DrakonSign

Six calls to a completed signing record

Every envelope operation in the dashboard is in the REST API, including the signed PDF, the certificate of completion, the evidence bundle and live re-verification of the audit chain. Only billing is left out, deliberately, so a leaked key can’t touch it.

# 1 — Create an envelope from a PDF
curl -X POST https://sign.drakonsystems.com/api/documents \
  -H "X-API-Key: dsk_…" \
  -F "title=Supplier agreement — Northwind Ltd" \
  -F "file=@supplier-agreement.pdf"

# 2 — Add a signer (routing_index orders the signing)
curl -X POST https://sign.drakonsystems.com/api/documents/$DOC/signers \
  -H "X-API-Key: dsk_…" -H "Content-Type: application/json" \
  -d '{"name": "Alex Morgan", "email": "alex@example.com"}'

# 3 — Auto-detect the fields (or POST them yourself)
curl -X POST https://sign.drakonsystems.com/api/documents/$DOC/ai/suggest-fields \
  -H "X-API-Key: dsk_…"

# 4 — Assign each detected field to a signer (send rejects unassigned ones)
curl -X PATCH https://sign.drakonsystems.com/api/documents/$DOC/fields/$FIELD \
  -H "X-API-Key: dsk_…" -H "Content-Type: application/json" \
  -d '{"signer_id": "'$SIGNER'"}'

# 5 — Send it. Signers get verified links by email
curl -X POST https://sign.drakonsystems.com/api/documents/$DOC/send \
  -H "X-API-Key: dsk_…"

# 6 — Once complete: recompute the audit chain, live
curl https://sign.drakonsystems.com/api/documents/$DOC/audit/verify \
  -H "X-API-Key: dsk_…"

{"intact": true, "event_count": 14, "anchored": true, "anchor_expected": true, "anchor_missing_recorded": false, "anchor_event_count": 12, "unanchored_suffix_count": 2, "anchor_valid": true, "anchor_validation_status": "valid"}

The response shows the chain is intact and the DigiCert timestamp over the completion checkpoint is valid. Events after completion, such as downloads, are counted separately. These are the real endpoints, not pseudocode. Try them in the interactive API docs.

The surface

Envelopes

Create envelopes from PDFs, list your org's documents, fetch one with its full state.

  • POST /api/documents
  • GET /api/documents
  • GET /api/documents/{id}

Signers & fields

Add signers with roles (signer, witness, approver, CC) and routing order; place signature, initials, date, text and checkbox fields — by hand or auto-detected. Witness and Approver are routing labels. Every signer goes through the same ceremony, and CC recipients never sign and are never emailed. The detector uses deterministic label matching; the "ai" in its path is a legacy name, not a model call.

  • POST …/{id}/signers
  • POST …/{id}/fields
  • POST …/{id}/ai/suggest-fields
  • PATCH …/{id}/fields/{field_id}

Send & track

Send the envelope and watch its status move: sent, verification started, PDF accessed, partially signed, completed — declines included. Poll it, or register a signed webhook and have it pushed to you.

  • POST …/{id}/send
  • GET …/{id}
  • GET …/{id}/audit

Evidence

Pull the signed PDF, the certificate of completion and the full audit chain. One call recomputes the chain and validates the independent RFC 3161 timestamp over completion.

  • GET …/{id}/download
  • GET …/{id}/certificate
  • GET …/{id}/audit/verify
  • GET …/{id}/anchor

Webhooks

Stop polling: register an HTTPS destination and we POST a signed JSON body when an envelope is viewed, completed, declined or voided. HMAC-SHA256 over a timestamp and the exact body bytes; the secret is shown once and rotatable. Delivery is at-least-once — the same delivery id and byte-identical body can arrive twice, so deduplicate on the event id. Redirects are never followed and only publicly resolvable HTTPS destinations are accepted. Managed by an owner from a signed-in session, never by an API key.

  • POST /api/account/webhooks
  • POST …/webhooks/{id}/rotate-secret
  • GET …/webhooks/deliveries
  • POST …/deliveries/{id}/replay

Docs that are never stale, keys that can’t hurt you

Live OpenAPI docs

/docs is interactive documentation generated from the running service, /redoc is a printable reference that needs no JavaScript, and /openapi.json is the machine-readable spec — point a client generator, or an AI agent, straight at it. All three are served from this origin; no CDN, no third-party scripts.

One header to auth

Send your org key as X-API-Key. Create and revoke keys in the dashboard; we store only their hashes, so plaintext keys can’t leak from our side.

Blast radius, by design

API keys send and read documents. Billing lives behind signed-in dashboard sessions only — a leaked key can never change your plan, your card or your account.

The API isn’t a second bill

The big e-signature APIs meter per invite, on top of what the web app costs. DrakonSign has one price: your plan’s envelope quota, shared between the dashboard and the API, from £15/month. The maths is on the API pricing page.

Sign in, then create the key you need

Checkout provisions your organisation and sends a single-use magic sign-in link. It creates no API key. Once signed in, create a revocable key deliberately from Account → API keys, where its plaintext is shown once.

Start your free trial Browse the API docs