Getting Started

REST over HTTPS. All request and response bodies use JSON. Set Content-Type: application/json on requests with a body. All resource identifiers are UUIDs. The base URL is /api. The current API version is 0.1.0.

All endpoints require a Bearer token. Pass it as Authorization: Bearer {token} in the request header. Three token types are accepted using the same Bearer format.

The API accepts all three types uniformly. The token issuing context determines what actions it can perform.

• Personal access tokens: issued from Settings > Tokens
• Application tokens: issued from Settings > Applications
• Agent application tokens: issued from Settings > Agents

Access is scoped by participant role. Tokens act within the permissions of the actor they represent. Operations on agreements, sections, terms, comments, participants, and attachments are subject to the actor participant role: author, editor, commentor, signer, or viewer. Operations on contacts, templates, and actor settings are scoped to the authenticated actor only.

List endpoints accept two query parameters. Paginated responses include a Pagination object inside data: page, page_size, total_pages, total_records.

• page: one-based page number, integer, default: 1
• page_size: records per page, integer, 1-100, default: 20

List endpoints that support filtering accept a search query parameter. It filters by the resource canonical searchable fields. No sorting parameters are defined in this API version. No other filter parameters exist beyond search.

Not documented in the current API version. If you receive a 429 status, check the response headers for Retry-After.

All date-time values use ISO 8601 format: 2026-01-01T00:00:00Z. Date-time fields are typed string with format: date-time in the schema. Null date-time fields indicate the event has not occurred.

All successful responses wrap their payload in a data key. The resource key inside data matches the resource type.

Paginated responses nest the pagination metadata alongside the resource array inside data.

• Single resource: {"data": {"agreement": {...}}}
• Collection: {"data": {"agreements": [...], "page": 1, "page_size": 20, "total_pages": 3, "total_records": 54}}

Errors return a standard envelope. The fields array is present only on 422 responses and lists per-field validation errors.

Common status codes: 400 Bad request, 401 Unauthorized, 404 Not found, 409 Conflict, 422 Unprocessable.

{
  "error": {
    "code": "validation_error",
    "message": "The name field is required.",
    "request_id": "req_abc123",
    "status": 422,
    "fields": [{"field": "name", "message": "is required"}]
  }
}

Not documented beyond standard HTTP in the current API version.