Flowgrammer

PandaDoc Webhook Verification Pack

Original PandaDoc webhook pack with HMAC hex query vectors, Event-Id replay cases, and twenty-two fictional fixtures.

Download the webhook verification pack (ZIP)

Download this pack when PandaDoc documents already go out and you need to prove query-signature HMAC and pdf_ready timing before SignatureEvidence accepts a row. The pack implements the PandaDoc E-Signature Automation adapter and the published E-Signature Automation control plane. It includes fiction HMAC vectors, Event-Id replay cases, twenty-two fixtures, and a forbidden-downstream sheet.

Read the paired guide first: PandaDoc E-Signature Automation. Keep the shared Signing Workflow Requirements Workbook nearby for the field list. If you already verify DocuSign Connect, keep the published DocuSign E-Signature Automation page for that HMAC. If you already acknowledge Dropbox Sign callbacks, keep the published Dropbox Sign E-Signature Automation page for that event_hash. If you already echo Acrobat Sign Application IDs, keep the published Adobe Acrobat Sign Automation page for that CLIENTID check. Those checks are not interchangeable.

Download the webhook verification pack (ZIP)

The ZIP includes HMAC hex vectors, Event-Id notes, JSON array files, setup notes, a pdf_ready matrix, and SX01 through SX12 plus SX-PD-01 through SX-PD-10. Samples stay fictional on 9 September 2026. No live PandaDoc tenant is included, and this is not a Marketplace listing.

What you get

  • HMAC hex tests for the signature query parameter
  • Raw-body versus re-serialized JSON
  • X-PandaDoc-Webhook-Event-Id replay cases
  • JSON array payloads with mixed event types
  • ACK below 400 versus an accidental 410
  • Three retries and the seven-day soft-deactivate window
  • document_completed_pdf_ready versus recipient_completed
  • Download-protected 200 versus 202
  • Forbidden-downstream rules for payment, bank-detail change, accounting, auto-renew, and auto-terminate
  • Twenty-two fictional Cedar and Quay cases on DOC-CQ-SIGN-014

Keep these jobs separate

A completed document is not Document Approval DecisionEvidence. This pack covers the PandaDoc webhook adapter. Submit for approval may implement a vendor-hosted gate. That surface does not automatically become Flowgrammer Document Approval DecisionEvidence. Use the published Document Approval Workflow when an org decision is required. This pack does not run IDP or OCR. Use invoice processing automation or the contract tracker when money or renewal is the actual job.

If you still need the shared signing model, start with E-Signature Automation. If you still need to choose a first workflow, start with Document Processing Automation.

How to start

  1. Read README.md, then markdown/setup.md.
  2. Walk csv/hmac-query-tests.csv and csv/idempotency-table.csv.
  3. Confirm HQ01 passes and HQ02 fails when the body is pretty-printed.
  4. Confirm ACK below 400 queues work and a 21-second sync handler fails.
  5. Walk SX01 through SX12, then SX-PD-01 through SX-PD-10.
  6. Keep the paired PandaDoc E-Signature Automation guide nearby.

If webhook enablement, shared values, or the event log are still unclear, start with an AI Success Audit. If they are named, book a fit call to scope an AI Automation Systems build.

Book an AI Success Audit call