UnforgedSig A sample certificateWhat a signature provesDevelopers
Get started
Get started
Contents

Webhook endpoints

Hear when a package is sent, viewed, signed, declined, voided or expires.

The SigWebhook object

Attributes

  • id required Type: string
  • url required Type: string
  • events required Type: string[]
  • created_at required Type: string

SigWebhook on its own page

List Sig's webhook endpoints

GET /sig/webhooks

Needs sig:settings:manage: Sig settings: Folio filing and Nib checks

Sig's endpoints only.

Returns

  • 200 Type: SigWebhookList
    The endpoints
  • 400 Type: Problem
    invalid_request, invalid_version, idempotency_key_required or invalid_signature
  • 401 Type: Problem
    unauthorized
  • 403 Type: Problem
    permission_denied, org_suspended, or address_not_allowed (your organisation only accepts requests from the addresses it has listed)
  • 404 Type: Problem
    not_found
  • 421 Type: Problem
    wrong_region
  • 429 Type: Problem
    rate_limited or quota_exceeded
  • default Type: Problem
    internal
GET /sig/webhooks · curl 
curl "https://api.unforged.sh/sig/webhooks" \
  -H "Authorization: Bearer $UNFORGED_KEY" \
  -H "Unforged-Version: 2026-10-14"
GET /sig/webhooks · Python 
import requests

r = requests.get(
    "https://api.unforged.sh/sig/webhooks",
    headers={"Authorization": f"Bearer {UNFORGED_KEY}", "Unforged-Version": "2026-10-14"},
)
print(r.json())
GET /sig/webhooks · Node.js 
const res = await fetch('https://api.unforged.sh/sig/webhooks', {
  method: 'GET',
  headers: { Authorization: `Bearer ${process.env.UNFORGED_KEY}`, 'Unforged-Version': '2026-10-14' },
});
console.log(await res.json());

Create a Sig webhook endpoint

POST /sig/webhooks

Needs sig:settings:manage: Sig settings: Folio filing and Nib checks

Like POST /nib/webhooks (the same signing, retries, delivery log and connection test), for Sig's events: sig.package.sent, sig.signer.viewed, sig.signer.signed, sig.package.completed, sig.package.declined, sig.package.voided, sig.package.expired. Each event carries the package_id; one about a signer carries their signer_id too, and sig.signer.signed and sig.package.declined say what they did in outcome (signed, approved or declined), the same as a package's return link. The secret is shown once. No Idempotency-Key: a retry creates another endpoint.

Request body

SigWebhookCreate

  • url required Type: string
  • events required Type: "sig.package.sent" "sig.signer.viewed" "sig.signer.signed" "sig.package.completed" "sig.package.declined" "sig.package.voided" "sig.package.expired"[]

Returns

  • 201 Type: SigWebhookCreated
    Created
  • 400 Type: Problem
    invalid_request, invalid_version, idempotency_key_required or invalid_signature
  • 401 Type: Problem
    unauthorized
  • 403 Type: Problem
    permission_denied, org_suspended, or address_not_allowed (your organisation only accepts requests from the addresses it has listed)
  • 404 Type: Problem
    not_found
  • 409 Type: Problem
    conflict, idempotency_conflict, idempotency_in_progress or idempotency_not_replayable
  • 421 Type: Problem
    wrong_region
  • 429 Type: Problem
    rate_limited or quota_exceeded
  • default Type: Problem
    internal
POST /sig/webhooks · curl 
curl -X POST "https://api.unforged.sh/sig/webhooks" \
  -H "Authorization: Bearer $UNFORGED_KEY" \
  -H "Unforged-Version: 2026-10-14" \
  -H "Content-Type: application/json" \
  -d '{}'
POST /sig/webhooks · Python 
import requests

r = requests.post(
    "https://api.unforged.sh/sig/webhooks",
    headers={"Authorization": f"Bearer {UNFORGED_KEY}", "Unforged-Version": "2026-10-14"},
    json={},
)
print(r.json())
POST /sig/webhooks · Node.js 
const res = await fetch('https://api.unforged.sh/sig/webhooks', {
  method: 'POST',
  headers: { Authorization: `Bearer ${process.env.UNFORGED_KEY}`, 'Unforged-Version': '2026-10-14', 'Content-Type': 'application/json' },
  body: JSON.stringify({}),
});
console.log(await res.json());

Delete a Sig webhook endpoint

DELETE /sig/webhooks/{webhook_id}

Needs sig:settings:manage: Sig settings: Folio filing and Nib checks

404 for an unknown endpoint and for another product's.

Parameters

  • webhook_id pathrequired Type: string

    The endpoint's id.

Returns

  • 204
    Deleted
  • 400 Type: Problem
    invalid_request, invalid_version, idempotency_key_required or invalid_signature
  • 401 Type: Problem
    unauthorized
  • 403 Type: Problem
    permission_denied, org_suspended, or address_not_allowed (your organisation only accepts requests from the addresses it has listed)
  • 404 Type: Problem
    not_found
  • 421 Type: Problem
    wrong_region
  • 429 Type: Problem
    rate_limited or quota_exceeded
  • default Type: Problem
    internal
DELETE /sig/webhooks/{webhook_id} · curl 
curl -X DELETE "https://api.unforged.sh/sig/webhooks/{webhook_id}" \
  -H "Authorization: Bearer $UNFORGED_KEY" \
  -H "Unforged-Version: 2026-10-14"
DELETE /sig/webhooks/{webhook_id} · Python 
import requests

r = requests.delete(
    "https://api.unforged.sh/sig/webhooks/{webhook_id}",
    headers={"Authorization": f"Bearer {UNFORGED_KEY}", "Unforged-Version": "2026-10-14"},
)
print(r.json())
DELETE /sig/webhooks/{webhook_id} · Node.js 
const res = await fetch('https://api.unforged.sh/sig/webhooks/{webhook_id}', {
  method: 'DELETE',
  headers: { Authorization: `Bearer ${process.env.UNFORGED_KEY}`, 'Unforged-Version': '2026-10-14' },
});
console.log(await res.json());