Webhooks

{  "event": "form_submitted",  "form": {    "id": "00000000-0000-4000-8000-000000000001",    "title": "Tax check-up",    "url": "https://app.oneform.si/f/tax-check-up"  },  "response": {    "id": "00000000-0000-4000-8000-000000000002",    "submitted_at": "2026-10-01T15:04:05.000Z",    "device": "mobile",    "lang": "en",    "ending": "default"  },  "respondent": {    "name": "Maya Lee",    "first_name": "Maya",    "last_name": "Lee",    "email": "[email protected]",    "phone": "+1 555 0100",    "company": ""  },  "answers": [    {      "id": "contact",      "question": "Your details",      "type": "contact_group",      "answer": "First name: Maya · Last name: Lee · Email: [email protected] · Phone: +1 555 0100"    },    {      "id": "income",      "question": "Roughly what was your income last year?",      "type": "short_text",      "answer": "$120,000"    },    {      "id": "goal",      "question": "What would you like help with?",      "type": "long_text",      "answer": "Lower my taxes next year."    }  ],  "fields": {    "contact": "First name: Maya · Last name: Lee · Email: [email protected] · Phone: +1 555 0100",    "income": "$120,000",    "goal": "Lower my taxes next year."  },  "variables": {},  "hidden": {    "utm_source": "newsletter"  },  "report": null}

{  "event": "report_approved",  "form": {    "id": "00000000-0000-4000-8000-000000000001",    "title": "Tax check-up",    "url": "https://app.oneform.si/f/tax-check-up"  },  "response": {    "id": "00000000-0000-4000-8000-000000000002",    "submitted_at": "2026-10-01T15:04:05.000Z",    "device": "mobile",    "lang": "en",    "ending": "default"  },  "respondent": {    "name": "Maya Lee",    "first_name": "Maya",    "last_name": "Lee",    "email": "[email protected]",    "phone": "+1 555 0100",    "company": ""  },  "answers": [    {      "id": "contact",      "question": "Your details",      "type": "contact_group",      "answer": "First name: Maya · Last name: Lee · Email: [email protected] · Phone: +1 555 0100"    },    {      "id": "income",      "question": "Roughly what was your income last year?",      "type": "short_text",      "answer": "$120,000"    },    {      "id": "goal",      "question": "What would you like help with?",      "type": "long_text",      "answer": "Lower my taxes next year."    }  ],  "fields": {    "contact": "First name: Maya · Last name: Lee · Email: [email protected] · Phone: +1 555 0100",    "income": "$120,000",    "goal": "Lower my taxes next year."  },  "variables": {},  "hidden": {    "utm_source": "newsletter"  },  "report": {    "id": "00000000-0000-4000-8000-000000000003",    "title": "Your tax opportunities",    "status": "approved",    "summary": "Three ways to lower next year's bill.",    "highlights": [      "Max out your 401(k)",      "Open an HSA",      "Bunch charitable gifts"    ],    "review_url": "https://app.oneform.si/reviews/00000000-0000-4000-8000-000000000003"  }}

{  "event": "booking_made",  "form": {    "id": "00000000-0000-4000-8000-000000000001",    "title": "Tax check-up",    "url": "https://app.oneform.si/f/tax-check-up"  },  "response": {    "id": "00000000-0000-4000-8000-000000000002",    "submitted_at": "2026-10-01T15:04:05.000Z",    "device": "mobile",    "lang": "en",    "ending": "default"  },  "respondent": {    "name": "Maya Lee",    "first_name": "Maya",    "last_name": "Lee",    "email": "[email protected]",    "phone": "+1 555 0100",    "company": ""  },  "answers": [    {      "id": "contact",      "question": "Your details",      "type": "contact_group",      "answer": "First name: Maya · Last name: Lee · Email: [email protected] · Phone: +1 555 0100"    },    {      "id": "income",      "question": "Roughly what was your income last year?",      "type": "short_text",      "answer": "$120,000"    },    {      "id": "goal",      "question": "What would you like help with?",      "type": "long_text",      "answer": "Lower my taxes next year."    }  ],  "fields": {    "contact": "First name: Maya · Last name: Lee · Email: [email protected] · Phone: +1 555 0100",    "income": "$120,000",    "goal": "Lower my taxes next year."  },  "variables": {},  "hidden": {    "utm_source": "newsletter"  },  "report": null,  "booking": {    "id": "00000000-0000-4000-8000-000000000004",    "title": "Tax strategy call",    "status": "confirmed",    "starts_at": "2026-10-08T14:00:00.000Z",    "ends_at": "2026-10-08T14:30:00.000Z",    "duration_min": 30,    "time_zone": "America/New_York",    "location": "https://zoom.us/j/0000000000",    "join_url": "https://zoom.us/j/0000000000",    "invitee": {      "name": "Maya Lee",      "email": "[email protected]",      "phone": "+1 555 0100",      "time_zone": "America/Chicago"    }  }}

