---
title: "Webhooks - Rest PKI Core"
description: "Webhooks of Rest PKI Core: event notifications sent to your app as HTTP POST requests, such as DocumentSignatureCompleted, with a sample payload."
canonical: "https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/webhooks"
locale: "en"
product: "Rest PKI Core"
last_updated: "2026-10-20"
---

# Webhooks - Rest PKI Core

You may configure your [Rest PKI Core](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core) subscription to send event notifications to your app. The following notifications are currently available:

Event type                   | Description
---------------------------- | -----------
`DocumentSignatureCompleted` | Triggered when a document is signed and has finished being processed

If enabled, webhook notifications consist of HTTP `POST` requests with a `WebhookEventModel` in JSON. See the [API Reference](https://core.pki.rest/swagger) for the model schema.

A sample webhook notification of a `DocumentSignatureCompleted` event is shown below:

```json
{
	"type": "DocumentSignatureCompleted",
	"document": {
		"id": "3dfdd6f0-884e-4092-abed-00f18ea6716a",
		"key": "FUFYQ7SL6XKMBW9A",
		"formattedKey": "FUFY-Q7SL-6XKM-BW9A",
		"dateCreated": "2026-10-12T14:31:07.5310000-03:00",
		"subscriptionId": "6e1ffc5e-4c0a-4f5b-9a0f-2d1b8c0f7a41",
		"originalFile": {
			"name": "P100001-001.pdf",
			"mimeType": "application/pdf",
			"length": 101730,
			"url": "https://..."
		},
		"markedFile": null,
		"signedFile": {
			"name": "P100001-001.pdf",
			"mimeType": "application/pdf",
			"length": 273429,
			"url": "https://..."
		},
		"signatureType": "Pdf",
		"availableUntil": "2026-11-11T14:31:07.5310000-03:00",
		"signers": [
			{
				"certificate": {
					"thumbprint": "...",
					"thumbprintSHA256": "...",
					"subjectCommonName": "Pierre de Fermat:47363361886",
					"subjectDisplayName": "Pierre de Fermat",
					"subjectIdentifier": "47363361886",
					"emailAddress": "test@lacunasoftware.com",
					"organization": null,
					"organizationIdentifier": null
				},
				"date": "2026-10-12T14:31:41.2070000-03:00"
			}
		],
		"metadata": {},
		"signatureSessionIds": [
			"a9d1d2b7-0b0e-4d4b-8d4c-5b3a1f0c9e27"
		]
	}
}
```

The `document` is a `DocumentModel`, the same model that `GET api/documents/{id}` returns. `signatureType` is `Pdf`, `Cms` or `Xml`. Each file's `url` is a temporary
link that downloads the file without the API key and expires after a short time, normally one hour, so download the file instead of storing the link. Each file
also carries `contentType` and `location`, deprecated copies of `mimeType` and `url` kept for older clients, and `content` and `blobToken`, which are null; the
sample omits them. The `markedFile` is the PDF with the [validation marks](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/pdf-marking), when there is one.

Your app must answer with a 2xx status code. Any other response, or no response at all, counts as a failed notification.

## Configuring webhooks

Webhook notifications are configured for each subscription, on the dashboard of the Rest PKI Core instance ([https://core.pki.rest/](https://core.pki.rest/) on the
SaaS instance), by a user with the **Admin** or **Manager** role on the subscription:

1. Sign in to the dashboard and click **Settings** on the left menu
1. On the **Webhook config** box, in the **Configuration** tab, turn on **Enable webhook**
1. Fill out the **URL** to which the HTTP requests should be made
1. Choose an **Authentication type**:
   * **NoAuth**: no credentials are sent
   * **Basic**: fill out a **Username** and a **Password**, sent on the `Authorization` request header with scheme `Basic`
   * **Bearer**: fill out the **Authentication Token**, sent on the `Authorization` request header with scheme `Bearer`
   * **ApiKey**: fill out the **Authentication Token**, sent on the `X-Api-Key` request header
1. Click **Save**

> **Warning**
>
> With **Basic**, Rest PKI Core encodes the username and the password in Base64 separately and joins them with a colon: the header is
> `Authorization: Basic base64(username):base64(password)`, not the Base64 of `username:password` that RFC 7617 describes. A standard Basic authentication handler
> rejects it, so check the header yourself, or choose **Bearer** or **ApiKey**.

The **Recent calls** tab lists the notifications sent, with their status, the time of the last attempt and the response of your app.

**Demos and samples**

- Receive Rest PKI Core webhooks: [.NET](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/dotnet/mvc/PkiSuiteAspNetMvcSample/Controllers/WebhookRestCoreController.cs) · [Java](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/java/springmvc/src/main/java/com/lacunasoftware/pkisuite/controller/WebhookRestCoreController.java) · [PHP](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/php/plain/public/webhook-rest-core/index.php)