# Webhooks

> Planned GoForma webhooks for deadlines, filings, post and requests.

# Webhooks

> **Status: planned, not live.**

## Subscribing

`POST /v1/webhooks` with `{ "url": "https://…", "events": ["filing.status_changed"] }` returns an `id` and a signing `secret`. `GET /v1/webhooks` lists your subscriptions and `DELETE /v1/webhooks/{id}` removes one. This is the subscribe and unsubscribe pattern Zapier, Make and n8n use.

## Events

| Event | Sent when |
|---|---|
| `deadline.created` | GoForma adds a deadline |
| `deadline.due_soon` | A deadline is close |
| `filing.status_changed` | A filing moves on |
| `mail.received` | Post arrives at your virtual office |
| `request.updated` | GoForma replies to or closes your request |

## Payloads are thin

```json
{
  "id": "evt_…",
  "type": "filing.status_changed",
  "occurred_at": "2026-11-02T09:14:00Z",
  "company_id": "…",
  "resource_url": "https://mcp.goforma.com/v1/filings/…"
}
```

Fetch the details from `resource_url` with your own token. No client data sits in delivery logs, and disconnecting stops the data at once.

## Verifying a delivery

Each request carries `GoForma-Signature: t=<unix time>,v1=<hex>`, an HMAC-SHA256 of `<t>.<raw body>` with your secret. Reject anything older than five minutes. Failed deliveries are retried with backoff for 24 hours, then the subscription is paused.