Skip to main content
WEBHOOK
form.event
{
  "event": "form.submitted",
  "sessionId": "0193c2c3-5555-7aaa-8bbb-000000000005",
  "templateSlug": "e-charterparty",
  "templateVersion": 6,
  "renderId": null,
  "data": {
    "customer": {
      "name": "Acme Corp"
    },
    "amount": 42
  },
  "submittedAt": "2026-06-05T11:00:00.000Z"
}

Authorizations

​
Authorization
string
header
required

Project API key (ck_live_… or ck_test_…) presented as a bearer token. For embed partner endpoints this is the partner secret key, which is the same credential type.

Headers

​
x-craftkit-event
string
required

The event name (mirrors the body's event field).

Example:

"render.succeeded"

​
x-craftkit-signature
string
required

HMAC-SHA256 of the raw request body, keyed with the subscription secret, hex-encoded (no prefix). Verify before trusting the payload.

​
x-craftkit-timestamp
string
required

Unix epoch seconds when the delivery was signed. Use with the signature to reject stale replays.

​
x-craftkit-delivery-id
string<uuid>
required

Stable delivery id, reused across retries. Key your idempotency on it.

Body

application/json

Body of a form.submitted webhook, emitted by collect-only embed fill sessions. data is the complete merged, manifest-keyed, coerced field set (prefill + user entries, user wins) — byte-symmetric with what the render API accepts, so it can be stored and re-rendered verbatim. Ephemeral: retained only until acknowledged, then purged.

​
event
enum<string>
required
Available options:
form.submitted
​
sessionId
string<uuid>
required

The embed fill session that produced the submission.

​
templateSlug
string
required

Slug of the template the form was scoped to.

​
templateVersion
integer
required

Published version number the data was validated against.

​
renderId
string<uuid> | null
required

Null in collect-only mode (no render was created).

​
data
object
required

The complete merged, manifest-keyed, coerced field set.

​
submittedAt
string<date-time>
required

Response

2XX

Return any 2xx to acknowledge. Non-2xx / timeout triggers retry.