreement"
    }
  }
}

Submission event metadata echoes the caller-provided submission metadata. Keys reserved for SpitShake internals, currently flattening_failed, are omitted. Submitter metadata remains excluded; use each submitter’s external_id for caller-owned correlation.

Document download URLs in payloads

The submission.completed and form.completed webhook payloads include a documents array with download URLs, so you can retrieve signed PDFs directly from the event without a follow-up API call:

{
  "event": "submission.completed",
  "data": {
    "submission": {
      "id": 42,
      "status": "completed",
      "documents": [
        {
          "id": 1,
          "document_type": "signed_pdf",
          "filename": "signed_contract.pdf",
          "download_url": "https://your-instance.com/api/v1/submissions/42/documents/1"
        },
        {
          "id": 2,
          "document_type": "combined",
          "filename": "complete_contract.pdf",
          "download_url": "https://your-instance.com/api/v1/submissions/42/documents/2"
        }
      ]
    }
  }
}

The download_url requires authentication (Bearer token or X-Auth-Token with submissions:read scope).

Public document links

download_url needs your API token. If your integration expects a link it can fetch without credentials (DocuSeal’s documents[].url), an account admin can turn on Public document links in Settings → Webhooks, or via PUT /api/settings/document_links. Each document then also carries:

{
  "id": 2,
  "document_type": "combined",
  "filename": "complete_contract.pdf",
  "download_url": "https://your-instance.com/api/v1/submissions/42/documents/2",
  "url": "https://your-instance.com/dl/eyJfcmFpbHMiOnsi...--4f0c2e...",
  "url_expires_at": "2026-10-28T12:00:00Z"
}

Anyone with url can download the PDF, so treat it like a password.
Links expire after the account’s setting (30 days by default); set expires_in_days to null for links that never expire. url_expires_at is null for those.
Turning links off, or POST /api/settings/document_links/revoke, stops every link already sent. Changing the expiry only affects new links.
To mint a link on demand (with its own expiry), POST /api/submissions/{id}/documents/{document_id}/link.
A redelivery replays the original body, including the link it carried.

Template Event Payload

Template events include metadata about the template’s structure:

{
  "event": "template.updated",
  "timestamp": "2026-04-09T09:15:00Z",
  "data": {
    "template": {
      "id": 15,
      "name": "Employment Agreement",
      "slug": "employment-agreement-v2",
      "external_id": "tmpl_emp_2026",
      "folder_name": "HR Documents",
      "source": "web",
      "created_at": "2026-03-01T08:00:00Z",
      "updated_at": "2026-04-09T09:15:00Z",
      "submitters": [
        {
          "uuid": "c3d4e5f6-a7b8-9012-cdef-123456789012",
          "name": "Employee"
        },
        {
          "uuid": "d4e5f6a7-b8c9-0123-defa-234567890123",
          "name": "HR Manager"
        }
      ],
      "field_count": 12,
      "document_count": 1
    }
  }
}

Field Updated Payload

Fired each time a submitter changes a field value. Includes the old and new values for change tracking:

{
  "event": "field.updated",
  "timestamp": "2026-04-09T14:25:00Z",
  "data": {
    "event": "field.updated",
    "submitter": {
      "id": 142,
      "uuid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
      "email": "jane.doe@example.com",
      "name": "Jane Doe",
      "role": "First Party"
    },
    "submission": {
      "id": 89,
      "slug": "abc123def456",
      "template_id": 15
    },
    "field": {
      "uuid": "f1a2b3c4-d5e6-7890-abcd-ef1234567890",
      "name": "Start Date",
      "type": "date",
      "old_value": null,
      "new_value": "2026-05-01",
      "was_prefilled": false
    },
    "changed_at": "2026-04-09T14:25:00Z"
  }
}

Webhook Headers

Every webhook delivery includes the following HTTP headers:

Header	Description	Example
`Content-Type`	Always JSON.	`application/json`
`X-Webhook-Signature`	HMAC-SHA256 signature of the raw request body.	`sha256=5d7b1e3a9f...`
`X-Webhook-Secret`	Deprecated. The raw shared secret. Sent only to endpoints created before 2026-09-22 (`legacy_secret_header: true`); never to new endpoints. Verify with `X-Webhook-Signature` instead, then turn this off with `PATCH /api/webhooks/{id}` `{"legacy_secret_header": false}`.	`whsec_abc123def456`
`X-Webhook-Delivery-Id`	Unique UUID identifying this delivery attempt (use for deduplication).	`e7f8a9b0-c1d2-3456-e7f8-a9b0c1d23456`
`User-Agent`	Identifies the sender.	`SpitShake-Webhook/1.0`
`X-Webhook-Test`	Present only on a delivery from the test endpoint. Never sent for a real event.	`true`

