Quathos Sign
API v1

Electronic & digital signatures, built for your product

Integrate legally binding signatures in minutes. Create envelopes with multiple documents, configure signer authentication, and receive events in real time over webhooks.

Quickstart API reference

Copy, paste, run

Create your first envelope in the language you already use.

curl -X POST 'https://api.sign.quathos.com/api/v1/envelopes' \
  -H 'Authorization: Bearer $QUATHOS_SIGN_TOKEN' \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: 5c1f8b2e-...' \
  -d '{
    "title": "Service Agreement",
    "signing_order": "parallel",
    "expires_in_days": 30
  }'

Response: 201 Created · { "id": "…", "status": "draft" }

Authentication Bearer tokens, live vs. test environments, and the scope model. Envelopes Build an envelope with documents, participants and fields, then send it. Webhooks Receive envelope events in real time and verify the HMAC signature. Errors Stable error codes, HTTP statuses and how to handle each one.

When something fails

Every error returns the same shape — an HTTP status and a stable detail code you can branch on.

detailStatusWhen
unauthorized401Missing or invalid token.
missing_scope403Token lacks the required scope.
not_found404Resource does not exist in your tenant.
conflict409Idempotency key reused with a different payload.
unprocessable_pdf422Uploaded file failed validation.
rate_limited429Too many requests — back off and retry.

See the full error reference →

Frequently asked questions

What is an envelope?

An envelope is the signing transaction: one or more documents, the participants who must act on them, and the fields they fill or sign. You build it in draft, then send it to start the flow.

How do test and live tokens differ?

Every API token carries its environment. A test token operates on isolated test data and never sends real emails or consumes paid credits; a live token drives production. The environment is fixed at token creation.

How do I verify webhook signatures?

Each delivery is signed with HMAC-SHA256 over "{timestamp}.{raw_body}" using your endpoint secret. Recompute it and compare in constant time against the X-Webhook-Signature header, rejecting deliveries older than 5 minutes.

Do tokens expire?

Tokens are valid until you revoke them, unless you set an explicit expiry when creating one. The full secret is shown only once at creation — store it securely.

Test freely

Use a test token while you integrate — it runs on isolated data, never emails real signers and never consumes paid credits. Switch to a live token when you go to production.
Next Quickstart