Webhooks: every signature, sent where you need it

What you can listen for

Each endpoint picks the events it wants, so a Slack alert can listen only for envelope.completed while your CRM hears about every view.

Set it up

1. 1

   Get an address to send to

   In Zapier, add a Webhooks by Zapier trigger and choose Catch Hook; Make and n8n have their own webhook triggers. Copy the URL they give you, or use an https:// address on your own server.

2. 2

   Add the endpoint

   In SignMaster, open Settings › Developers › Webhooks, paste the URL, describe it and tick the events you want.

3. 3

   Keep the signing secret

   SignMaster shows the endpoint's secret once, when you create it. Store it where your code can read it; you can roll a new one at any time.

4. 4

   Send a test

   A test sends a webhook.test message with sample data straight away and shows the status code your endpoint answered with, so you can map fields before a real contract is signed.

What arrives

Every message is JSON with an id starting evt_, a type, created_at and api_version, and a data object built when it's sent, so it always holds the latest details:

• data.envelope: its id, title, status, template_id, bulk_send_id, sent_at and completed_at.
• data.recipients: each person's id, name, email, role, type, status and completed_at. Events about one signer add data.recipient.
• data.fields and data.fields_by_label: on recipient.completed and envelope.completed, every field with its label, type and value, and whether the signer or the sender filled it in.
• data.signed_pdf: on envelope.completed, a link to the signed PDF that works for a day, with its SHA-256 fingerprint.

Signature images are never sent. A file a signer uploaded arrives as its name and a short-lived link.

Check that it came from SignMaster

Each request carries SignMaster-Event-Id, SignMaster-Event-Type and SignMaster-Signature headers. The signature reads t= a Unix timestamp, then v1= a hex HMAC-SHA256 of the timestamp, a dot and the raw request body, keyed with your secret. Compute the same value, compare, and reject old timestamps. Store the event id too: if a message ever arrives twice, you'll know to skip it.

Retries and failures

Any 2xx response counts as delivered. Anything else counts as a failure, including a redirect or no answer within 5 seconds, and SignMaster tries again after 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours and 24 hours. A message that fails a seventh time is marked dead. The delivery log lists each message with its status, and you can retry one from there.

If an endpoint fails 20 times in a row and hasn't succeeded for 24 hours, SignMaster pauses it and emails the person who created it, so a broken URL doesn't fail quietly for weeks. Fix it and switch it back on.

Which plans include webhooks

Webhooks come with the REST API on Crew and Company. Crew is $49 a month for 5 people, and new workspaces try it free for 14 days. Compare plans.