Put e-signatures inside your product

# First page
curl "https://test.signlypdf.com/api/submissions?limit=50" \
  -H "X-Auth-Token: $SIGNLY_API_KEY"

# Next page: pass pagination.next as "after"
curl "https://test.signlypdf.com/api/submissions?limit=50&after=8812" \
  -H "X-Auth-Token: $SIGNLY_API_KEY"

{
  "data": [ { "id": 8861, "status": "pending" }, { "id": 8812, "status": "completed" } ],
  "pagination": { "count": 2, "next": 8812, "prev": 8861 }
}

{ "error": "email is invalid in `submitters[0]`." }

HTTP/1.1 200 OK
Content-Type: application/json
X-RateLimit-Limit: 600
X-RateLimit-Remaining: 587
X-RateLimit-Reset: 1791476100

curl -X POST https://test.signlypdf.com/api/templates \
  -H "X-Auth-Token: $SIGNLY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Merchant Processing Agreement",
    "external_id": "mpa-v3",
    "documents": [
      {
        "name": "agreement.pdf",
        "file": "https://harbor-payments.com/mpa-v3.pdf",
        "fields": [
          {
            "name": "Signature",
            "type": "signature",
            "role": "Merchant",
            "areas": [
              { "page": 4, "x": 0.12, "y": 0.78, "w": 0.3, "h": 0.06 }
            ]
          }
        ]
      }
    ]
  }'

import base64, os, requests

with open("agreement.pdf", "rb") as f:
    pdf = base64.b64encode(f.read()).decode()

template = requests.post(
    "https://test.signlypdf.com/api/templates",
    headers={"X-Auth-Token": os.environ["SIGNLY_API_KEY"]},
    json={
        "name": "Merchant Processing Agreement",
        "external_id": "mpa-v3",
        "documents": [{"name": "agreement.pdf", "file": pdf}],
    },
).json()

curl -X PUT https://test.signlypdf.com/api/submitters/20471 \
  -H "X-Auth-Token: $SIGNLY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "lena@harbor-bistro.com",
    "send_email": true
  }'

curl -X POST https://test.signlypdf.com/api/clickwraps \
  -H "X-Auth-Token: $SIGNLY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Merchant Terms of Service",
    "kind": "view_only",
    "template_id": 1042,
    "button_text": "I agree",
    "require_name": true,
    "require_email": true,
    "checkboxes": [
      { "text": "I agree to the Merchant Terms.", "required": true },
      { "text": "Email me updates.", "required": false }
    ],
    "publish": true
  }'

{
  "id": 77,
  "name": "Merchant Terms of Service",
  "kind": "view_only",
  "slug": "ToazhJ5qkCwGQx",
  "published": true,
  "active_version_number": 1,
  "url": "https://test.signlypdf.com/c/ToazhJ5qkCwGQx"
}

# Events completed since 1791400000 (Unix time), newest first
curl "https://test.signlypdf.com/api/events/form/completed?before=1791400000&limit=100" \
  -H "X-Auth-Token: $SIGNLY_API_KEY"

{
  "event_id": "0b4f3d6e-6a0c-4f7a-9d2b-1c55e8a07c3f",
  "event_type": "form.completed",
  "timestamp": "2026-10-08T15:50:34.648Z",
  "data": {
    "id": 20471,
    "submission_id": 8861,
    "email": "owner@harbor-bistro.com",
    "name": "Lena Okafor",
    "role": "Merchant",
    "status": "completed",
    "external_id": "merchant_5521",
    "metadata": { "application_id": "app_9f2c" },
    "ip": "203.0.113.24",
    "completed_at": "2026-10-08T15:50:31.020Z",
    "values": [
      { "field": "Business name", "value": "Harbor Bistro LLC" }
    ],
    "documents": [{ "name": "agreement", "url": "https://test.signlypdf.com/file/..." }],
    "audit_log_url": "https://test.signlypdf.com/file/...",
    "submission": { "id": 8861, "status": "completed" }
  }
}

POST /webhooks/signly HTTP/1.1
Content-Type: application/json
User-Agent: SignlyPDF.com Webhook
X-Signly-Event-Id: 0b4f3d6e-6a0c-4f7a-9d2b-1c55e8a07c3f
X-Signly-Event-Type: form.completed
X-Signly-Timestamp: 1791475834
X-Signly-Signature: v1=8c1f0a…e94d
X-Webhook-Secret: ••••••••

import crypto from "node:crypto";
import express from "express";

const app = express();
const SECRET = process.env.SIGNLY_WEBHOOK_SECRET; // the value you saved as the webhook secret

// Verify against the raw body, before JSON parsing changes it.
app.post("/webhooks/signly", express.raw({ type: "application/json" }), (req, res) => {
  const timestamp = req.get("X-Signly-Timestamp");
  const signature = req.get("X-Signly-Signature") || "";

  const expected = "v1=" + crypto
    .createHmac("sha256", SECRET)
    .update(`${timestamp}.${req.body}`)
    .digest("hex");

  const valid = Buffer.byteLength(signature) === Buffer.byteLength(expected) &&
    crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
  const fresh = Math.abs(Date.now() / 1000 - Number(timestamp)) < 300;

  if (!valid || !fresh) return res.sendStatus(401);

  const event = JSON.parse(req.body);
  // Deduplicate on event.event_id, then hand off to a queue.
  res.sendStatus(200);
});

import hashlib, hmac, os, time
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["SIGNLY_WEBHOOK_SECRET"].encode()

@app.post("/webhooks/signly")
def signly_webhook():
    timestamp = request.headers.get("X-Signly-Timestamp", "")
    signature = request.headers.get("X-Signly-Signature", "")
    body = request.get_data()  # raw bytes

    expected = "v1=" + hmac.new(
        SECRET, timestamp.encode() + b"." + body, hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(signature, expected):
        abort(401)
    if abs(time.time() - int(timestamp)) > 300:
        abort(401)

    event = request.get_json()
    # Deduplicate on event["event_id"], then process asynchronously.
    return "", 200

# Rails controller
def signly
  body      = request.raw_post
  timestamp = request.headers["X-Signly-Timestamp"].to_s
  signature = request.headers["X-Signly-Signature"].to_s

  expected = "v1=" + OpenSSL::HMAC.hexdigest("SHA256", ENV.fetch("SIGNLY_WEBHOOK_SECRET"), "#{timestamp}.#{body}")

  return head :unauthorized unless ActiveSupport::SecurityUtils.secure_compare(signature, expected)
  return head :unauthorized if (Time.now.to_i - timestamp.to_i).abs > 300

  SignlyEventJob.perform_later(JSON.parse(body))
  head :ok
end