Skip to main content

API & Webhook Settings

Manage OAuth 2.0 API access and webhook subscriptions for third-party integrations like Zapier, Make, and custom applications.

Enterprise Feature

API access and webhooks are available exclusively on the Enterprise plan. Admins on other plans see an upgrade prompt on these tabs.

note

Only organization administrators can access the API Settings and Webhooks tabs.

API Settings Tab​

Navigate to Settings → API Settings to manage API access.

Enabling API Access​

API access is disabled by default. Use the toggle at the top of the tab to enable it. While disabled, OAuth clients cannot be created and third-party applications cannot access your organization's data.

OAuth Clients​

Each integration that connects to the API needs an OAuth client. The clients table shows:

  • Client ID - Public identifier (with copy button)
  • Allowed Scopes - Permissions granted to the client
  • Created date
  • Delete action

Creating an OAuth Client​

  1. Enable API access
  2. Click Create OAuth Client
  3. Enter a descriptive name (e.g., "Zapier Integration", "Mobile App")
  4. Select the scopes the client is allowed to request
  5. Add one or more redirect URIs (where users are sent after authorizing)
  6. Click Create Client
Save Your Client Secret

The client secret is shown only once, immediately after creation. Copy it and store it securely. If you lose it, delete the client and create a new one.

Available Scopes​

ScopeDescription
portal:readList and view portals
portal:writeCreate and update portals
file:listList file names and metadata
file:uploadUpload files
task:readList tasks
task:writeCreate, update, and complete tasks
guest:inviteInvite guests to portals
webhook:manageManage webhooks

Users authorizing a client can choose which of the allowed scopes to grant on the consent screen. Connected apps never have access to download file contents.

Webhooks Tab​

Navigate to Settings → Webhooks to manage webhook subscriptions. Webhooks send real-time HTTP notifications to your systems when events occur in your organization.

Webhook Table​

Each webhook shows:

  • URL - Where events are delivered
  • Events - Subscribed event types
  • Status - Active or Disabled
  • Stats - Successful / failed delivery counts
  • Last Triggered - Most recent delivery

Creating a Webhook​

  1. Click Create Webhook
  2. Enter the destination URL (must be HTTPS)
  3. Select one or more event types
  4. Click Create

Available Events​

EventWhen Triggered
portal.createdNew portal created
portal.workflow_changedPortal workflow state changed
file.uploadedFile uploaded to a portal
file.signedPDF signature completed
task.createdNew task created
task.completedTask marked as done — in the web app, via the API, or when a client uploads a document to a File Request
guest.invitedGuest invited to a portal

Every payload includes the portal's external system IDs (see External Systems), so a receiving system can match the event to its own record without calling the API. IDs can be set in the portal's settings panel or via the API's externalSystemIds field.

Webhook Actions​

For each webhook you can:

  • Pause/Resume - Temporarily disable without deleting
  • Send Test - Deliver a test event to verify your endpoint
  • View Delivery Logs - Inspect recent delivery attempts and responses
  • Copy Secret - Copy the signing secret for signature verification
  • Delete - Remove the webhook

Verifying Deliveries​

Every delivery is signed with HMAC-SHA256 using the webhook's secret. Verify the X-Webhook-Signature header on your endpoint before trusting the payload. See the Developer Quickstart for example code.

Failed deliveries are retried 3 times with exponential backoff.

Managing via API​

Everything on these tabs can also be managed programmatically — see the API Reference for the webhook endpoints.

Zapier​

The Zapa Client Portals app on Zapier uses this same API and creates its own OAuth client connection when a team member connects their account, so no OAuth client needs to be created here. It offers a trigger for each webhook event, actions for portals, files, tasks and guests, and searches to find a portal by name or by external system ID.