Docuflex › E-signature › API › Signing ceremony (public)

API reference: Signing ceremony (public)

Token-gated endpoints the signer's browser calls: load the session, pass access-code / SMS / KBA / ID checks, give ESIGN consent, adopt a signature, fill tabs, complete or decline.

Create a Docuflex account Read the API reference Connect your AI agent

Method	Path	What it does
`GET`	`/v1/signing/{token}`	Ceremony bundle Envelope summary, presigned documents, the recipient's tabs, consent + auth state. Documents/tabs stay locked until all required auth challenges pass.
`POST`	`/v1/signing/{token}/auth/access-code`	Verify the sender-shared access code (5 attempts, then revoked)
`POST`	`/v1/signing/{token}/auth/sms-otp/request`	Send a one-time code (email transport in dev; SMS adapter later)
`POST`	`/v1/signing/{token}/auth/sms-otp/verify`	Verify the one-time code (5 attempts, then revoked)
`POST`	`/v1/signing/{token}/auth/kba`	[STUB] Knowledge-based authentication — auto-passes with an audited stub note
`POST`	`/v1/signing/{token}/auth/id-verification`	[STUB] ID verification — auto-passes with an audited stub note
`POST`	`/v1/signing/{token}/consent`	Record ESIGN/UETA consent (required before any signing mutation)
`POST`	`/v1/signing/{token}/signature`	Adopt a signature (+optional initials) as PNG data URLs (≤1MB each)
`PUT`	`/v1/signing/{token}/tabs`	Fill tab values (signature tabs take an adopted SignatureAsset id)
`POST`	`/v1/signing/{token}/complete`	Finish signing: validates required tabs, stamps auto tabs, advances routing
`POST`	`/v1/signing/{token}/decline`	Decline to sign (declines the whole envelope, revokes open links)

Conventions

Base URL: https://api.docuflex.net; tenant routes are /v1/accounts/{accountId}/....
Auth: x-api-key: dfx_live_..., or Authorization: Bearer <OAuth2 access token>.
Errors: always {"error":{"code","message","details","requestId"}}; the requestId is also in the x-request-id header.
Pagination: offset (?page=&pageSize=, max 100) or cursor (?cursor=&limit=, follow nextCursor until hasMore is false).
Idempotency: any POST or PUT accepts Idempotency-Key; same key + different body is 409 IDEMPOTENCY_KEY_REUSED.
Rate limits: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset on every response; 429 RATE_LIMITED with Retry-After.
Tabs: coordinates are fractions of the page (origin top-left); documentIndex and recipientIndex refer to positions in the same request.
Spec: /openapi.json (OpenAPI 3). TypeScript client @docuflex/sdk; Postman and Bruno collections ship with the repo.