Template links API

GET /t/{token}

Read a public fill link Extension

What a stranger holding the link is allowed to see before they start: whose form it is, what role they are filling, and what the page must ask them for. Unauthenticated — the token is the credential. Deliberately absent: the template id, the workspace id, the field list, the other recipients, and any metadata. A link is permission to start a document, not to read one. Every failure — unknown token, disabled link, expired link, a single-use link already spent, a template that is no longer available — is the same 404, with meta.message reading Couldn't find the page requested.

Base URL

https://api.signclad.com/api/v1

Authentication

None — this operation is public

Path parameters

Responses

Example request

curl -X GET https://api.signclad.com/api/v1/t/{token} \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

POST /t/{token}/start

Start a document from a public link Extension

Creates the document and returns a signing session for the person who just filled the form, so the page can go straight into signing without an email round trip. Two limiters apply: the shared 50/min unauthenticated bucket protects Signclad, and a per-token limiter protects one customer's document allowance from one attacker who found their link. name and email are required only when the link says so — read require_name_email from GET /t/{token} rather than assuming.

Base URL

https://api.signclad.com/api/v1

Authentication

None — this operation is public

Path parameters

Request body

application/json

Responses

Example request

curl -X POST https://api.signclad.com/api/v1/t/{token}/start \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

GET /template_links/{template}

Get a template's link settings Extension

The public URL and the rules behind it. A link exists from the moment the template does; it is enabled: false until somebody turns it on.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Path parameters

Responses

Example request

curl -X GET https://api.signclad.com/api/v1/template_links/{template} \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

PUT /template_links/{template}

Update a template's link settings Extension

A partial merge despite being a PUT: only the keys present change. redirect_url must be HTTPS. An expires_at in the past is accepted — it simply makes the link unusable, which is a reasonable way to switch one off.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Path parameters

Request body

application/json

Responses

Example request

curl -X PUT https://api.signclad.com/api/v1/template_links/{template} \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"

POST /template_links/{template}/rotate

Rotate a template's link Extension

Issues a new token and kills the old URL immediately. This is the answer to a link that leaked: the settings survive, the address does not.

Base URL

https://api.signclad.com/api/v1

Authentication

API key or OAuth 2.1 access token

Path parameters

Responses

Example request

curl -X POST https://api.signclad.com/api/v1/template_links/{template}/rotate \
  -H "X-Api-Key: $SIGNCLAD_API_KEY"