# Accept Success Signing Webhook

Upon successful signing, Sign will notify the relying party (RP) via a webhook. The RP must implement and expose a webhook endpoint on their server to receive this notification. The webhook will inform the RP that a signing transaction has been successfully completed and provide the URL to download the signed document.

## Path

A <mark style="color:green;">`POST`</mark> request to the webhook URL that was provided to us during your [onboarding](https://docs.sign.singpass.gov.sg/for-relying-parties/how-our-api-works).&#x20;

## **Body**

A JSON object with only 1 field `token` .

```json
{
  "token": "xxxx"
}
```

The token is a standard [JSON Web Token](https://datatracker.ietf.org/doc/html/rfc7519) with payload:

* `request_type`: Always `signed_doc_url`
* `signed_doc_url`: Where you can download the signed document. This link will expire after 2 minutes.&#x20;
* `request_id`: Same as the request id returned during initiate sign request
* `signer_info` : an object containing the following information:
  * `signer_name` : Name of the signer as per the user cert CN
  * `signer_partial_uinfin` : The last 4 alphanumerical value of the signer's NRIC
  * `signed_at` : Unix timestamp in milliseconds of when the user completed the sign request.
* `iat` & `exp`: Standard Issued At / Expiration timestamp of JWT. The expiry of the token is set to 2 minutes. The `signed_doc_url`  will expire within the `exp` as well.&#x20;

{% hint style="danger" %}
RP are required to implement token validation by fetching the [#sign-with-singpass-jwks](https://docs.sign.singpass.gov.sg/for-relying-parties/api-documentation/jwks-specification#sign-with-singpass-jwks "mention"), and verify the signature, expiration, and claims contained in the JWT.
{% endhint %}

{% hint style="danger" %}
RP are required to download the document **immediately** as the `signed_doc_url` will expire in 2 minutes. We do not recommend RP to send the `signed_doc_url` to user for the same reason.
{% endhint %}

**Example:**&#x20;

{% code overflow="wrap" %}

```
eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InNpZ24tZGV2LTAxIn0.eyJzaWduZWRfZG9jX3VybCI6Imh0dHBzOi8vZGV2LnNpZ24uc2luZ3Bhc3MuZ292LnNnL3NpZ25lZC90ZXN0LXNpZ25lZC1wZGYtaWQ_RXhwaXJlcz0xNzU4NjE2MDM0JktleS1QYWlyLUlkPUsyQUUwQzdLRkhNODJOJlNpZ25hdHVyZT1EZ1FBY0V-ZjhWT2xJTmUybkYtWFlKYVJTMXQ2RzQ5ckcyZnJKUzJVT29wbDR6SnpmcH5-flBhRHFoaH52RzBxanVJQjFjOFg1QWtrdG15NkNRcDNPN2QwNHBmN1RnZm5ZaW5pakJLT3Z3Ui1KdEpjOUFzcGx2VzJ0NUQzNXBRbjFyLVFNVURrOUFQYUJRVWh4eX4wNTE0RDN4bXBoS2hidmFXeUN5QXBEaWRlLUlYelo3QzVRMWxpUDNVQ1JiLUxsdWpKLU4xUUZTaWN5dnNmNWhjanRQVUw5Tk5GRG5OdFlYR2U1Y29pOX5kZ0lramNQbEZzS29KdTBkS3UtbzA2UDhEMFhzeExkTllrRjlnY051bVBiOHNxOXE1ZjhkVHNBUUIwNnhFMmp3dVhmaTR5eG8yalRQTmczRGhxeWxiTi1aWkkwWjJrQk8tM0U3bHROQXliVUFfXyIsInNpZ25lcl9pbmZvIjp7InNpZ25lcl9uYW1lIjoiVXNlciBTMzE3Njc0OUQiLCJzaWduZXJfcGFydGlhbF91aW5maW4iOiI3NDlEIiwic2lnbmVkX2F0IjoxNzU4NjE1OTEzNTY3fSwiZXhwIjoxNzU4NjE2MDMzfQ.xxx
```

{% endcode %}

## Response

It is sufficient to respond with only 2XX HTTP status code without any response body.

## Retry Settings <a href="#retry-settings" id="retry-settings"></a>

Singpass will perform automated retries of webhook calls in the case of timeouts or certain errors.&#x20;

```
Per try timeout: 2s
Delay between each retry: 2s
Max attempts: 3
```

{% hint style="danger" %}
RP are required to respond to the webhook request within **2 seconds.**
{% endhint %}

## **IP Address**

We strive to maintain consistent egress IPs, but please note that they are subject to change with short notice.

* **Staging:**
  * 54.169.20.186
* **Production:**
  * 18.143.229.39
  * 54.179.76.90
  * 3.0.39.45