Endpoint Design

Use HTTPS for all production endpoints

• Encrypt data in transit

• Required for compliance and security

Implement idempotency

• Handle duplicate event deliveries gracefully

• Same event delivered twice should have same effect

• Use transaction IDs or event IDs to detect duplicates

Respond quickly (< 30 seconds)

• Return HTTP 2xx status codes quickly

• Process heavy workloads asynchronously

• Conga Sign may timeout on slow responses

Log incoming payloads

• Store raw payloads for debugging

• Include timestamps and request headers

• Helps troubleshoot integration issues

Validate payload schema

• Verify payload structure matches expectations

• Handle missing or unexpected fields gracefully

• Log schema mismatches for investigation

Event Selection

Subscribe only to needed events

• Reduces unnecessary network traffic

• Minimizes endpoint processing load

• Lowers costs for metered APIs

Use filters to reduce noise

• Apply contract value thresholds

• Filter by customer, language, or other criteria

• Prevent unnecessary notifications

Consider separate callbacks

• Different callbacks for different event categories

• Easier to troubleshoot specific integrations

• Allows different routing/processing logic

Security

Always use authentication for production endpoints

• Never use "None" authentication in production

• Protect your endpoints from unauthorized access

Rotate credentials regularly

• Change API keys and OAuth secrets periodically

• Follow your organization's security policies

• Update callbacks after credential rotation

Validate incoming payloads

• Verify requests originate from Conga Sign

• Implement request signing or token validation

• Reject malformed or suspicious payloads

Implement IP whitelisting (if possible)

• Restrict access to Conga Sign IP ranges

• Add an extra layer of security

• Contact Conga Support for IP ranges

Use least-privilege credentials

• OAuth scopes should grant minimum necessary permissions

• API keys should have limited access

• Separate credentials for different integrations

Performance

Avoid enabling Document Bytes unless required

• Significantly increases payload size

• Impacts network bandwidth

• Slows delivery and processing

• Use Conga Sign APIs to fetch documents on-demand instead

Use filters to reduce payload volume

• Filter by contract value, customer, or status

• Prevents unnecessary data transmission

• Reduces processing overhead

Implement async processing

• Accept webhook immediately (return 200)

• Process heavy workloads in background queues

• Prevents timeouts and improves reliability

Monitor delivery success rates

• Review dashboard metrics regularly

• Investigate declining success rates

• Address endpoint performance issues proactively

Monitoring & Maintenance

Review dashboard regularly

• Check success rates and response times

• Identify trends or degradation

• Proactive issue detection

Set up alerting

• Monitor your endpoint's error logs

• Alert on failed deliveries or timeouts

• Integrate with your monitoring platform

Test after configuration changes

• Always use Test button after modifications

• Verify endpoint still responds correctly

• Check authentication still works

Document your integration

• Maintain internal documentation

• Include endpoint URLs, authentication details

• Document expected event handling logic