Webhooks

Delivery and status events with HMAC signatures.

Polling for document status wastes rate limits; webhooks push every event:

• Events: document.received, document.delivered, document.delivery_failed, document.validation_failed, plus response documents (MLR, invoice response) as they arrive.
• Verification: every payload is signed with your endpoint’s HMAC secret (X-Signature header, SHA-256 over the raw body) — verify before trusting.
• Retries: failed deliveries retry with exponential backoff for 24 hours; design your handler to be idempotent (dedupe on event ID).
• Ordering is not guaranteed — a delivered event can arrive before the sent you expected; reconcile on document state, not event order.

Endpoint management, secrets and a webhook tester live in the sandbox — start with the quickstart.