Webhooks
Every state change, delivered.
Nineteen event types. Signed with HMAC-SHA256. Delivered from a durable queue and retried with back-off on failure. Every attempt and its response status is recorded.
Event catalog.
All events fire from the same delivery queue, with the same headers and signing scheme.
| Event | Description |
|---|---|
envelope.created | envelope created |
envelope.sent | sent to recipients |
envelope.opened | recipient opened the link |
envelope.viewed_document | recipient viewed a document |
envelope.identity_verified | signer passed OTP verification |
envelope.field_filled | a field was filled |
envelope.document_signed | a document was signed |
envelope.all_signed | all signers completed |
envelope.document_completed | a document completed |
envelope.completed | envelope completed |
envelope.copied | a copy was sent to a CC recipient |
envelope.reminded | a reminder was sent |
envelope.declined | signer declined |
envelope.expired | window closed unsigned |
envelope.voided | sender voided it |
envelope.recalled | sender recalled it to a draft |
envelope.id_verified | signer passed ID verification |
envelope.id_verification_failed | ID verification failed |
envelope.recipient_updated | recipient details changed |
Payload example.
envelope.completed is the most common event. `data` carries whatever the underlying audit event recorded, so its keys vary by event type. Subscribe once; on failure we retry with back-off before marking the delivery failed.
// Headers
X-VG-Signature: sha256=4c2a9bd3…71ff
X-VG-Delivery-Id: 8f4a2c1e-9b3d-4f02-a71c-2d5e6b8c0a19
// Body
{
"id": "8f4a2c1e-9b3d-4f02-a71c-2d5e6b8c0a19",
"event": "envelope.completed",
"envelope_id": "3f9c1d84-0b27-4a6e-9d51-7c2f8e4b1a03",
"workspace_id": "b41e7d90-5c38-42af-8e16-9a0d3f5c7b28",
"external_ref": "deal_142",
"timestamp": "2026-05-02T16:48:11.204Z",
"data": {
"recipient_id": "c72b5a10-8e64-4d39-b0f7-1e5a9c3d6482",
"actor_email": "signer@example.com",
"ip_address": "203.0.113.10",
"user_agent": "Mozilla/5.0 …",
"scope": "envelope"
}
}Delivery guarantees.
HMAC-SHA256 signed
Each delivery includes an X-VG-Signature header, an HMAC-SHA256 digest of the raw body. Verify it before trusting the payload.
Retry with back-off
A delivery is tried up to 3 times (retries after about 1 and 5 minutes), then marked failed.
Delivery records
Every attempt and its response status is recorded, so a failed delivery can be diagnosed.
Idempotent by delivery id
Every delivery carries an X-VG-Delivery-Id header, repeated as "id" in the body and unchanged across retries. Store it and skip duplicates.
Send your first envelope free.
Start on Free and upgrade to Pro when you need more.