Accounts API

GET /workspaces

List workspaces Extension

Every workspace the caller can reach, sorted by name. Readable by any role. An API key belongs to exactly one workspace, so it sees a single entry with role: admin. The list item is a smaller object than every other workspace response here — no default_language, or created_at — and its test_mode is always false for a person, whatever the key would report.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Responses

Example request

curl -X GET https://api.signclad.com/api/v1/workspaces \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

POST /workspaces

Create a workspace Extension

Adds a workspace to the caller's account. Requires manage_settings. Documents, templates, API keys, and webhooks all live inside a workspace; billing does not.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Request body

application/json

Responses

Example request

curl -X POST https://api.signclad.com/api/v1/workspaces \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

GET /workspaces/{id}

Get a workspace Extension

One workspace, as a bare object. Readable by any member; somebody with no role in it gets a 404, not a 403, so the id is never confirmed. This is the only workspace shape that carries created_at — the list omits it.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Path parameters

Responses

Example request

curl -X GET https://api.signclad.com/api/v1/workspaces/{id} \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

PATCH /workspaces/{id}

Update a workspace Extension

Renames a workspace and changes its default language, compatibility shim, and idle timeout. Requires manage_settings both on the current workspace and on the one being changed. The storage region is not changed here — it is a migration, not a setting, and it has its own route.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Path parameters

Request body

application/json

Responses

Example request

curl -X PATCH https://api.signclad.com/api/v1/workspaces/{id} \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

DELETE /workspaces/{id}

Schedule a workspace for deletion Extension

Owner only — an API key never has manage_billing. Answers 202: the workspace is marked deleted now and purged at purge_at. An account must keep at least one workspace; deleting the last one is 422.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Path parameters

Responses

Example request

curl -X DELETE https://api.signclad.com/api/v1/workspaces/{id} \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

POST /workspaces/{id}/switch

Switch the active workspace Extension

Points this session at another of the caller's workspaces. People only: an API key is 403, because a key is bound to one workspace by construction. A workspace the caller has no role in is 404.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Path parameters

Responses

Example request

curl -X POST https://api.signclad.com/api/v1/workspaces/{id}/switch \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

POST /workspaces/{id}/transfer_ownership

Transfer ownership Extension

Hands the owner role to another member, named either by membership_id or by user_id. Owner only. This is the only way a workspace's owner changes: PATCH /members/{id} refuses to grant owner.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Path parameters

Request body

application/json

Responses

Example request

curl -X POST https://api.signclad.com/api/v1/workspaces/{id}/transfer_ownership \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

GET /members

List members Extension

Everyone in the workspace, oldest first, archived members included. Readable by any role — unlike the invitation list, which needs manage_members. The list item carries seat and created_at; the item returned by the role, archive, and restore operations does not.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Responses

Example request

curl -X GET https://api.signclad.com/api/v1/members \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

PATCH /members/{id}

Change a member's role Extension

People only — an API key is 403. Nobody can change their own role, an admin cannot touch an owner, and only an owner may grant owner; in practice granting owner goes through POST /workspaces/{id}/transfer_ownership, which is what keeps exactly one owner.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Path parameters

Request body

application/json

Responses

Example request

curl -X PATCH https://api.signclad.com/api/v1/members/{id} \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

POST /members/{id}/archive

Archive a member Extension

Takes away access and frees the seat while keeping the row, so their documents keep their author. Their templates transfer to the owner. Idempotent: archiving an archived member is 200 and changes nothing.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Path parameters

Responses

Example request

curl -X POST https://api.signclad.com/api/v1/members/{id}/archive \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

POST /members/{id}/restore

Restore an archived member Extension

Gives access back and takes a seat again.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Path parameters

Responses

Example request

curl -X POST https://api.signclad.com/api/v1/members/{id}/restore \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

GET /members/invitations

List pending invitations Extension

Invitations that have neither been accepted nor revoked, newest first. Requires manage_members.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Responses

Example request

curl -X GET https://api.signclad.com/api/v1/members/invitations \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

POST /members/invitations

Invite someone Extension

Emails an invitation and returns the token and accept URL — the only response that carries them. People only. owner cannot be invited; transfer ownership instead. Inviting an address that already has a pending invitation resends it rather than failing. adds_seat says whether accepting will bill another seat.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Request body

application/json

Responses

Example request

curl -X POST https://api.signclad.com/api/v1/members/invitations \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

DELETE /members/invitations/{id}

Revoke an invitation Extension

Only a pending invitation can be revoked; anything else is 422.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Path parameters

Responses

Example request

curl -X DELETE https://api.signclad.com/api/v1/members/invitations/{id} \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

POST /invitations/{token}/accept

Accept an invitation Extension

Joins the workspace. The caller must be signed in but is, by definition, not yet a member, so this route carries neither the workspace requirement nor a role check — the token is the authorization. The invitation must have been sent to the signed-in address.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Path parameters