HMAC Signature Verification

Every webhook includes an X-Webhook-Signature header containing an HMAC-SHA256 digest of the raw request body, signed with your webhook secret key:

X-Webhook-Signature: sha256=HMAC-SHA256(secret_key, raw_body)

Always verify the signature before processing a webhook to ensure it was sent by SpitShake and was not tampered with in transit.

require 'openssl'

def verify_webhook(request, secret)
  raw_body = request.body.read
  signature_header = request.headers['X-Webhook-Signature']

  expected = 'sha256=' + OpenSSL::HMAC.hexdigest(
    OpenSSL::Digest.new('sha256'),
    secret,
    raw_body
  )

  if Rack::Utils.secure_compare(expected, signature_header)
    JSON.parse(raw_body)
  else
    raise 'Invalid webhook signature'
  end
end

const crypto = require('crypto');

function verifyWebhook(req, secret) {
  const rawBody = req.body; // Buffer from express.raw()
  const signatureHeader = req.headers['x-webhook-signature'];

  const expected =
    'sha256=' +
    crypto.createHmac('sha256', secret).update(rawBody).digest('hex');

  const isValid = crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signatureHeader)
  );

  if (!isValid) {
    throw new Error('Invalid webhook signature');
  }

  return JSON.parse(rawBody);
}

import hmac
import hashlib
import json

def verify_webhook(request_body: bytes, signature_header: str, secret: str) -> dict:
    expected = 'sha256=' + hmac.new(
        secret.encode('utf-8'),
        request_body,
        hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(expected, signature_header):
        raise ValueError('Invalid webhook signature')

    return json.loads(request_body)

Always use the raw request body (bytes) for signature verification, not a parsed or re-serialized version. Re-serializing JSON may change key order or whitespace, causing verification to fail.

Managing Webhooks via API

Create a Webhook Endpoint

curl -X POST https://your-instance.spitshake.io/api/webhooks \
  -H "X-Auth-Token: YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://yourapp.com/webhooks/spitshake",
    "events": [
      "form.completed",
      "form.declined",
      "submission.completed",
      "submission.expired"
    ],
    "secret": "whsec_your_signing_secret_here",
    "enabled": true
  }'

Response:

{
  "id": 34,
  "url": "https://yourapp.com/webhooks/spitshake",
  "events": [
    "form.completed",
    "form.declined",
    "submission.completed",
    "submission.expired"
  ],
  "secret": "whsec_your_signing_secret_here",
  "enabled": true,
  "created_at": "2026-04-09T10:00:00Z",
  "updated_at": "2026-04-09T10:00:00Z"
}

Update a Webhook Endpoint

curl -X PUT https://your-instance.spitshake.io/api/webhooks/34 \
  -H "X-Auth-Token: YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://yourapp.com/webhooks/spitshake-v2",
    "events": [
      "form.completed",
      "form.declined",
      "form.expired",
      "submission.completed",
      "submission.expired",
      "template.updated"
    ],
    "enabled": true
  }'

Response:

{
  "id": 34,
  "url": "https://yourapp.com/webhooks/spitshake-v2",
  "events": [
    "form.completed",
    "form.declined",
    "form.expired",
    "submission.completed",
    "submission.expired",
    "template.updated"
  ],
  "secret": "whsec_your_signing_secret_here",
  "enabled": true,
  "created_at": "2026-04-09T10:00:00Z",
  "updated_at": "2026-04-09T11:30:00Z"
}

List All Webhook Endpoints

curl -X GET https://your-instance.spitshake.io/api/webhooks \
  -H "X-Auth-Token: YOUR_API_TOKEN"

Response:

{
  "data": [
    {
      "id": 34,
      "url": "https://yourapp.com/webhooks/spitshake-v2",
      "events": [
        "form.completed",
        "form.declined",
        "form.expired",
        "submission.completed",
        "submission.expired",
        "template.updated"
      ],
      "secret": "whsec_your_signing_secret_here",
      "enabled": true,
      "created_at": "2026-04-09T10:00:00Z",
      "updated_at": "2026-04-09T11:30:00Z"
    }
  ],
  "pagination": {
    "count": 1,
    "next": null,
    "prev": null
  }
}

Delete a Webhook Endpoint

curl -X DELETE https://your-instance.spitshake.io/api/webhooks/34 \
  -H "X-Auth-Token: YOUR_API_TOKEN"

Returns HTTP 204 No Content on success.

