Webhooks

{
  "id": "EV3QK9WT7PZMXDH4",
  "type": "pact.sealed",
  "created": "2026-10-21T09:12:45Z",
  "data": {
    "pact": {
      "uid": "K4TQ7MZE",
      "title": "Consulting agreement with Acme",
      "status": "sealed",
      "message": "Please sign by Friday.",
      "page_count": 3,
      "created_by": "api",
      "current_signer": null,
      "date_created": "2026-10-20T14:05:00Z",
      "date_sent": "2026-10-20T14:05:01Z",
      "date_lapses": "2026-11-03T14:05:01Z",
      "date_sealed": "2026-10-21T09:12:44Z",
      "date_updated": "2026-10-21T09:12:44Z",
      "documents_charged": 1,
      "documents_cost": null,
      "sent_sha256": "9f2c…",
      "signed_sha256": "4b1e…",
      "recipients": [
        { "order": 1, "role": "signer", "name": "Avery Lane", "email": "avery@example.com", "status": "signed", "date_viewed": "2026-10-20T15:28:02Z", "date_signed": "2026-10-20T15:31:40Z", "typed_name": "Avery Lane", "decline_reason": null },
        { "order": 2, "role": "signer", "name": "Sam Ortiz", "email": "sam@example.com", "status": "signed", "date_viewed": "2026-10-21T09:10:15Z", "date_signed": "2026-10-21T09:12:44Z", "typed_name": "Sam Ortiz", "decline_reason": null },
        { "order": 3, "role": "cc", "name": "Records", "email": "records@example.com", "status": "pending", "date_viewed": null, "date_signed": null, "typed_name": null, "decline_reason": null }
      ],
      "links": {
        "document": "https://api.signwithsigil.com/v1/pacts/K4TQ7MZE/document.pdf",
        "signed": "https://api.signwithsigil.com/v1/pacts/K4TQ7MZE/signed.pdf",
        "sigil": "https://api.signwithsigil.com/v1/pacts/K4TQ7MZE/sigil.pdf",
        "dashboard": "https://www.signwithsigil.com/pacts/K4TQ7MZE"
      }
    }
  }
}

{
  "id": "EV7PZ2KQMX9TWH4D",
  "type": "pact.signed",
  "created": "2026-10-20T15:31:40Z",
  "data": {
    "pact": { "uid": "K4TQ7MZE", "status": "sent", "current_signer": 2, "…": "…" },
    "recipient": { "order": 1, "role": "signer", "name": "Avery Lane", "email": "avery@example.com", "status": "signed", "date_viewed": "2026-10-20T15:28:02Z", "date_signed": "2026-10-20T15:31:40Z", "typed_name": "Avery Lane", "decline_reason": null }
  }
}

{
  "id": "PNG4K7QWT9ZXMEH2",
  "type": "ping",
  "created": "2026-10-20T14:00:12Z",
  "data": { "endpoint": { "uid": "W8NQ3KTE", "url": "https://example.com/sigil/webhook" } }
}

import express from 'express';
import crypto from 'node:crypto';

const SECRET = process.env.SIGIL_WEBHOOK_SECRET;
const app = express();

app.post('/sigil/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const header = req.get('X-Sigil-Signature') ?? '';
  const parts = Object.fromEntries(header.split(',').map((p) => p.split('=', 2)));
  const t = Number(parts.t);
  const expected = crypto.createHmac('sha256', SECRET).update(`${parts.t}.`).update(req.body).digest('hex');
  const fresh = Number.isFinite(t) && Math.abs(Date.now() / 1000 - t) < 300;
  const ok = fresh && parts.v1?.length === expected.length && crypto.timingSafeEqual(Buffer.from(parts.v1, 'hex'), Buffer.from(expected, 'hex'));
  if (!ok) return res.status(401).send('bad signature');

  const event = JSON.parse(req.body);
  // Answer first, work after: anything slow belongs in a queue, keyed by req.get('X-Sigil-Delivery').
  res.sendStatus(204);
  if (event.type === 'pact.sealed') console.log('sealed:', event.data.pact.uid, event.data.pact.links.signed);
});

app.listen(3000);

import hmac, hashlib, os, time
from flask import Flask, request, abort

SECRET = os.environ["SIGIL_WEBHOOK_SECRET"].encode()
app = Flask(__name__)

@app.post("/sigil/webhook")
def sigil_webhook():
    header = request.headers.get("X-Sigil-Signature", "")
    parts = dict(p.split("=", 1) for p in header.split(",") if "=" in p)
    body = request.get_data()  # raw bytes, before any parsing
    expected = hmac.new(SECRET, parts.get("t", "").encode() + b"." + body, hashlib.sha256).hexdigest()
    fresh = parts.get("t", "").isdigit() and abs(time.time() - int(parts["t"])) < 300
    if not (fresh and hmac.compare_digest(expected, parts.get("v1", ""))):
        abort(401)

    event = request.get_json(force=True)
    if event["type"] == "pact.sealed":
        print("sealed:", event["data"]["pact"]["uid"])
    return "", 204

using System.Security.Cryptography;
using System.Text;

app.MapPost("/sigil/webhook", async (HttpRequest request) =>
{
    string secret = Environment.GetEnvironmentVariable("SIGIL_WEBHOOK_SECRET")!;
    using MemoryStream buffer = new();
    await request.Body.CopyToAsync(buffer);
    byte[] body = buffer.ToArray();

    var parts = (request.Headers["X-Sigil-Signature"].ToString()).Split(',')
        .Select(p => p.Split('=', 2)).Where(p => p.Length == 2).ToDictionary(p => p[0], p => p[1]);
    if (!parts.TryGetValue("t", out var t) || !parts.TryGetValue("v1", out var v1) || !long.TryParse(t, out long ts))
        return Results.Unauthorized();
    if (Math.Abs(DateTimeOffset.UtcNow.ToUnixTimeSeconds() - ts) > 300)
        return Results.Unauthorized();

    byte[] signed = [.. Encoding.UTF8.GetBytes(t + "."), .. body];
    string expected = Convert.ToHexStringLower(HMACSHA256.HashData(Encoding.UTF8.GetBytes(secret), signed));
    if (!CryptographicOperations.FixedTimeEquals(Encoding.ASCII.GetBytes(expected), Encoding.ASCII.GetBytes(v1)))
        return Results.Unauthorized();

    var evt = System.Text.Json.JsonDocument.Parse(body).RootElement;
    // Queue the work by request.Headers["X-Sigil-Delivery"]; answer right away.
    return Results.NoContent();
});

<?php
$secret = getenv('SIGIL_WEBHOOK_SECRET');
$body = file_get_contents('php://input');
$parts = [];
foreach (explode(',', $_SERVER['HTTP_X_SIGIL_SIGNATURE'] ?? '') as $p) {
    [$k, $v] = array_pad(explode('=', $p, 2), 2, '');
    $parts[$k] = $v;
}
$expected = hash_hmac('sha256', ($parts['t'] ?? '') . '.' . $body, $secret);
$fresh = ctype_digit($parts['t'] ?? '') && abs(time() - (int) $parts['t']) < 300;
if (!$fresh || !hash_equals($expected, $parts['v1'] ?? '')) {
    http_response_code(401);
    exit;
}
$event = json_decode($body, true);
http_response_code(204);
// handle $event['type'] after responding, or quickly