import { createHmac, timingSafeEqual } from "node:crypto"; /** Verifies a OneForm webhook. rawBody: the exact bytes received (before JSON.parse). */export function verifyOneForm(rawBody: string, header: string | null, secret: string, toleranceSec = 300): boolean {  const parts = Object.fromEntries((header ?? "").split(",").map((p) => p.trim().split("=") as [string, string]));  const t = Number(parts.t);  if (!t || !parts.v1 || Math.abs(Date.now() / 1000 - t) > toleranceSec) return false;  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");  const a = Buffer.from(expected, "hex");  const b = Buffer.from(parts.v1, "hex");  return a.length === b.length && timingSafeEqual(a, b);} // Next.js route handler:// export async function POST(req: Request) {//   const raw = await req.text();//   if (!verifyOneForm(raw, req.headers.get("x-oneform-signature"), process.env.ONEFORM_WEBHOOK_SECRET!)) return new Response("bad signature", { status: 401 });//   const event = JSON.parse(raw); // dedupe on req.headers.get("x-oneform-delivery")//   return new Response("ok");// }

import hashlib, hmac, time def verify_oneform(raw_body: bytes, header: str, secret: str, tolerance: int = 300) -> bool:    parts = dict(p.strip().split("=", 1) for p in (header or "").split(",") if "=" in p)    try:        t = int(parts["t"])    except (KeyError, ValueError):        return False    if abs(time.time() - t) > tolerance or "v1" not in parts:        return False    expected = hmac.new(secret.encode(), f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()    return hmac.compare_digest(expected, parts["v1"])

<?phpfunction verify_oneform(string $rawBody, ?string $header, string $secret, int $tolerance = 300): bool {    $parts = [];    foreach (explode(',', $header ?? '') as $p) { [$k, $v] = array_pad(explode('=', trim($p), 2), 2, ''); $parts[$k] = $v; }    $t = (int)($parts['t'] ?? 0);    if (!$t || empty($parts['v1']) || abs(time() - $t) > $tolerance) return false;    $expected = hash_hmac('sha256', $t . '.' . $rawBody, $secret);    return hash_equals($expected, $parts['v1']);}

package oneform import (	"crypto/hmac"	"crypto/sha256"	"encoding/hex"	"strconv"	"strings"	"time") func Verify(rawBody []byte, header, secret string, tolerance time.Duration) bool {	parts := map[string]string{}	for _, p := range strings.Split(header, ",") {		if kv := strings.SplitN(strings.TrimSpace(p), "=", 2); len(kv) == 2 {			parts[kv[0]] = kv[1]		}	}	t, err := strconv.ParseInt(parts["t"], 10, 64)	if err != nil || parts["v1"] == "" || time.Since(time.Unix(t, 0)).Abs() > tolerance {		return false	}	mac := hmac.New(sha256.New, []byte(secret))	mac.Write([]byte(parts["t"] + "."))	mac.Write(rawBody)	want, _ := hex.DecodeString(parts["v1"])	return hmac.Equal(mac.Sum(nil), want)}

require "openssl" def verify_oneform(raw_body, header, secret, tolerance = 300)  parts = (header || "").split(",").map { |p| p.strip.split("=", 2) }.to_h  t = parts["t"].to_i  return false if t.zero? || parts["v1"].nil? || (Time.now.to_i - t).abs > tolerance  expected = OpenSSL::HMAC.hexdigest("SHA256", secret, "#{t}.#{raw_body}")  OpenSSL.fixed_length_secure_compare(expected, parts["v1"])end

curl https://app.oneform.si/api/v1/triggers/form_submitted/sample \  -H "Authorization: Bearer $ONEFORM_API_KEY"

const res = await fetch("https://app.oneform.si/api/v1/triggers/form_submitted/sample", {  headers: {    Authorization: `Bearer ${process.env.ONEFORM_API_KEY}`,  },});if (!res.ok) throw new Error(`OneForm answered ${res.status}: ${await res.text()}`);const data = await res.json();

import osimport requests res = requests.get(    "https://app.oneform.si/api/v1/triggers/form_submitted/sample",    headers={"Authorization": f"Bearer {os.environ['ONEFORM_API_KEY']}"},    timeout=30,)res.raise_for_status()data = res.json()

<?php$ch = curl_init("https://app.oneform.si/api/v1/triggers/form_submitted/sample");curl_setopt_array($ch, [    CURLOPT_CUSTOMREQUEST => "GET",    CURLOPT_HTTPHEADER => [        "Authorization: Bearer " . getenv("ONEFORM_API_KEY"),    ],    CURLOPT_RETURNTRANSFER => true,]);$data = json_decode(curl_exec($ch), true);$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);

package main import (	"fmt"	"io"	"net/http"	"os") func main() {	req, err := http.NewRequest("GET", "https://app.oneform.si/api/v1/triggers/form_submitted/sample", nil)	if err != nil {		panic(err)	}	req.Header.Set("Authorization", "Bearer "+os.Getenv("ONEFORM_API_KEY"))	res, err := http.DefaultClient.Do(req)	if err != nil {		panic(err)	}	defer res.Body.Close()	out, _ := io.ReadAll(res.Body)	fmt.Println(res.Status, string(out))}

require "net/http"require "json" uri = URI("https://app.oneform.si/api/v1/triggers/form_submitted/sample")req = Net::HTTP::Get.new(uri)req["Authorization"] = "Bearer #{ENV.fetch('ONEFORM_API_KEY')}"res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(req) }data = JSON.parse(res.body)