Nomio provides webhooks as part of its API. With webhooks, you can subscribe to a Nomio-specific event and we’ll send you a JSON event whenever that event triggers.

Getting Started

1. Go to **https://region.nomio.com/org/manage-api** where…

   • region is either app (UK), us or eu.
   • org is the identifier for your organisation in Nomio.

   You can find both by logging into Nomio and looking at the URL (e.g. https://app.nomio.com/infinity/agreements).

2. Fill in the webhook form:

   • Currently we provide only one event: *Agreement Signed Off.*
   • Supply a URL to send events to.

   

3. Note the UUID and Secret Token given to you:

   <aside> <img src="/icons/report_gray.svg" alt="/icons/report_gray.svg" width="40px" />

   Your Secret Token can only be copied in full when you create the key, so make sure you copy it and store it securely.

   </aside>

   

Events

Once set up, we’ll send your webhook listener an HTTPS POST request whenever the subscribed event triggers. The body of the request will be JSON encoded, and is event-dependent.

Currently, we only have one event you can subscribe to:

Agreement Signed Off

An Agreement is a collection of documents relating to the same legal agreement. Documents are organised into Agreements by Nomio during document processing.

The Agreement Signed Off event is fired whenever we are happy that all key information has been captured in the agreement’s documents.

Webhook listeners will receive the signed-off Agreement, as defined in the Swagger documentation.

Verifying Requests

Webhook listeners should be public and provide no authentication challenges to ensure that the event is delivered. This presents an obvious attack vector: how can we ensure that events received by the webhook listener are from Nomio, rather than an impersonator?

Requests sent by Nomio have headers that you can use to verify they are from Nomio and haven’t been tampered with.

<aside> <img src="/icons/report_gray.svg" alt="/icons/report_gray.svg" width="40px" /> We strongly recommend verifying messages to ensure they have come from Nomio. Webhook listening endpoints are public, and are therefore targets for vandalising companies’ internal data.

</aside>

To verify that a request is genuine:

1. Check that the Nomio-Webhook-UUID header matched the UUID from when you created the event.