EverStamp API

An API key from the dashboard (Settings, Integrations): `esk_` followed by 32 characters. Send it as `Authorization: Bearer esk_...`. It acts for one organisation with the rights of an administrator.

Revoke a key the moment it leaks; a revoked key stays revoked. Keys act with the rights of an administrator, so keep them server-side, never in an app or a browser. One key per piece of software makes the audit log readable: every order an integration prepares carries the key name.

Errors are JSON with a stable error code and a human message. Codes you will meet: api-key (401), invalid-body (400), unknown-member, unknown-template, unknown-project (422), order-claimed (409: the order was picked up, the dossier exists), rate-limit (429, with Retry-After).

Lists return at most 500 orders and 100 dossiers per page; page dossiers with before. Calls are idempotent where it matters: withdrawing twice is fine, a phone picking up twice with the same dossier is fine. The API is versioned in the path (/v1); fields are only ever added, never renamed or removed within a version.

Add a webhook in the dashboard (Settings, Integrations) with an https URL and the events you want. Every delivery is a POST with the Standard Webhooks headers webhook-id, webhook-timestamp and webhook-signature (v1, plus base64 of HMAC-SHA256 over id.timestamp.body with your secret, shown once). Answer any 2xx within five seconds; otherwise we retry after 1, 5, 30 minutes, 2 and 12 hours, and switch the webhook off after eight failures in a row. The same webhook-id is reused on retries, so you can deduplicate.

{ "format": "everstamp/3", "event": "dossier.registered", "at": "2026-09-05T14:53:10Z", "organisation": "01M1...", "data": { "dossier": { ... }, "order": { ... } } }

import { createHmac, timingSafeEqual } from 'node:crypto';

const secret = Buffer.from(process.env.WEBHOOK_SECRET.replace('whsec_', ''), 'base64');
const id = req.headers['webhook-id'], ts = req.headers['webhook-timestamp'];
const expected = 'v1,' + createHmac('sha256', secret).update(`${id}.${ts}.${rawBody}`).digest('base64');
const ok = timingSafeEqual(Buffer.from(expected), Buffer.from(req.headers['webhook-signature']));
if (!ok || Math.abs(Date.now() / 1000 - Number(ts)) > 300) return res.status(401).end();

No code needed for the two things most companies want: hear it when a dossier is registered, and prepare an order from something that already exists (a form, a planning tool, a CRM). The webhook URL these tools give you is unguessable, which is the shared secret for a no-code receiver; verify the signature only if the tool lets you run code.

{
  "name": "EverStamp: dossier registered",
  "nodes": [
    {
      "parameters": {
        "httpMethod": "POST",
        "path": "everstamp",
        "responseMode": "onReceived"
      },
      "name": "EverStamp webhook",
      "type": "n8n-nodes-base.webhook",
      "typeVersion": 1,
      "position": [
        0,
        0
      ]
    },
    {
      "parameters": {
        "jsCode": "const d = $json.body.data.dossier;\nreturn [{ json: { title: d.title, who: d.memberName, stampedAt: d.stampedAt, root: d.root, project: d.project } }];"
      },
      "name": "Pick fields",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        260,
        0
      ]
    }
  ],
  "connections": {
    "EverStamp webhook": {
      "main": [
        [
          {
            "node": "Pick fields",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}