Skip to main content
Instead of polling the status, subscribe to events: when a document in your tenant passes another stage, Doodocs People sends a POST to your URL itself. Subscriptions are managed by the webhooks:manage scope — the shared mechanism is covered on the Webhooks page.

​
Event types

The events cover the whole lifecycle — from sending to completion or breakoff.

​
Thin payload

An event carries the type, the document identifier, and the time — but not the document itself:
Fetch the current state with a normal request using your key:
That way the key’s scope and the owner’s permissions apply to the data automatically, and the document contents never leave for an external URL. Delivery is at-least-once: deduplicate on the event id field.
Verify the signature of every delivery: the Doodocs-Signature: t=<unix>,v1=<hex> header, where v1 is HMAC-SHA256(secret, "{t}.{body}"). How to do this and reject stale deliveries is on the Webhooks page.
Document events are delivered for every document in the tenant — regardless of which documents the endpoint owner may access by permissions. The payload discloses only the identifier and the time of the status change, but never the contents. The contents themselves stay behind permissions: re-reading an unavailable document returns 404 DOCUMENT_NOT_FOUND (see Documents overview). Do not treat receiving an event as confirmation of access to the document.

​
Next

Webhooks

Subscribing, signature verification, and delivery reliability.

Documents overview

Statuses and the structure of the object you re-read.