Responses

Example request

curl -X POST https://api.signclad.com/api/v1/invitations/{token}/accept \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

GET /api_keys

List API keys Extension

Every key in the workspace, newest first, revoked and expired ones included. Requires manage_settings. The secret is never returned here — only display_prefix and last_four.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Responses

Example request

curl -X GET https://api.signclad.com/api/v1/api_keys \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

POST /api_keys

Create an API key Extension

Returns the key object with its plaintext key — the only time it exists. A sandbox key is requested either as sandbox: true or mode: sandbox (test is accepted as a synonym); sandbox wins when both are sent, and the response always reports mode as sandbox or live.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Request body

application/json

Responses

Example request

curl -X POST https://api.signclad.com/api/v1/api_keys \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

DELETE /api_keys/{id}

Revoke an API key Extension

Immediate and idempotent. A key cannot revoke itself — that is a 409, so an automated rotation cannot lock itself out halfway through.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Path parameters

Responses

Example request

curl -X DELETE https://api.signclad.com/api/v1/api_keys/{id} \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

POST /api_keys/{id}/rotate

Rotate an API key Extension

Mints a replacement and leaves the old key working until previous.stops_working_at, so a deploy can roll. Answers 200, not 201. The new plaintext is at key.key.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Path parameters

Responses

Example request

curl -X POST https://api.signclad.com/api/v1/api_keys/{id}/rotate \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

GET /billing

Get the billing summary Extension

Plan, seats, usage for a period, card, invoices, and the plan's feature matrix. Owner only: an API key resolves to admin and is refused, so a leaked integration key cannot see or change billing. period is a YYYY-MM string; anything that does not look like one is ignored rather than rejected, and the current month is used.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Query parameters

Responses

Example request

curl -X GET https://api.signclad.com/api/v1/billing \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

PATCH /billing/plan

Change the plan Extension

Switches plan or billing interval and returns the whole billing summary, with usage for the current month.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Request body

application/json

Responses

Example request

curl -X PATCH https://api.signclad.com/api/v1/billing/plan \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

POST /billing/checkout_session

Start a checkout session Extension

Returns a hosted checkout URL for a paid plan. free passes validation but is refused by the business rule — there is nothing to buy.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Request body

application/json

Responses

Example request

curl -X POST https://api.signclad.com/api/v1/billing/checkout_session \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

POST /billing/portal_session

Open the billing portal Extension

A hosted URL where the owner manages the card, invoices, and cancellation.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Responses

Example request

curl -X POST https://api.signclad.com/api/v1/billing/portal_session \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

POST /billing/cancel

Cancel the subscription Extension

Ends the subscription at the period end, or straight away with immediately: true. Returns the whole billing summary.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Request body

application/json

Responses

Example request

curl -X POST https://api.signclad.com/api/v1/billing/cancel \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

GET /audit_log

List the workspace audit log Extension

Who did what in this workspace, newest first, plus account-level entries such as plan changes. Requires manage_members. Cursor-paginated; the filters are applied as given and never rejected.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Query parameters

Responses

Example request

curl -X GET https://api.signclad.com/api/v1/audit_log \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

GET /sso/config

Get the SSO configuration Extension

SAML or OIDC single sign-on for this workspace, plus the service-provider values an IdP administrator needs to paste into their end. Owner only — an API key resolves to admin and is always refused — and Enterprise only. Two shapes, told apart by configured. Before anything is set up the body is just configured: false and service_provider, which is exactly what somebody starting the setup needs.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Responses

Example request

curl -X GET https://api.signclad.com/api/v1/sso/config \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

PUT /sso/config

Update the SSO configuration Extension

A merge, not a replacement, despite the verb: a field left out is untouched, and a field sent empty is cleared. protocol is required the first time. The request is flat where the response nests: idp_entity_id and friends come back under saml, oidc_issuer and oidc_client_id under oidc, and jit_enabled, default_role, and group_role_map under provisioning. oidc_client_secret is write-only; the response only says whether one is set. Sending metadata_url makes the server fetch that document and overwrite the SAML fields from it, which is the fast path for an IdP that publishes metadata.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Request body

application/json

Responses

Example request

curl -X PUT https://api.signclad.com/api/v1/sso/config \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

GET /sso/metadata

Download SAML SP metadata Extension

The service-provider metadata document to hand to an IdP administrator, as XML. Owner only, Enterprise only. A workspace with no usable connection answers 422 — JSON, on an endpoint that otherwise returns XML.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Responses

Example request

curl -X GET https://api.signclad.com/api/v1/sso/metadata \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

POST /sso/scim/token

Issue a SCIM token Extension

Mints the bearer token an IdP uses to provision users, and returns it once. Issuing a new one invalidates the old. The token is the tenant: SCIM calls carry no user and no role, so this value is the whole credential for the provisioning surface.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Responses

