Webhooks
Webhook integration

Docusign Webhooks: Send Connect Events to Sazabi

By Sazabi Team

Webhook facts checked on the platform’s docs on Nov 8, 2026.

Docusign calls its webhook service Connect. When an envelope is sent, signed or declined, Connect sends an HTTPS POST to a URL you configure. This page uses the JSON SIM format, the one Docusign recommends, and shows how to store the events in Sazabi.

What Connect sends

The JSON SIM format sends one message per event rather than a summary of the whole envelope. Every message has an event element that names the event, standard fields such as uri, retryCount, configurationId, apiVersion and generatedDateTime, and a data element with the details for that event.

Envelope events include envelope-sent, envelope-delivered, envelope-completed, envelope-declined, envelope-voided, envelope-corrected, envelope-resent and envelope-deleted. Recipient events include recipient-sent, recipient-delivered, recipient-completed, recipient-declined, recipient-authenticationfailed and recipient-reassign.

An envelope-sent message carries accountId, userId, envelopeId and an envelopeSummary inside data. The Include Data setting controls how much else Connect adds.

Why send it to Sazabi

Signature events drive other systems: provisioning, order processing, archiving. When one of those downstream jobs fails, the first question is whether Docusign told you the envelope was complete. Sazabi's Webhook Events source stores each JSON payload as a searchable log record, so you can search for an envelopeId and see its events beside your application logs.

Add a path suffix to the intake URL, such as /docusign. Sazabi stores it as webhook.path, which keeps contract events separate from other webhook streams.

Set it up in Docusign

  1. Sign in to Docusign and select Admin. Under Integrations, select Connect.
  2. Select Add configuration, then Custom.
  3. Enter a name. In URL to Publish, paste your Sazabi intake URL with the /docusign suffix.
  4. Choose the JSON SIM message format.
  5. Select the triggering events you need, for example Envelope Sent and Envelope Completed.
  6. Under Include Data, pick the data to add. Docusign notes that including Documents can make messages too large for simple listeners.
  7. Leave the extra security options off. HMAC security (see below) signs each message. Sazabi's intake URL takes no authentication headers.
  8. Select Add configuration, then send yourself an envelope and complete it.

An account can define up to 20 Connect JSON configurations. If you have several apps listening, give Sazabi its own configuration.

Example payload

An abbreviated envelope-sent message, following the structure in the Docusign docs. It is an example, not a captured delivery.

{
  "event": "envelope-sent",
  "uri": "/restapi/v2.1/accounts/{accountId}/envelopes/{envelopeId}",
  "retryCount": 0,
  "configurationId": 10242474,
  "apiVersion": "v2.1",
  "generatedDateTime": "2021-05-14T23:15:56.3570000Z",
  "data": {
    "accountId": "0000000-0000-0000-0000-000000000000",
    "userId": "12345678-xxxx-xxxx-xxxx-123456789abc",
    "envelopeId": "cc6803ce-xxxx-xxxx-xxxx-3c4f50733703",
    "envelopeSummary": "rest of envelope summary"
  }
}

In a Sazabi thread, search for a top-level field such as webhook.event to isolate one event type. Envelope summaries can include signer names and email addresses, so choose Include Data deliberately.

What to watch for

  • Retry count in the body. retryCount is part of the message. Anything above 0 means Connect is re-sending.
  • Connect dashboard. It shows a timeline of successful and failed notifications and a retry count per event. If Require Acknowledgement is off, the dashboard shows no error data, so keep it on while you set this up.
  • Missing completions. An envelope that was signed but has no envelope-completed record in Sazabi is worth checking against the dashboard before you suspect the sender.
  • Order. Events are separate messages. Use generatedDateTime to order them, not arrival time.
  • Large messages. Documents in Include Data inflate payloads.

The Intake page in the Sazabi dashboard shows ingestion volume per source, which helps confirm that the stream is still flowing.

Retries

When delivery for an envelope fails, Connect retries with exponential back-off: five minutes later, then 10, 20 and 40 minutes later, then one hour, two hours and one day later, and after that once per day for 15 days. Because retries run for days, an endpoint that recovers can receive delayed events.

Docusign can sign messages with HMAC keys, one header per key. For code and ticket events from the same teams, see GitLab and Jira.

Docusign webhook facts

Signatures: Sazabi doesn’t check Docusign signatures by default, so it doesn’t reject unsigned or forged requests. Signature verification is in early access: contact support to turn it on for your organization, then verify signatures on the Webhook Events source with the Custom HMAC option (header X-Docusign-Signature-1, SHA-256, base64), and Sazabi rejects a delivery that fails the check with a 401. Docusign sends one header per HMAC key, so enter the header that matches the key you paste. Until it’s on, the intake URL is the only credential. It’s hard to guess, so keep it private, and rotate the project’s public key if it leaks.

  • Events: Connect triggering events include envelope-sent, envelope-delivered, envelope-completed, envelope-declined, envelope-voided, recipient-sent, recipient-completed and recipient-declined. (Docusign docs, accessed Nov 8, 2026)
  • Payload: A JSON SIM message is event-focused, with an event element, standard fields such as retryCount and generatedDateTime, and a data element holding the data unique to the event. (Docusign docs, accessed Nov 8, 2026)
  • Signing: With HMAC security enabled, each Connect message includes one header per HMAC key, such as X-Docusign-Signature-1, containing the message body hashed with HMAC-SHA256. (Docusign docs, accessed Nov 8, 2026)
  • Retries: If delivery for an envelope fails, Connect retries with exponential back-off, from five minutes later up to once per day over a 15-day span. (Docusign docs, accessed Nov 8, 2026)

Frequently Asked Questions

Does Docusign Connect send JSON?

Yes, in the JSON SIM format, which Docusign recommends for all apps. Each message is one event with an event name and a data object.

Which Docusign Connect events can I send to Sazabi?

Any trigger you select in the Connect configuration, such as envelope-sent, envelope-completed, envelope-declined or recipient-completed.

How long does Docusign Connect keep retrying?

It retries a failed envelope delivery at 5, 10, 20 and 40 minutes, then after one hour, two hours and one day, and then once a day over a 15-day span.

Does Sazabi verify Docusign signatures?

Not by default, and it doesn’t reject unsigned requests. Signature verification is in early access: contact support to turn it on for your organization, then turn on Verify signatures on the Webhook Events source with the Custom HMAC option (header X-Docusign-Signature-1, SHA-256, base64), and Sazabi rejects a delivery that fails the check with a 401. Docusign sends one header per HMAC key, so enter the header that matches the key you paste. Until it’s on, keep the intake URL private.

Sources

  1. Connect as an HTTPS POST webhook service, the retry sequence and the advantages over polling (accessed Nov 8, 2026)
  2. Creating a custom configuration under Admin, Integrations, Connect, with URL to Publish, triggering events and Include Data (accessed Nov 8, 2026)
  3. JSON SIM message structure, the envelope-sent example, enabling JSON SIM and the 20 configuration limit (accessed Nov 8, 2026)
  4. Full list of event triggers for envelopes and recipients (accessed Nov 8, 2026)
  5. HMAC security headers, one per key, hashed with HMAC-SHA256 (accessed Nov 8, 2026)
  6. Connect dashboard timeline of successful and failed notifications, retry count and the Require Acknowledgement note (accessed Nov 8, 2026)
  7. Webhook Events source: JSON only, payload under webhook.* attributes, path suffix stored as webhook.path; signature verification with the Standard Webhooks and Custom HMAC options, and rejected deliveries (accessed Nov 8, 2026)