Signatures from your own software.

1. Step 1

   Create the request

   One POST /v1/signing-requests with the PDF, the signers and how the fields are placed: anchors finds [[ls:signature:client]] markers in the PDF, explicit takes coordinates, auto_append adds a signature page. The answer carries the documentId and one signingUrl per signer.

   In the docs

   curl https://api.wesign.now/v1/templates/$TEMPLATE_ID/instantiate \
     -H "Authorization: Bearer $WSK_KEY" \
     -H "Idempotency-Key: case-4711/mandate" \
     -H "Content-Type: application/json" \
     -d '{
       "recipients": [{ "slot": 1, "email": "anna@example.ch", "name": "Anna Muster" }],
       "field_values": { "company.legal_name": "Muster AG", "company.tax_id": "CHE-123.456.789" },
       "metadata": { "case_id": "4711" }
     }'

   The same send from a locked template: POST /v1/templates/{id}/instantiate merges your field_values into the {{placeholders}} and invites the recipients.

2. Step 2

   Your signer signs

   We email the invitation in the signer's language from your branded subdomain — or you deliver the link yourself with send_emails: false. Add a mobile number and require_sms_verification, and the signer enters a one-time code first: an advanced electronic signature (AES) instead of the email-link level (SES).

   In the docs

   "signers": [{
     "email": "anna@example.ch",
     "role": "client",
     "name": "Anna Muster",
     "locale": "de",
     "phone_e164": "+41791112233",
     "require_sms_verification": true
   }]
   
   # The invitation goes out in German from your branded subdomain.
   # Anna asks for the code on the signing page; the signature is AES once verified.
   # Deliver the link yourself instead: send_emails=false

3. Step 3

   You get the event

   Register a webhook once for the workspace, or pass callback_url per request. Every delivery is HMAC-SHA256 signed, retried with exponential backoff and listed in a delivery log you can redeliver from. document.completed arrives once per document with signed_pdf_url, audit_trail_url and the file's sha256.

   In the docs

   POST https://your-app.example/wesign/callback
   X-WeSign-Event: document.completed
   X-WeSign-Signature: t=1757404800,v1=9c3b…a2f1
   
   {
     "event": "document.completed",
     "document_id": "8a1e4f9a-…",
     "metadata": { "case_id": "4711" },
     "signed_pdf_url": "https://api.wesign.now/v1/documents/8a1e4f9a-…/signed",
     "audit_trail_url": "https://api.wesign.now/v1/documents/8a1e4f9a-…/audit-trail",
     "sha256": "4f9a…d21c", …
   }

4. Step 4

   Fetch the files

   GET /v1/documents/{id}/signed streams the PAdES-sealed PDF, every signature under one seal; /audit-trail renders the event log — SHA-256, time stamp, masked IPs — as a PDF, always in English. Both need your key. Compare the hash and store both files on your side.

   In the docs

   curl -LOJ -H "Authorization: Bearer $WSK_KEY" \
     https://api.wesign.now/v1/documents/$DOC_ID/signed
   
   curl -OJ -H "Authorization: Bearer $WSK_KEY" \
     https://api.wesign.now/v1/documents/$DOC_ID/audit-trail
   
   # Compare the file's SHA-256 with the event's sha256, then store both files on your side.

Every answer carries an X-Request-Id, and Settings → API keeps an API log of every call for 30 days — status, error code, the document concerned; bodies are never stored. An Idempotency-Key makes a retried send or instantiate safe. Each key may make 60 requests per minute.