Example request

curl -X POST https://api.signclad.com/api/v1/sso/scim/token \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

GET /workspace/compatibility

Get compatibility shim status Extension

Whether this workspace still emits the compatibility SW-* message aliases in embedded pages, and how often anything used them in the last 30 days. recorded: false means nothing has been measured yet, which is not the same as zero — the difference decides whether it is safe to turn the shim off.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Responses

Example request

curl -X GET https://api.signclad.com/api/v1/workspace/compatibility \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

GET /workspace/compliance

Get compliance settings Extension

The workspace's 21 CFR Part 11, NOM-151, and identity-verification switches, what the plan makes available, and the values each setting accepts. Readable by any member.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Responses

Example request

curl -X GET https://api.signclad.com/api/v1/workspace/compliance \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

PATCH /workspace/compliance

Update compliance settings Extension

Owner only. Turning a feature off is always allowed, even on a plan that no longer carries it — a workspace must be able to stop doing something it can no longer pay for. Turning one on without the plan is 422.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Request body

application/json

Responses

Example request

curl -X PATCH https://api.signclad.com/api/v1/workspace/compliance \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

POST /workspaces/{id}/storage_region

Move a workspace's files to another region Extension

Queues a migration of every stored object to the named region. Owner only, and any region other than the default needs the eu_residency feature. 202 when a move was queued, 200 when the workspace is already there — same body, distinguished by changed. storage_region keeps reporting the old region until the migration completes; effective_region is where a write would land right now, which can differ again if the plan lapsed. Only one migration at a time: a second is 409.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Path parameters

Request body

application/json

Responses

Example request

curl -X POST https://api.signclad.com/api/v1/workspaces/{id}/storage_region \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

GET /api_keys/{id}/requests

Read a key's request log Extension

The last seven days of calls made with this key: method, path, status, latency, request id, and a ready-made copy_as_curl. Bodies are never stored and query strings are redacted at write time, so a secret in a URL does not become a second copy of the secret. Requires manage_settings. status accepts a class (4) or an exact code (404); a value that is neither, and an unparseable since, are ignored rather than refused.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Path parameters

Query parameters

Responses

Example request

curl -X GET https://api.signclad.com/api/v1/api_keys/{id}/requests \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

GET /scim/v2/Users

SCIM — list users Extension

RFC 7644 provisioning. The SCIM bearer token from POST /sso/scim/token is the whole credential and identifies the workspace; there is no user and no role on this surface, and every response — errors included — is application/scim+json with the SCIM error envelope rather than Signclad's. Only userName eq "value" is supported as a filter. sortBy and sortOrder are ignored rather than refused.

Base URL

https://api.signclad.com

Authentication

SCIM token

Query parameters

Responses

Example request

curl -X GET https://api.signclad.com/scim/v2/Users \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

POST /scim/v2/Users

SCIM — create a user Extension

Provisions a membership. The body is read leniently, as IdPs vary: the address comes from userName or the first valid emails[].value, the display name from displayName, name.formatted, the given and family names, or the address; everything else in the payload is ignored without complaint. roles[].value is honoured when it is a real role, except owner, which is quietly downgraded to admin — ownership is not something an IdP gets to grant. An address outside the connection's allowed domains is refused. externalId is the directory's own immutable handle for the person. It is stored verbatim against the membership and echoed back on every read. It used to be discarded, and the response answered Signclad's user id instead — which meant a provider that stored and reconciled on it was matching against an identifier it never issued.

Base URL

https://api.signclad.com

Authentication

SCIM token

Request body

application/scim+json

Responses

Example request

curl -X POST https://api.signclad.com/scim/v2/Users \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

GET /scim/v2/Users/{id}

SCIM — get a user Extension

A membership outside the token's workspace is 404, like one that does not exist.

Base URL

https://api.signclad.com

Authentication

SCIM token

Path parameters

Responses

Example request

curl -X GET https://api.signclad.com/scim/v2/Users/{id} \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

PATCH /scim/v2/Users/{id}

SCIM — deactivate or reactivate a user Extension

Only active can change. Role, name, and address are not patchable, and asking to patch one is a 400 rather than a silent no-op — a provisioning system that thinks it renamed somebody should find out. Operations and operations are both accepted, replace and add both work, and a string "False" counts as false, because that is what Entra ID sends.

Base URL

https://api.signclad.com

Authentication

SCIM token

Path parameters

Request body

application/scim+json

Responses

Example request

curl -X PATCH https://api.signclad.com/scim/v2/Users/{id} \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

DELETE /scim/v2/Users/{id}

SCIM — deprovision a user Extension

Archives the membership. The person's user record is untouched — they may be in other workspaces, and their signatures are evidence. Idempotent.

Base URL

https://api.signclad.com

Authentication

SCIM token

Path parameters

Responses

Example request

curl -X DELETE https://api.signclad.com/scim/v2/Users/{id} \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"