Webhook Delivery Log

Every attempt to reach this endpoint, newest first: real events, retries, and sends from the test endpoint (flagged "test": true). Each entry carries the HTTP status the endpoint answered, how long it took, and the error text when it failed.

curl -X GET "https://your-instance.spitshake.io/api/webhooks/34/deliveries?status=failed" \
  -H "X-Auth-Token: YOUR_API_TOKEN"

Query parameters:

Parameter	Type	Default	Description
`status`	string	—	Only entries in this state: `"pending"`, `"delivered"`, `"failed"` (a retry is scheduled, see `next_retry_at`) or `"exhausted"` (all 5 retries failed, or the URL was blocked).
`event`	string	—	Only entries for this event, e.g. `"form.completed"`.
`page`	integer	`1`	Page number.
`per_page`	integer	`20`	Entries per page (1-100).

Response:

{
  "data": [
    {
      "id": 1892,
      "delivery_uuid": "e7f8a9b0-c1d2-3456-e7f8-a9b0c1d23456",
      "event": "form.completed",
      "status": "delivered",
      "test": false,
      "attempt": 1,
      "response_status": 200,
      "duration_ms": 142.3,
      "delivered_at": "2026-04-09T14:32:01Z",
      "next_retry_at": null,
      "created_at": "2026-04-09T14:32:00Z"
    },
    {
      "id": 1885,
      "delivery_uuid": "f8a9b0c1-d2e3-4567-f8a9-b0c1d2e34567",
      "event": "form.viewed",
      "status": "failed",
      "test": false,
      "attempt": 2,
      "response_status": null,
      "duration_ms": 10004.8,
      "delivered_at": null,
      "next_retry_at": "2026-04-09T14:55:00Z",
      "created_at": "2026-04-09T14:20:00Z"
    },
    {
      "id": 1871,
      "delivery_uuid": "0a1b2c3d-4e5f-6789-0a1b-2c3d4e5f6789",
      "event": "form.completed",
      "status": "delivered",
      "test": true,
      "attempt": 1,
      "response_status": 200,
      "duration_ms": 98.1,
      "delivered_at": "2026-04-09T13:58:12Z",
      "next_retry_at": null,
      "created_at": "2026-04-09T13:58:12Z"
    }
  ],
  "pagination": {
    "page": 1,
    "per_page": 20,
    "total": 3,
    "total_pages": 1
  }
}

Field	Description
`delivery_uuid`	The `X-Webhook-Delivery-Id` header your endpoint received.
`status`	`pending` (in flight), `delivered` (endpoint answered 2xx), `failed` (non-2xx or no answer; a retry is scheduled for `next_retry_at`), `exhausted` (every retry failed, or the URL resolves to a blocked address - no retry).
`test`	`true` for a send from `POST /api/webhooks/{id}/test`. The body it delivered carried `"test": true` and the `X-Webhook-Test` header; skip these in anything that counts real signatures.
`attempt`	1 for the first send; a retry rewrites the same entry with the next attempt number.
`response_status`	HTTP status the endpoint answered, `null` when it never answered.
`duration_ms`	Time from request start to response (or to the timeout).
`next_retry_at`	When the next retry is due, only while `status` is `failed`. Retries are 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours after the previous attempt.

A delivery that is missing entirely was never dispatched: check the subscription rules under Which events actually reach you.

Redelivering a failed webhook

If a delivery failed or was exhausted, you can trigger a redeliver:

POST /api/webhooks/{webhook_id}/deliveries/{delivery_id}/redeliver

This creates a new delivery attempt with a fresh delivery_uuid.

