Contents

Webhooks: send hivi-x events to your other systems

Webhooks: send hivi-x events to your other systems

Short answer: in Account → Webhooks, add an HTTPS endpoint and pick events. hivi-x POSTs a signed JSON event to it each time one of them happens. Every business plan includes webhooks.

Set up an endpoint

  1. Open Account → Webhooks (owner or admin).
  2. Enter the endpoint URL, an optional description, and tick the events to send.
  3. Choose Add endpoint and copy the signing secret. It's shown once; you can replace it later.
  4. Choose Send test event. A webhook.test event arrives, and hivi-x shows whether your endpoint answered with a 2xx status.

Up to 10 endpoints per workspace. For Zapier, Make or n8n, see Connect hivi-x to Zapier or Make.

Events

EventSent whenMain fields
client.createdA client is added: by hand, CSV import, capture or a converted leadclient (id, full name, email, phone, status, tags)
client.updatedA client's details are editedclient
client.deletedA client is deletedclient.id only
checklist.item_submittedA client completes an item or uploads a file, through a secure link or their portalclient, checklist, item, file (name, type, size), submittedVia
checklist.item_reviewedYour team approves or sends back a submissionitem.reviewStatus, rejectionReason, reviewedBy
checklist.completedEvery applicable item on a checklist is doneclient, checklist, completedAt
extraction.confirmedSomeone confirms values read with Read fieldsdocType, confirmed fields (never the passport number), newlyConfirmed
esign.envelope_completedEveryone has signed a signature requestenvelope, client.id, signers
document.expiringA document a client sent reaches 90, 30 or 7 days before its expiry date, or has expiredclient, checklist, item, file, expiresOn, daysLeft

Sample clients and the self-rehearsal client created for trials don't send events.

What a request looks like

POST /your/endpoint HTTP/1.1
Content-Type: application/json
User-Agent: hivi-x-webhooks/1.0
Hivi-Event-Id: evt_3f2b9c0d4e5f4a6b8c7d1e2f3a4b5c6d
Hivi-Event-Type: checklist.item_submitted
Hivi-Delivery-Id: 6b1d2c9e-...
Hivi-Signature: t=1761400800,v1=5f1c...
{
  "id": "evt_3f2b9c0d4e5f4a6b8c7d1e2f3a4b5c6d",
  "type": "checklist.item_submitted",
  "createdAt": "2026-10-25T14:00:00.000Z",
  "workspaceId": "a8c2...",
  "data": {
    "client": { "id": "d41e...", "fullName": "Jordan Smith" },
    "checklist": { "id": "9b77...", "name": "Rental application" },
    "item": { "id": "pay-stub", "label": "Two recent pay stubs", "type": "checkbox" },
    "file": { "id": "f3a1...", "name": "paystub-oct.pdf", "mimeType": "application/pdf", "size": 184322 },
    "submittedVia": "guest_link",
    "submittedAt": "2026-10-25T14:00:00.000Z"
  }
}

Ids stay the same across events, so a client.updated matches the client you stored from client.created. Check the signature before trusting a request: see Verify webhook signatures.

Delivery, retries and switching off

  • Answer with any 2xx status within 10 seconds. Anything else, a redirect or a timeout is a failure.
  • A failed delivery is retried after 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours, 12 hours and 24 hours: 8 attempts over about two days.
  • If 5 events in a row fail every attempt, the endpoint is switched off and the account owner gets an email. Turning it back on resets the count. Events that happened while it was off aren't sent later.
  • Delivery history keeps each delivery for 30 days with its status, HTTP code, error and the exact JSON body. Resend sends one again, once.
  • An event can arrive more than once and out of order. Use the event id to ignore repeats.
  • While the account is blocked (trial over, unpaid or ended subscription), nothing is sent.

Safety rules

  • HTTPS only, to public addresses. Private, local, link-local and cloud-metadata addresses are refused, and the address is checked again before every send. Redirects aren't followed.
  • No files are sent, only their names and sizes. Unconfirmed Read-fields values are never sent.
  • Deleting a client also deletes stored delivery bodies about that client, except the deletion event.
  • The owner and admins manage webhooks; adding, changing and deleting endpoints is recorded in the activity log.

The endpoint and whatever it forwards to are yours: hivi-x sends client data there because you set it up. Pick receivers you'd trust with that client data.

Limits

  • Webhooks are outbound only. To act in hivi-x from Zapier (create clients, send checklists), use the hivi-x app for Zapier. There's no app in the Make directory.
  • You choose event types, not fields. Each event always carries the fields in the table above: a client event always includes name, email and phone. There's no ids-only option.
  • One signing secret per endpoint; replacing it takes effect at once.

Related

Answers are general operational information only — not legal, tax, regulatory, clinical, privacy, immigration, or professional advice. Requirements vary by matter, client, and regulator.

Frequently asked questions

Does hivi-x have webhooks?
Yes, on every business plan. In Account → Webhooks, add an HTTPS endpoint, choose its events and copy its signing secret. hivi-x then POSTs a JSON event to it each time one of those events happens.
Does hivi-x work with Zapier or Make?
Yes. For Zapier there is the hivi-x app (invite-only while Zapier reviews it), with triggers and actions. With webhooks, use Webhooks by Zapier (Catch Hook) or Make's Custom webhook as the trigger, paste its URL into hivi-x and send a test event.
Which events can I receive?
client.created, client.updated, client.deleted, checklist.item_submitted, checklist.item_reviewed, checklist.completed, extraction.confirmed, esign.envelope_completed and document.expiring, plus webhook.test when you send a test.
Are uploaded files sent?
No. Events about uploads include the file's name, type and size, never the file or a download link.
What if my endpoint is down?
hivi-x retries a failed delivery up to 8 times over about two days. If five events in a row fail every retry, it switches the endpoint off and emails the account owner. Each delivery stays in the history for 30 days, where you can resend it.
How do I know a request really came from hivi-x?
Each request has a Hivi-Signature header with a timestamp and an HMAC-SHA256 of the timestamp and body, made with the endpoint's signing secret. Recompute it and compare. See Verify webhook signatures.
Who can set up webhooks?
The workspace owner and admins. Staff can't see or change them.

Organize client document intake with checklists

hivi-x helps Ontario professionals collect client documents with reusable checklists, secure Canadian hosting, and exportable PDF packages.

Webhooks for Zapier, Make and Your Own System | hivi-x Docs