Accounts API

GET /workspaces

List workspaces Extension

Every workspace the caller can reach, sorted by name. Readable by any role. An API key belongs to exactly one workspace, so it sees a single entry with role: admin. The list item is a smaller object than every other workspace response here — no default_language, or created_at — and its test_mode is always false for a person, whatever the key would report.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token or Session

Responses

Example request

curl -X GET https://api.signclad.com/api/v1/workspaces \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

GET /audit_log

List the workspace audit log Extension

Who did what in this workspace, newest first, plus account-level entries such as plan changes. Requires manage_members. Cursor-paginated; the filters are applied as given and never rejected.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or Session

Query parameters

Responses

Example request

curl -X GET https://api.signclad.com/api/v1/audit_log \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

POST /sso/scim/token

Issue a SCIM token Extension

Mints the bearer token an IdP uses to provision users, and returns it once. Issuing a new one invalidates the old. The token is the tenant: SCIM calls carry no user and no role, so this value is the whole credential for the provisioning surface.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or Session

Responses

Example request

curl -X POST https://api.signclad.com/api/v1/sso/scim/token \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

GET /scim/v2/Users

SCIM — list users Extension

RFC 7644 provisioning. The SCIM bearer token from POST /sso/scim/token is the whole credential and identifies the workspace; there is no user and no role on this surface, and every response — errors included — is application/scim+json with the SCIM error envelope rather than Signclad's. Only userName eq "value" is supported as a filter. sortBy and sortOrder are ignored rather than refused.

Base URL

https://api.signclad.com

Authentication

SCIM token

Query parameters

Responses

Example request

curl -X GET https://api.signclad.com/scim/v2/Users \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

POST /scim/v2/Users

SCIM — create a user Extension

Provisions a membership. The body is read leniently, as IdPs vary: the address comes from userName or the first valid emails[].value, the display name from displayName, name.formatted, the given and family names, or the address; everything else in the payload is ignored without complaint. roles[].value is honoured when it is a real role, except owner, which is quietly downgraded to admin — ownership is not something an IdP gets to grant. An address outside the connection's allowed domains is refused. externalId is the directory's own immutable handle for the person. It is stored verbatim against the membership and echoed back on every read. It used to be discarded, and the response answered Signclad's user id instead — which meant a provider that stored and reconciled on it was matching against an identifier it never issued.

Base URL

https://api.signclad.com

Authentication

SCIM token

Request body

application/scim+json

Responses

Example request

curl -X POST https://api.signclad.com/scim/v2/Users \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

GET /scim/v2/Users/{id}

SCIM — get a user Extension

A membership outside the token's workspace is 404, like one that does not exist.

Base URL

https://api.signclad.com

Authentication

SCIM token

Path parameters

Responses

Example request

curl -X GET https://api.signclad.com/scim/v2/Users/{id} \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

PATCH /scim/v2/Users/{id}

SCIM — deactivate or reactivate a user Extension

Only active can change. Role, name, and address are not patchable, and asking to patch one is a 400 rather than a silent no-op — a provisioning system that thinks it renamed somebody should find out. Operations and operations are both accepted, replace and add both work, and a string "False" counts as false, because that is what Entra ID sends.

Base URL

https://api.signclad.com

Authentication

SCIM token

Path parameters

Request body

application/scim+json

Responses

Example request

curl -X PATCH https://api.signclad.com/scim/v2/Users/{id} \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

DELETE /scim/v2/Users/{id}

SCIM — deprovision a user Extension

Archives the membership. The person's user record is untouched — they may be in other workspaces, and their signatures are evidence. Idempotent.

Base URL

https://api.signclad.com

Authentication

SCIM token

Path parameters

Responses

Example request

curl -X DELETE https://api.signclad.com/scim/v2/Users/{id} \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"