Skip to main content
WEBHOOK
document.event
{
  "event": "document.viewed",
  "renderId": "0193c2c3-1111-7aaa-8bbb-000000000001",
  "templateId": "0193c2c3-0000-7aaa-8bbb-000000000000",
  "shareId": "0193c2c3-3333-7aaa-8bbb-000000000003",
  "eventId": "0193c2c3-4444-7aaa-8bbb-000000000004",
  "eventType": "viewed",
  "actorKind": "recipient",
  "sourceIp": "203.0.113.7",
  "userAgent": "Mozilla/5.0 …",
  "metadata": null,
  "createdAt": "2026-06-05T11:03:00.000Z"
}

Authorizations

​
Authorization
string
header
required

Project API key (ck_live_… or ck_test_…) presented as a bearer token. For embed partner endpoints this is the partner secret key, which is the same credential type.

Headers

​
x-craftkit-event
string
required

The event name (mirrors the body's event field).

Example:

"render.succeeded"

​
x-craftkit-signature
string
required

HMAC-SHA256 of the raw request body, keyed with the subscription secret, hex-encoded (no prefix). Verify before trusting the payload.

​
x-craftkit-timestamp
string
required

Unix epoch seconds when the delivery was signed. Use with the signature to reject stale replays.

​
x-craftkit-delivery-id
string<uuid>
required

Stable delivery id, reused across retries. Key your idempotency on it.

Body

application/json

Body of a document.* engagement webhook.

​
event
enum<string>
required
Available options:
document.share_created,
document.share_revoked,
document.email_sent,
document.email_opened,
document.viewed,
document.downloaded,
document.printed
​
renderId
string<uuid>
required
​
templateId
string<uuid>
required
​
eventId
string<uuid>
required

Id of the recorded engagement event.

​
eventType
enum<string>
required

Bare engagement type.

Available options:
viewed,
downloaded,
printed,
email_opened,
email_sent,
share_created,
share_revoked
​
actorKind
enum<string>
required
Available options:
recipient,
partner,
system
​
createdAt
string<date-time>
required
​
shareId
string<uuid> | null

The share link involved, when the event originated from one.

​
sourceIp
string | null
​
userAgent
string | null
​
metadata
object | null

Custom metadata attached when the event was recorded.

Response

2XX

Return any 2xx to acknowledge. Non-2xx / timeout triggers retry.