Agent Document Signing Webhooks: Get document.signed Without Polling

curl -X POST https://signb.ee/api/v1/send \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{
    "title": "Master Services Agreement",
    "markdown": "# Master Services Agreement\n\nThis agreement governs services rendered...",
    "recipient_name": "Bob Smith",
    "recipient_email": "bob@enterprise.com",
    "webhook_url": "https://api.yourdomain.com/webhooks/signbee"
  }'

{
  "document_id": "cmm8902abc12345678",
  "status": "pending_recipient",
  "sender": "Alice Chen",
  "recipient": "Bob Smith",
  "expires_at": "2026-09-11T12:00:00.000Z",
  "webhook_secret": "whsec_9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d"
}

{
  "error": "Webhooks require Pro or Business plan. Upgrade at https://signb.ee/dashboard",
  "plan": "FREE"
}

{
  "event": "document.signed",
  "document_id": "cmm8902abc12345678",
  "title": "Master Services Agreement",
  "status": "signed",
  "sender_email": "alice@startup.com",
  "recipient_name": "Bob Smith",
  "recipient_email": "bob@enterprise.com",
  "recipient_signed_at": "2026-09-04T14:32:18.102Z",
  "signed_pdf_url": "https://signb.ee/uploads/signed_cmm8902abc12345678.pdf",
  "signature_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
  "verify_url": "https://signb.ee/verify/cmm8902abc12345678",
  "timestamp": "2026-09-04T14:32:18.520Z"
}

import express, { Request, Response } from "express";
import crypto from "crypto";

const app = express();
const WEBHOOK_SECRET = process.env.SIGNBEE_WEBHOOK_SECRET || "whsec_...";

function verifySignbeeSignature(
  rawBody: Buffer,
  signatureHeader: string | undefined,
  secret: string
): boolean {
  if (!signatureHeader) return false;

  const hmac = crypto.createHmac("sha256", secret);
  hmac.update(rawBody);
  const calculatedHex = hmac.digest("hex");

  const calculatedBuf = Buffer.from(calculatedHex, "utf8");
  const headerBuf = Buffer.from(signatureHeader, "utf8");

  if (calculatedBuf.length !== headerBuf.length) {
    return false;
  }

  return crypto.timingSafeEqual(calculatedBuf, headerBuf);
}

// Preserve raw body buffer for verification
app.post(
  "/webhooks/signbee",
  express.raw({ type: "application/json" }),
  (req: Request, res: Response) => {
    const signature = req.headers["x-signbee-signature"] as string | undefined;

    if (!verifySignbeeSignature(req.body, signature, WEBHOOK_SECRET)) {
      console.error("Signature verification failed.");
      return res.status(401).json({ error: "Invalid signature" });
    }

    const payload = JSON.parse(req.body.toString("utf8"));
    
    if (payload.event === "document.signed") {
      console.log(`Document ${payload.document_id} signed by ${payload.recipient_name}`);
      console.log(`Verified PDF URL: ${payload.signed_pdf_url}`);
      console.log(`Tamper Hash: ${payload.signature_hash}`);
      // Trigger downstream agent actions or notify database
    }

    return res.status(200).json({ received: true });
  }
);

app.listen(3000, () => console.log("Webhook listener active on :3000"));

import hmac
import hashlib
import json
import os
from fastapi import FastAPI, Request, HTTPException, status
from fastapi.responses import JSONResponse

app = FastAPI()
WEBHOOK_SECRET = os.environ.get("SIGNBEE_WEBHOOK_SECRET", "whsec_...").encode("utf-8")

@app.post("/webhooks/signbee")
async def handle_signbee_webhook(request: Request):
  signature_header = request.headers.get("x-signbee-signature")
  if not signature_header:
    raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Missing signature header")

  # Read the raw unparsed request body buffer
  raw_body = await request.body()

  # Compute expected HMAC-SHA256 hex digest
  computed_hmac = hmac.new(WEBHOOK_SECRET, raw_body, hashlib.sha256).hexdigest()

  # Perform constant-time string comparison to prevent timing attacks
  if not hmac.compare_digest(computed_hmac, signature_header):
    raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid HMAC signature")

  payload = json.loads(raw_body.decode("utf-8"))

  if payload.get("event") == "document.signed":
    doc_id = payload.get("document_id")
    pdf_url = payload.get("signed_pdf_url")
    print(f"Contract executed: {doc_id} -> {pdf_url}")
    # Dispatch event to Celery worker or agent memory pipeline

  return JSONResponse(status_code=200, content={"received": True})

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"crypto/subtle"
	"encoding/hex"
	"encoding/json"
	"io"
	"log"
	"net/http"
	"os"
)

var webhookSecret = []byte(os.Getenv("SIGNBEE_WEBHOOK_SECRET"))

type SignbeePayload struct {
	Event         string `json:"event"`
	DocumentID    string `json:"document_id"`
	Title         string `json:"title"`
	Status        string `json:"status"`
	SignedPdfUrl  string `json:"signed_pdf_url"`
	SignatureHash string `json:"signature_hash"`
}

func handleSignbeeWebhook(w http.ResponseWriter, r *http.Request) {
	if r.Method != http.MethodPost {
		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
		return
	}

	sigHeader := r.Header.Get("X-Signbee-Signature")
	if sigHeader == "" {
		http.Error(w, "Missing signature header", http.StatusUnauthorized)
		return
	}

	rawBody, err := io.ReadAll(r.Body)
	if err != nil {
		http.Error(w, "Failed to read request body", http.StatusBadRequest)
		return
	}

	mac := hmac.New(sha256.New, webhookSecret)
	mac.Write(rawBody)
	expectedSig := hex.EncodeToString(mac.Sum(nil))

	// Constant-time byte comparison prevents side-channel timing leaks
	if subtle.ConstantTimeCompare([]byte(expectedSig), []byte(sigHeader)) != 1 {
		http.Error(w, "Signature verification failed", http.StatusUnauthorized)
		return
	}

	var payload SignbeePayload
	if err := json.Unmarshal(rawBody, &payload); err != nil {
		http.Error(w, "Invalid JSON payload", http.StatusBadRequest)
		return
	}

	if payload.Event == "document.signed" {
		log.Printf("Document completed: %s, PDF: %s", payload.DocumentID, payload.SignedPdfUrl)
	}

	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(http.StatusOK)
	w.Write([]byte(`{"received":true}`))
}

func main() {
	http.HandleFunc("/webhooks/signbee", handleSignbeeWebhook)
	log.Println("Go webhook receiver listening on :8080")
	log.Fatal(http.ListenAndServe(":8080", nil))
}