Test a Webhook Endpoint

Send a sample delivery of any single event to your registered URL, so you can exercise the handler you actually wrote before a real signer ever touches the document.

curl -X POST https://your-instance.spitshake.io/api/webhooks/34/test \
  -H "X-Auth-Token: YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "event": "form.completed"
  }'

200 OK

{
  "success": true,
  "event": "form.completed",
  "message": "Sample form.completed payload sent",
  "delivery_id": 1871,
  "delivery_uuid": "0a1b2c3d-4e5f-6789-0a1b-2c3d4e5f6789"
}

The send is logged like any other delivery, flagged "test": true, so GET /api/webhooks/{id}/deliveries shows what your endpoint answered. A failed test send is logged as failed with the error text and is not retried; the response is 422 with the same delivery_id.

event may be any event in Supported Events, including one this endpoint is not subscribed to — which is what makes it useful behind a “Test” button next to an event picker. Omit it and you get the first event the endpoint subscribes to, or form.completed if it subscribes to all.

An unrecognised event is rejected with 422 and nothing is sent:

422 Unprocessable Entity

{ "success": false, "error": "Unknown event \"form.exploded\". Supported events: form.created, form.started, ..." }

The body is the real payload shape for that event, filled with obviously-fake sample data (sample.signer@example.com, template “Sample Agreement”, ids in the 900000 range). Document download_urls (and public urls, when links are on) point at your own signing domain but resolve to nothing — they are for checking your URL handling, not for downloading.
The delivery carries every standard header, so it exercises your signature verification exactly like a real one.

A sample is marked as a test in two places: "test": true at the top level of the body, and the X-Webhook-Test: true header. Check one of them before acting. A sample submission.completed is shaped exactly like the real thing, so a handler that ignores both flags will happily create records for a submission that does not exist. Real deliveries never carry either flag.

Sample body

{
  "event": "form.completed",
  "timestamp": "2026-09-21T19:45:00Z",
  "test": true,
  "data": {
    "submitter": { "id": 900020, "email": "sample.signer@example.com", "name": "Sample Signer", "role": "Signer", "status": "completed", "...": "..." },
    "submission": { "id": 900010, "slug": "SampleSubmission01", "status": "completed", "template_id": "tpl_SampleTemplate0001" },
    "template": { "id": "tpl_SampleTemplate0001", "name": "Sample Agreement" }
  }
}

Test deliveries are sent synchronously and are not recorded in the delivery log — the HTTP response above is the result. Use the log for real events.

Testing your integration

A path from “nothing wired up” to “confident in production”, without emailing anyone.

Exercise your handler with a sample of each event

POST /api/webhooks/{id}/test for every event you subscribe to. Confirm your signature check passes, your parser copes with the shape, and you skip anything carrying "test": true.

Run a real submission that emails nobody

Create a submission with "send_email": false. No invitation is sent, but the submission is real and webhooks still fire normally — so you can open the signing link yourself, complete it, and watch genuine form.* and submission.completed deliveries arrive.

curl -X POST https://your-instance.spitshake.io/api/submissions \
  -H "X-Auth-Token: YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "template_id": "tpl_7VQhP2tM9xA1kR8bN",
    "send_email": false,
    "submitters": [{ "role": "Client", "email": "you@yourcompany.com" }]
  }'

Each submitter in the response carries a signing_url you can open directly.

Read the delivery log when something does not arrive

GET /api/webhooks/{id}/deliveries shows every attempt, test sends included ("test": true), with the status your endpoint answered and the error text when it did not. A delivery that is missing entirely was never dispatched — check the subscription rules below rather than your handler.

Which events actually reach you

Situation	What happens
`events` is a non-empty list	Only those events are delivered.
`events` is an empty list	Every event is delivered. An empty list is not “none”.
Endpoint has `enabled: false`	Nothing is delivered, and nothing is logged.
`submission.created`	Fires only if you subscribe to it explicitly — it is not implied by `form.created`.
`signing.complete`	Identity-bound submissions only; it arrives after `form.completed`, never instead of it.
A test delivery	Sent whatever the subscription says, and logged with `"test": true`.

Deliveries are retried on any non-2xx, so a handler that 500s while you are debugging will keep receiving the same X-Webhook-Delivery-Id for up to 12 hours. Return 200 and discard what you cannot use yet.

