Skip to content
LegalBook

Webhooks and website forms

Signed webhooks to send and receive events from any system, and signed website forms that create prospects.

For: Owner

On this page

Signed webhooks

A generic signed webhook connection lets any system exchange signed JSON with LegalBook: lead forms, relays, e-signature services or your own tools. It can receive leads, contacts, matters and e-signature completions, and optionally send signed JSON to one HTTPS address you configure.

Set it up

  1. Open Integrations and choose Generic signed webhook.
  2. LegalBook shows the endpoint address and a signing secret. The secret is shown once. Copy it and confirm before you leave the screen.
  3. Configure the sending system to sign each delivery with the secret.
  4. Map the records and fields you accept or send.

How deliveries are checked

  • Every delivery must carry a valid signature with a recent timestamp. The signature is checked before anything else.
  • A delivery received twice is recorded once. A replay of an old delivery is refused.
  • Rejected deliveries are kept without their body, and many rejections in a short time raise an alert.
  • Outbound calls go only to the HTTPS address you configured. Private, internal and loopback addresses are refused, redirects are not followed, and responses are size-limited.

Secrets can be rotated, with an overlap period so the sending system can switch over.

Website forms

Your own website can create prospects directly.

  1. A firm administrator sets the website form secret in the firm's intake settings. Until it is set, the form route does not exist.
  2. Your website signs each submission with the secret and posts it to LegalBook.
  3. LegalBook checks the signature, creates the prospect with the source Web form, and never creates the same submission twice.

Submissions then follow the normal intake process.