Help Center

Outbound webhook on submission

POST JSON to your URL after each new signature, signed with HMAC SHA-256.

Each form can POST to your own HTTPS URL after a new signature. Edits to an existing submission do not fire it. A failed webhook never blocks the person who signed.

Set it up

1. Open the form's Settings.
2. Paste an https URL under Outbound webhook and save. We generate a signing secret.
3. Your endpoint should verify X-ConsentForms-Signature: sha256= plus hex HMAC-SHA256 of the raw JSON body, using that secret.

Payload

JSON with event: submission.created, form id and slug, submission id, submittedAt, signer name and email. We do not send file bytes. Header X-ConsentForms-Event is the same event name.