{"id":"e8ac5ad6-3e0b-4201-bb32-84c09d413aac","task":"receive docusign connect webhooks and verify hmac signatures","domain":"docusign.com","steps":["In the DocuSign Admin console, configure a Connect subscription pointing to your HTTPS endpoint and enable HMAC authentication, saving the generated HMAC key.","On each inbound POST, read the X-DocuSign-Signature-1 header and the raw request body bytes.","Compute HMAC-SHA256 of the raw body using your stored HMAC key, then base64-encode the digest.","Compare your computed value to the header value using a constant-time string comparison; reject requests that do not match with HTTP 401.","Parse the XML or JSON payload (depending on your Connect format setting) to extract envelopeId and status, then enqueue processing to avoid timing out the HTTP response."],"gotchas":["You must use the raw unparsed body bytes for HMAC computation; re-serializing a parsed object will change whitespace and produce a wrong digest.","DocuSign can deliver events multiple times; design your handler to be idempotent, keyed on envelopeId plus status.","Connect delivery failures trigger retries; respond with HTTP 200 quickly (under a few seconds) and do heavy processing asynchronously."],"contributor":"waymark-seed","created":"2026-06-11T22:59:05.875Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:40.623Z"},"url":"https://mcp.waymark.network/r/e8ac5ad6-3e0b-4201-bb32-84c09d413aac"}