API reference: OAuth2

Authorization-code with PKCE and the jwt-bearer grant that mirrors DocuSign's JWT grant; token and revoke endpoints.

Method	Path	What it does
`GET`	`/v1/oauth/authorize`	OAuth2 authorization endpoint (authorization_code + PKCE S256) Requires an authenticated interactive principal (Clerk bearer or docuflex_session cookie). Consent is auto-approved; responds 302 to redirect_uri?code=…&state=….
`POST`	`/v1/oauth/token`	OAuth2 token endpoint Grants: authorization_code (+PKCE), refresh_token (rotating), and urn:ietf:params:oauth:grant-type:jwt-bearer (RS256 assertion against the client JWKS). Errors use the RFC 6749 {error, error_description} format on this endpoint only.
`POST`	`/v1/oauth/revoke`	Revoke a refresh token or API key (RFC 7009) Always answers 200, even for unknown tokens (no information oracle).

Conventions

Base URL: https://api.docuflex.net; tenant routes are /v1/accounts/{accountId}/....
Auth: x-api-key: dfx_live_..., or Authorization: Bearer <OAuth2 access token>.
Errors: always {"error":{"code","message","details","requestId"}}; the requestId is also in the x-request-id header.
Pagination: offset (?page=&pageSize=, max 100) or cursor (?cursor=&limit=, follow nextCursor until hasMore is false).
Idempotency: any POST or PUT accepts Idempotency-Key; same key + different body is 409 IDEMPOTENCY_KEY_REUSED.
Rate limits: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset on every response; 429 RATE_LIMITED with Retry-After.
Tabs: coordinates are fractions of the page (origin top-left); documentIndex and recipientIndex refer to positions in the same request.
Spec: /openapi.json (OpenAPI 3). TypeScript client @docuflex/sdk; Postman and Bruno collections ship with the repo.