Webhooks
Signed, retried callbacks for every lifecycle event.
Rather than polling, register an endpoint and be told when something happens.
Events
envelope.sent, recipient.viewed, recipient.signed, recipient.declined, recipient.reassigned, envelope.completed, envelope.voided, envelope.expired, reminder.sent.
Verifying
Every delivery carries X-Signspry-Signature, an HMAC-SHA256 of the raw body using your endpoint secret:
import hmac, hashlib
expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
if not hmac.compare_digest(expected, request.headers["X-Signspry-Signature"]):
abort(400)Compare in constant time, and always verify before acting.
Retries
A non-2xx response or a timeout is retried with backoff. Respond 200 quickly and do your work asynchronously — a slow endpoint looks like a failing one.
Idempotency
Retries mean you may see the same event twice. Each delivery has an event id; record what you've processed and ignore repeats.
Point a test-mode endpoint at a request-inspection service while developing. Sandbox envelopes fire webhooks exactly like live ones.
Was this useful?