Webhook is one of the popular call back mechanisms popularly used by developers to integrate any two applications. It provides updates in real-time to the integrated application whenever an event or action occurs. This is a superior solution, unlike in API based models where such data needs to be polled periodically. Webhook is a much more efficient and widely used methodology as far as integration is concerned.
Zoho Sign Webhooks
Zoho Sign provides option to configure webhooks to get real-time update of events that occur in Zoho Sign.
| Description |
Sent | Triggers when documents are sent for signatures. |
Viewed | Triggers when documents are viewed by one of the recipients. |
Signed by a recipient | Triggers when documents are signed or approved by one of the recipients. |
Completed by all | Triggers when documents are completely signed and approved by all recipients. |
Declined | Triggers when documents are declined by one of the recipients |
Reassigned | Triggers when documents are reassigned by one of the recipients to be signed or approved by another person. |
Expires | Triggers when documents are sent for signatures and the approval expires. |
Recalled | Triggers when documents are sent for signatures or approval are recalled by the sender.
|
Prerequisites:
- Webhooks, at present, are available on Enterprise, API, Zoho One, and People Plus plans.
- Currently, only two webhooks are allowed per account.
How to register a webhook:
The Zoho Sign admin can register a webhook by clicking Settings > Developer Settings > Webhooks from the left navigation pane.
Click
Create webhook and provide relevant information like callback URL and name. It also has a list of events for which this webhook has to be triggered.
![](https://help.zoho.com/galleryDocuments/edbsn13e23ccad537cdfcc3b7ae7cdb9635d93965a1f6c93ebd9ad9bc9b0f0a617bb358a244e029b1aff6a52bab7a88038db9?inline=true)
If you wish to secure your webhook, enable the HMAC signature checkbox and enter the Secret key generated by you. If you don't have one, click the Generate button.
![](https://static.zohocdn.com/zoho-desk-editor/static/images/file.png)
Once configured, the saved secret key cannot be retrieved from Zoho Sign.
You must take necessary steps to keep the secret key safe since the secret key is needed to validate the webhook payload in your application
Choose the relevant options and complete the webhook registration process.
Webhook payload:
- For every webhook event, following payload will be triggered.
- This payload is a JSON object with two keys, "notifications" and "requests", each internally containing a JSON object.
- The notifications object gives details about the action which was performed on the document and the requests object contains the details about the document for which the webhook was called.
Structure:
- {
- "notifications":
- {
- "performed_by_email": "<email address of the person performing the operation. ",
- "performed_by_name": "<user who performed this operation",
- "performed_at": <time value in java current time in mills format>,
- "reason": "Reason stated for the operation-applicable if any",
- "activity": "<small description of activity performed",
- "operation_type": "RequestSubmitted | RequestViewed | RequestSigningSuccess | RequestCompleted | RequestRejected | RequestRecalled | RequestForwarded | RequestExpired",
- "action_id": "<sign action id",
- "ip_address": "<ip address captured during this operation>"
- },
- "requests":
- {
- "request_status": "<status of the document>",
- "request_name": "<name of the sign request>",
- "request_id": "<long value - primary key of the signature request",
- "document_ids":
- [
- {
- "document_name": "<name of the document inside signature request",
- "document_id": "<long value - of the document contained inside request"
- }
- ]
- }
- }
Sample payload:
- {
- "notifications":
- {
- "performed_by_email": "testuser@zoho.com",
- "performed_at": 1555062604837,
- "reason": "reason given if any",
- "activity": "Document has been signed",
- "operation_type": "RequestSigningSuccess",
- "action_id": "1000000000090",
- "performed_by_name": "test user",
- "ip_address": "192.168.100.100"
- },
- "requests":
- {
- "request_name": "NDA Document",
- "request_id": "1000000000000",
- "org_id": "9876543210",
- "request_type_id": "10000000011",
- "document_ids":
- [
- {
- "document_name": "CommonNDA.pdf",
- "document_id": "100000000000050"
- }
- ]
- }
- }
Note:
- operation_type attribute under notification JSON object can have one of the following pre-defined constants with which actions are triggered. This attribute plays an important role in identifying the type of event that took place.
Operation Types | Reason for triggering |
RequestSubmitted | When a document is submitted for signature. |
RequestViewed | When a submitted document is viewed. |
RequestSigningSuccess | When one of the signers successfully completes the signing process. |
RequestCompleted | When all the assigned signers or approvers completes the signing or approval process. |
RequestRejected | When a submitted signature request is rejected. |
RequestRecalled | When a submitted signature request is recalled by the sender. |
RequestForwarded | When a submitted request is forwarded to another person by the assigned signer. |
RequestExpired | When a submitted document expires the allocated signing time.
|
- For signer-related actions, such as RequestViewed, RequestSigningSuccess, RequestRejected, and RequestForwarded, there will be 'action_id' of the signer present inside the 'notifications' json.
- All other data that comes as part of notification payload are not standard data attributes and may be removed anytime in future. Users are advised to use documented attributes alone.