The Common Paper webhook notifications allow you to extend the activity around your agreements to other parts of your organization.
What can you do with webhooks?
There are a wide variety of uses for webhooks, but the easiest way to get started with them is to use a service like Zapier. This tool can accept incoming webhooks like the ones sent from Common Paper, and can then use that information to quickly and easily push it into other tools and services.
Some examples of what you could do include:
Send updates about your agreements to a common Slack channel
Automatically email documents to a recipient after an NDA has been signed
Notify your attorney if a recipient proposes changes
Update your CRM when an agreement is sent or signed
How to configure webhooks
In the Integrations section in your Common Paper account, you can configure webhooks to fire each time something happens during the agreement flow. All that’s needed is the URL endpoint where you would like the notifications sent.
Technical details
For a full listing of the events that trigger the webhooks to be sent and the JSON payload that is sent each time, check out our API documentation.
Securing webhooks with a signature
To verify that webhook payloads are genuinely sent by Common Paper, you can configure a webhook secret. In the Integrations section, enter a secret token alongside your callback URL. Once a secret is set, Common Paper will include an X-SIGNATURE header with every webhook delivery. This header contains an HMAC-SHA256 signature of the request body, prefixed with sha256=.
Validating the signature
To validate a delivery, compute an HMAC-SHA256 hash of the raw request body using your secret token, and compare the result to the value in the X-SIGNATURE header.
Here is an example in Python:
import hashlib
import hmac
def verify_signature(payload_body, secret_token, signature_header):
"""Verify that the payload was sent from Common Paper
by validating the X-SIGNATURE header."""
expected_signature = "sha256=" + hmac.new(
secret_token.encode("utf-8"),
msg=payload_body,
digestmod=hashlib.sha256,
).hexdigest()
if not hmac.compare_digest(expected_signature, signature_header):
raise Exception("Request signatures didn't match!")
And in Ruby:
def verify_signature(payload_body, secret_token, signature_header)
expected_signature = "sha256=" + OpenSSL::HMAC.hexdigest(
OpenSSL::Digest.new("sha256"),
secret_token,
payload_body
)
raise "Request signatures didn't match!" unless Rack::Utils.secure_compare(expected_signature, signature_header)
end