DrakonSign

Six calls to a completed signing record

DrakonSign is API-first because we’re its first customer: Drakon’s own tenancy packs are sent by software, not clicks. Every envelope operation in the dashboard is in the REST API — including the completed signed PDF, its separate completion-snapshot certificate, and live chain re-verification through the audit verification endpoint. These files are not a self-contained long-term-validation evidence pack. Only billing is deliberately excluded, and that’s a feature.

The completion record states the actual document-seal outcome: self-issued PAdES B-T requires both the signing key and timestamp authority; a TSA outage records PAdES B-B when the signature validates and the measured unverified or unknown state when it does not; a missing key records an unsealed artifact. PDF readers may show the self-issued issuer as untrusted, and B-LT/B-LTA are not shipped.

# 1 — Create an envelope from a PDF
curl -X POST https://sign.drakonsystems.com/api/documents \
  -H "X-API-Key: dsk_…" \
  -F "title=Tenancy pack — 4 Print Works" \
  -F "file=@tenancy-pack.pdf"

# 2 — Add a signer (routing_index orders the signing)
curl -X POST https://sign.drakonsystems.com/api/documents/$DOC/signers \
  -H "X-API-Key: dsk_…" -H "Content-Type: application/json" \
  -d '{"name": "Alex Tenant", "email": "alex@example.com"}'

# 3 — Auto-detect the fields (or POST them yourself)
curl -X POST https://sign.drakonsystems.com/api/documents/$DOC/ai/suggest-fields \
  -H "X-API-Key: dsk_…"

# 4 — Assign each detected field to a signer (send rejects unassigned ones)
curl -X PATCH https://sign.drakonsystems.com/api/documents/$DOC/fields/$FIELD \
  -H "X-API-Key: dsk_…" -H "Content-Type: application/json" \
  -d '{"signer_id": "'$SIGNER'"}'

# 5 — Send it. Signers get verified links by email
curl -X POST https://sign.drakonsystems.com/api/documents/$DOC/send \
  -H "X-API-Key: dsk_…"

# 6 — Once complete: recompute the audit chain, live
curl https://sign.drakonsystems.com/api/documents/$DOC/audit/verify \
  -H "X-API-Key: dsk_…"

{"intact": true, "event_count": 14, "anchored": true, "anchor_expected": true, "anchor_missing_recorded": false, "anchor_event_count": 12, "unanchored_suffix_count": 2, "anchor_valid": true, "anchor_validation_status": "valid"}

The sample shows a valid 12-event completion checkpoint followed by two later events that recompute internally but are outside that timestamp. The same endpoint distinctly reports an internal chain break, an invalid stored anchor, or an intact chain with no external anchor recorded. Those are the real endpoints, not pseudocode — try them against the interactive API docs.

The surface

Envelopes

Create envelopes from PDFs, list your org's documents, fetch one with its full state.

  • POST /api/documents
  • GET /api/documents
  • GET /api/documents/{id}

Signers & fields

Add signers with roles (signer, witness, approver, CC) and routing order; place signature, initials, date, text and checkbox fields — by hand or auto-detected. (The role is a routing label: signer, witness and approver take the identical ceremony and differ only in ordering and in the word printed on the certificate — no statutory witnessing, no role-specific consent. Only cc behaves differently: it never signs and is never emailed. The detector matches labels deterministically; the "ai" in its path is a legacy name that integrations depend on, not a model call.)

  • POST …/{id}/signers
  • POST …/{id}/fields
  • POST …/{id}/ai/suggest-fields
  • PATCH …/{id}/fields/{field_id}

Send & track

Send the envelope and watch its status move: sent, verification started, PDF accessed, partially signed, completed — declines recorded, never hidden. Poll it, or register a signed webhook and have it pushed to you.

  • POST …/{id}/send
  • GET …/{id}
  • GET …/{id}/audit

Evidence

The part other APIs don't have: pull the completed signed PDF, the certificate of completion and the full audit chain. One server-side call recomputes that chain, validates the external RFC 3161 completion prefix independently, reports an invalid anchor as failure, counts later events outside that timestamp, distinguishes later suffix damage from prefix failure, and reports whether the fail-open missing anchor was expected and immutably recorded.

  • GET …/{id}/download
  • GET …/{id}/certificate
  • GET …/{id}/audit/verify
  • GET …/{id}/anchor

Webhooks

Stop polling: register an HTTPS destination and we POST a signed JSON body when an envelope is viewed, completed, declined or voided. HMAC-SHA256 over a timestamp and the exact body bytes; the secret is shown once and rotatable. Delivery is at-least-once — the same delivery id and byte-identical body can arrive twice, so deduplicate on the event id. Redirects are never followed and only publicly resolvable HTTPS destinations are accepted. Managed by an owner from a signed-in session, never by an API key.

  • POST /api/account/webhooks
  • POST …/webhooks/{id}/rotate-secret
  • GET …/webhooks/deliveries
  • POST …/deliveries/{id}/replay

Docs that are never stale, keys that can’t hurt you

Live OpenAPI docs

/docs is interactive documentation generated from the running service, /redoc is a printable reference that needs no JavaScript, and /openapi.json is the machine-readable spec — point a client generator, or an AI agent, straight at it. All three are served from this origin; no CDN, no third-party scripts.

One header to auth

Send your org key as X-API-Key. Create and revoke keys in the dashboard; we store only their hashes, so plaintext keys can’t leak from our side.

Blast radius, by design

API keys send and read documents. Billing lives behind signed-in dashboard sessions only — a leaked key can never change your plan, your card or your account.

The API isn’t a second bill

The big e-signature APIs meter per invite, on top of what the web app costs. DrakonSign has one price: your plan’s envelope quota, shared between the dashboard and the API, from £15/month. The maths is on the API pricing page.

Sign in, then create the key you need

Checkout provisions your organisation and sends a single-use magic sign-in link. It creates no API key. Once signed in, create a revocable key deliberately from Account → API keys, where its plaintext is shown once.

Start free trial Browse the API docs