Build on Vaultform

A public API and signed webhooks for teams who want to create and read requests programmatically, or react to events in their own systems.

API

Bearer-token authenticated, scoped to your organization. Create a request, list your organization's requests, or fetch a single request's status and items.

curl -H "Authorization: Bearer vf_live_..." \
  https://vaultform.net/api/v1/requests

Generate a key from your dashboard's API Keys page once logged in.

Webhooks

Get notified when a request completes — Slack, Teams, or a generic webhook for Zapier, Make, or your own service. Generic webhooks are signed with HMAC-SHA256 (X-Vaultform-Signature header) so you can verify a payload actually came from Vaultform before acting on it.

Configure these from your dashboard's Integrations page.

Payload

Currently one event type: request.completed, sent when every item on a request is uploaded or acknowledged. Exact shape:

{
  "event": "request.completed",
  "requestId": "a1b2c3d4-...",
  "customerEmail": "customer@example.com",
  "customerName": "Jane Doe",
  "summary": "Jane Doe completed their request",
  "timestamp": "2026-08-12T14:30:00.000Z"
}

Verifying the signature (Node.js)

const crypto = require('crypto');

function isValidSignature(rawBody, signatureHeader, webhookSecret) {
  const expected = crypto
    .createHmac('sha256', webhookSecret)
    .update(rawBody)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signatureHeader)
  );
}

Use the raw request body (before JSON parsing) when computing the HMAC — a re-serialized body can differ byte-for-byte from what was actually signed. Your webhook secret is shown once when you first configure the integration.

What's not there yet

No SDKs, no rate-limit headers, no pagination beyond a 100-item cap on list endpoints, and no API versioning strategy beyond the current /v1 prefix. This is a real first version, not a mature platform — reach out if a specific gap is blocking you.