Skip to main content
The Flowsign REST API is the programmatic side of the app: packages, templates, library documents and signing groups, plus the webhook endpoints that report back. The base URL is https://my.flowsign.app and every endpoint lives under /api/v1. Successful responses wrap their payload as { "data": ... }; errors are { "error": "...", "details"?: {...} }. The current version is 1.0.0; the API changelog lists what each release added.
The API and webhooks are included in the Enterprise plan. Calls from other plans return 402. New to the API? The developer quickstart takes you from a key to a sent package in five requests.

​
Endpoints

  • Account: the organisation, workspace and key behind a call.
  • Workspaces: the workspace the key acts in.
  • Packages: create, launch from a template, send, act on, find by external id, read audit events, get preview and signing links, manage documents and fields, and download signed copies or the certificate.
  • Templates: manage templates and add documents and fields to them.
  • Webhooks: register and manage the HTTPS endpoints that receive events.
  • Library: documents that can be attached to a package.
  • Custom fields: the definitions behind a package’s metadata.
  • Signing groups: groups and their members.
Every endpoint page is generated from the API specification and carries a live playground. List endpoints share one pagination scheme.

​
Common use cases

  • Sending from your own system: launch a package from a template with recipients mapped onto roles, and send it in the same call or later.
  • Embedded signing: fetch a recipient’s signing URL and open it inside your product.
  • Tracking to completion: subscribe a webhook to any of the nine package and session events, or poll the package.
  • Archiving: download the signed copies as one PDF or a zip, and the certificate of completion.
  • Keeping records in step: carry your own externalId and custom field metadata on a package, and look it up by that id later.

​
Authentication

Every request carries an API key as a Bearer token. Keys start with fsk_, are created by an owner at Settings > API keys, and are shown once; Flowsign stores only a hash. An organisation can hold up to 50 active keys. See Authentication for the full lifecycle and why a request is refused. A key is issued for one role and one workspace. It acts with that role’s permissions, never as the person who created it, and every call lands in its workspace. The role must hold the API access permission, which the Admin profile has by default. To act in another workspace, create a key for it; see Workspaces.
A key carries the full API access of its role. Keep it in a secrets manager, never in client-side code or a repository, and revoke it as soon as it is no longer needed.

​
Restrict keys by IP address

If the organisation has an IP allowlist under Settings > Security, API calls from any other address are refused with 403 IP address not allowed.

​
Set an expiry date

Expiry is optional. A key with no expiry works until it is revoked; a key with an expiry stops working at the end of that day. There is no rotate operation: create a new key, move your integration across, then revoke the old one.

​
Errors and rate limits

Status codes, validation details and the fixes for common refusals are on Errors and rate limits and Troubleshooting. All /api/v1 routes share one limit of 120 requests per 60-second window per source IP; beyond it the API returns 429 with a Retry-After header.
These docs are built for coding agents too. Every page has a menu with Copy page and Open in Claude, and the site is served as an MCP server. See Use with AI.