> ## Documentation Index
> Fetch the complete documentation index at: https://staging.docs.flowsign.app/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Flowsign is one word with a lowercase s.
> The REST API base URL is https://my.flowsign.app and every endpoint lives under /api/v1.
> When answering API questions, cite the HTTP method and endpoint path.
> API access needs the Enterprise plan and an API key with the API access permission.

# Introduction

> Use the Flowsign REST API to launch packages from templates, send them, follow signing to completion and receive webhook events from your own systems.

The Flowsign REST API is the programmatic side of the app: packages, templates, library documents and signing groups, plus the webhook endpoints that report back. The base URL is `https://my.flowsign.app` and every endpoint lives under `/api/v1`. Successful responses wrap their payload as `{ "data": ... }`; errors are `{ "error": "...", "details"?: {...} }`. The current version is 1.0.0.

<Info>
  The API and webhooks are included in the Enterprise plan. Calls from other plans return `402`. New to the API? The [developer quickstart](/developers) takes you from a key to a sent package in five requests.
</Info>

## Endpoints

* [Account](/api-reference/endpoints/account/get-the-account-behind-a-key): the organisation, workspace and key behind a call.
* [Workspaces](/api-reference/endpoints/workspaces/list-workspaces): the workspace the key acts in.
* [Packages](/api-reference/endpoints/packages/list-packages): create, launch from a template, send, act on, find by external id, read audit events, get preview and signing links, manage documents and fields, and download signed copies or the certificate.
* [Templates](/api-reference/endpoints/templates/list-templates): manage templates and add documents and fields to them.
* [Webhooks](/api-reference/endpoints/webhooks/list-webhook-endpoints): register and manage the HTTPS endpoints that receive events.
* [Library](/api-reference/endpoints/library/list-library-documents): documents that can be attached to a package.
* [Custom fields](/api-reference/endpoints/custom-fields/list-custom-fields): the definitions behind a package's `metadata`.
* [Signing groups](/api-reference/endpoints/signing-groups/list-signing-groups): groups and their members.

Every endpoint page is generated from the [API specification](/api-reference/specification) and carries copyable code samples in eight languages; see [Trying the API](/api-reference/trying-the-api). List endpoints share one [pagination](/api-reference/pagination) scheme.

### Common use cases

* **Sending from your own system**: launch a package from a template with recipients mapped onto roles, and send it in the same call or later.
* **Embedded signing**: fetch a recipient's signing URL and open it inside your product.
* **Tracking to completion**: subscribe a [webhook](/webhooks/overview) to any of the nine package and session events, or poll the package.
* **Archiving**: download the signed copies as one PDF or a zip, and the certificate of completion.
* **Keeping records in step**: carry your own `externalId` and custom field `metadata` on a package, and look it up by that id later.

## Authentication

Every request carries an API key as a Bearer token. Keys start with `fsk_`, are created by an owner at **Settings > API keys**, and are shown once; Flowsign stores only a hash. An organisation can hold up to 50 active keys. See [Authentication](/api-reference/authentication) for the full lifecycle and why a request is refused.

A key is issued for one **role** and one **workspace**. It acts with that role's permissions, never as the person who created it, and every call lands in its workspace. The role must hold the **API access** permission, which the Admin profile has by default. To act in another workspace, create a key for it; see [Workspaces](/api-reference/workspaces).

<Warning>
  A key carries the full API access of its role. Keep it in a secrets manager, never in client-side code or a repository, and revoke it as soon as it is no longer needed.
</Warning>

### Restrict keys by IP address

If the organisation has an IP allowlist under **Settings > Security**, API calls from any other address are refused with `403 IP address not allowed`.

### Set an expiry date

Expiry is optional. A key with no expiry works until it is revoked; a key with an expiry stops working at the end of that day. There is no rotate operation: create a new key, move your integration across, then revoke the old one.

## Errors and rate limits

Status codes, validation `details` and the fixes for common refusals are on [Errors and rate limits](/api-reference/errors) and [Troubleshooting](/api-reference/troubleshooting). All `/api/v1` routes share one limit of 120 requests per 60-second window per source IP; beyond it the API returns `429` with a `Retry-After` header.

<Note>
  These docs are built for coding agents too. Every page has a menu with **Copy page** and **Open in Claude**, and the site is served as an MCP server. See [Use with AI](/api-reference/use-with-ai).
</Note>

## Related topics

* [Developer quickstart](/developers)
* [Webhooks](/webhooks/overview)
* [Contact support](/support/contact)