Retry Policy

If your endpoint does not return an HTTP 2xx response, SpitShake retries the delivery up to 5 times with increasing delays:

Attempt	Delay After Failure
1st retry	1 minute
2nd retry	5 minutes
3rd retry	30 minutes
4th retry	2 hours
5th retry	12 hours

After 5 failed attempts, the delivery is marked as permanently failed. You can view failed deliveries in the webhook logs section of your account settings. Timeout thresholds:

Connect timeout: 5 seconds. If SpitShake cannot establish a TCP connection within 5 seconds, the attempt fails.
Read timeout: 10 seconds. If your server does not send a complete response within 10 seconds of connection, the attempt fails.

Each retry includes the same X-Webhook-Delivery-Id, so you can use it to deduplicate deliveries on your end.

Return a 200 OK response as quickly as possible. Process the webhook payload asynchronously (e.g., via a background job) to avoid hitting the read timeout.

SSRF Protection

SpitShake validates all webhook URLs before delivering events. The following restrictions apply to protect against Server-Side Request Forgery (SSRF) attacks: Blocked IP ranges:

CIDR Block	Description
`10.0.0.0/8`	Private network (Class A)
`172.16.0.0/12`	Private network (Class B)
`192.168.0.0/16`	Private network (Class C)
`127.0.0.0/8`	Loopback (localhost)
`169.254.0.0/16`	Link-local / cloud metadata
`100.64.0.0/10`	Carrier-grade NAT (shared address space)

Additional restrictions:

HTTPS required in production. HTTP URLs are only accepted in development/test environments.
Localhost blocked. URLs containing localhost, 127.0.0.1, or [::1] are rejected.
Cloud metadata endpoints blocked. URLs targeting 169.254.169.254 and similar metadata service IPs are rejected.

Best Practices

Verify signatures on every request

Always validate the X-Webhook-Signature header before processing any webhook payload. Never skip verification, even in development.

Use the delivery ID for deduplication

Store the X-Webhook-Delivery-Id header value and check for duplicates before processing. Retries will send the same delivery ID.

Respond quickly, process asynchronously

Return a 200 status immediately and enqueue the payload for background processing. Long-running synchronous handlers risk timeouts and unnecessary retries.

Handle events idempotently

Your webhook handler may receive the same event more than once due to retries. Design your processing logic to be safe for repeated execution.

Monitor your endpoint health

Set up alerting for elevated error rates or slow response times on your webhook handler. SpitShake will stop retrying after 5 failures.

Getting Started

Core Guides

Embedding

Features

Security & Compliance

Legal

Overview

Supported Events

Form Events

Field Events

Submission Events

Template Events

Event Payloads

Form Event Payload

Submission Event Payload

Document download URLs in payloads

Public document links

Template Event Payload

Field Updated Payload

Webhook Headers

HMAC Signature Verification

Managing Webhooks via API

Create a Webhook Endpoint

Update a Webhook Endpoint

List All Webhook Endpoints

Delete a Webhook Endpoint

Webhook Delivery Log

Redelivering a failed webhook

Test a Webhook Endpoint

Testing your integration

Which events actually reach you

Retry Policy

SSRF Protection

Best Practices

​Overview

​Supported Events

​Form Events

​Field Events

​Submission Events

​Template Events

​Event Payloads

​Form Event Payload

​Submission Event Payload

​Document download URLs in payloads

​Public document links

​Template Event Payload

​Field Updated Payload

​Webhook Headers

​HMAC Signature Verification

​Managing Webhooks via API

​Create a Webhook Endpoint

​Update a Webhook Endpoint

​List All Webhook Endpoints

​Delete a Webhook Endpoint

​Webhook Delivery Log

​Redelivering a failed webhook

​Test a Webhook Endpoint

​Testing your integration

​Which events actually reach you

​Retry Policy

​SSRF Protection

​Best Practices

Overview

Supported Events

Form Events

Field Events

Submission Events

Template Events

Event Payloads

Form Event Payload

Submission Event Payload

Document download URLs in payloads

Public document links

Template Event Payload

Field Updated Payload

Webhook Headers

HMAC Signature Verification

Managing Webhooks via API

Create a Webhook Endpoint

Update a Webhook Endpoint

List All Webhook Endpoints

Delete a Webhook Endpoint

Webhook Delivery Log

Redelivering a failed webhook

Test a Webhook Endpoint

Testing your integration

Which events actually reach you

Retry Policy

SSRF Protection

Best Practices