Webhooks

Document events: document.sent, document.viewed, document.signed, document.completed, document.declined, document.expired.

Agent Contact / DASP events: contact.invited, contact.accepted, contact.revoked, offer.sent, offer.received, offer.acked, offer.accepted, offer.declined, offer.escalated.

Transfer events: transfer.released when a package unlocks (share, sign-to-unlock, or accept-to-unlock). See Transfers.

When a mark is applied under a Signing Mandate, document.signed includes principal, agent, mandate_id, confirmation_level (l1 or l2), sign_request_id, and pre_sign_hash. document.completed repeats those fields when every signer is done.

Verify signature

Header: x-webhook-signature — HMAC-SHA256 of the raw body using your webhook secret.

import crypto from 'node:crypto';

function verify(rawBody, signature, secret) {
  const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

Register webhooks in the app (Developer → Webhook) or POST /v1/webhooks.