Webhooks

POST/your-endpoint

Receive signed HTTP callbacks when workspace events occur

Outbound webhooks notify your server when something happens in a workspace: a certificate is issued, a recipient shares on LinkedIn, a request is approved, and so on.

Configure a single HTTPS endpoint per workspace in the dashboard (Settings → Webhooks) or via the API. Webhooks require an active Pro seat.

Payload

Every delivery is a JSON POST:

{
  "id": "7c8e0b2a-3d1f-4c55-9a11-2f6b8d4e1c90",
  "event_type": "certificate.issued",
  "occurred_at": "2026-09-03T12:00:00Z",
  "workspace_id": "550e8400-e29b-41d4-a716-446655440000",
  "data": {
    "recipient_email": "[email protected]"
  }
}

data is the event payload stored with the event. It may be an empty object.

Signature

Verify X-Verifycate-Signature: hex-encoded HMAC-SHA256 of the raw request body using your endpoint secret.

Respond with HTTP 2xx to acknowledge. Other statuses are retried with backoff (30s, 2m, 15m, 1h, 4h, 12h, 24h) up to 7 attempts.

Event types

Lifecycle: recipient.enrolled, certificate.issued, certificate.bulk_sent, certificate.reissued, certificate.amended, certificate.deleted, certificate.created, certificate.updated, certificate.archived, template.published

Requests: request.submitted, request.approved, request.rejected, request.reopened

Corrections: correction.submitted, correction.approved, correction.rejected

Engagement: email.opened, email.clicked, certificate.opened_from_email, certificate.downloaded, share.linkedin_add, share.linkedin, share.x, share.facebook, share.whatsapp, share.telegram, share.email, share.link_copied, certificate.verified

Forms: form_invite.sent, request_form.opened, request_form.submitted

Subscribe to a list of types, or * for every event.