Developer platform

Call the public API with a scoped key, page with cursors, and verify webhook signatures. The OpenAPI document is generated from the routes.

Quickstart

Install @documenso/sdk from this repository and send the API key as a bearer token.

import { BuiltSignClient } from '@documenso/sdk';

const client = new BuiltSignClient({
  baseUrl: 'https://sign.example.com',
  apiKey: process.env.BUILTSIGN_API_KEY ?? '',
});

const page = await client.documents.list({ limit: 25 });
console.log(page.data, page.nextCursor);

OpenAPI specification

Authentication, scopes and idempotency

Send Authorization: Bearer api_... An empty scope list can call every route. A key with scopes can only call routes that match, plus POST /api/v2/developer/ping.

documents:read documents:write templates:read templates:write recipients:read recipients:write fields:read fields:write forms:read forms:write submissions:read contracts:read contracts:write payments:read

List routes accept cursor and limit. Pass the returned nextCursor to read the next page. POST requests can send Idempotency-Key. The same key and body replay the first response. A different body is rejected.

Set a per-key requests-per-minute limit when you create the key. It applies in addition to the organisation API quota.

API keys

Keys belong to a team. Managers create them here or in team settings.

Webhook tester

Sends a signed DOCUMENT_COMPLETED sample. Verify X-BuiltSIGN-Signature with HMAC-SHA256 of timestamp.body. Failed team webhooks retry after 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours.