The API and webhooks are available on the Enterprise plan. Calls from other plans return
402.https://my.flowsign.app. Every success response is wrapped as { "data": ... }; every error is { "error": "...", "details"?: {...} }. See Errors.
1
Create an API key
In the app, open Settings > API keys (my.flowsign.app/settings/api-keys) and create a key. Give it a name and, optionally, an expiry date. The key is shown once; copy it now.Creating keys requires the API access permission. The Admin profile has it by default; an administrator can grant it to other profiles from Roles & Permissions. A key acts as the user who created it, with that user’s permissions.
2
Check the key works
List the workspaces the key can act in. The response also tells you which workspace the call used.To act in a different workspace, send
X-Workspace-Id: <id> on any request. See Workspaces.3
Build a template in the app
The public API does not upload PDF files, so the documents and fields for a package come from a template. Create one in the app with at least one document, one role and the fields each role must complete, then set it to Each template in the response lists its
ACTIVE. See Building a workflow.Find its id with the API:roles in order. You map recipients onto roles by position (roleIndex) in the next step.4
Create a package from the template
POST /api/v1/templates/{templateId} creates a DRAFT package. Supply one recipient per role, using the role’s zero-based position in the template’s roles array. Merge field values are optional and are interpolated into the package title and email copy.scheduledAt (an ISO 8601 timestamp) instead to create a SCHEDULED package that FlowSign sends at that time. Do not call send on a scheduled package.5
Send it
Sending is an action on the package. Only Every Signer and Viewer now receives their invitation email. Sending charges one package against your allowance; a
DRAFT packages can be sent, and the key’s user needs the send permission.402 means the organisation has run out of credit.6
Follow progress
Poll the package, or register a webhook and react to The response includes
SESSION_COMPLETED and PACKAGE_COMPLETED instead.status, each recipient’s session with sentAt, openedAt, completedAt and declinedAt, the documents, and the last 100 audit events.The same flow in code
The steps above are the cURL walkthrough. Here is the whole run in one file, in each of the languages the endpoint reference also shows.Other package actions
PATCH /api/v1/packages/{packageId} also accepts:
Custom fields
Custom fields are the organisation’s own reference values on a package, such as an employee ID or a cost centre. Admins define them under Settings → Custom fields; each one has akey that never changes.
Packages carry their values as metadata, an object keyed by custom field key. GET /api/v1/packages, GET /api/v1/packages/{packageId} and every webhook event include it, as {} when nothing is set. GET /api/v1/templates/{templateId} returns the template’s defaults the same way.
Set values with metadata on POST /api/v1/packages/from-template or POST /api/v1/packages. A package from a template starts with the template’s defaults, and each key you send replaces one; an empty string clears it.
422 and details.metadata when a key is not a live custom field that applies to the package, and when a required custom field is empty on a call that sends or schedules the package. Sending a draft with PATCH checks its required custom fields the same way.
Creating a package without a template
POST /api/v1/packages creates a DRAFT package from a title, recipients and document descriptors (fileName, pageCount, nonce), or a SCHEDULED one when you pass scheduledAt. It returns a storage filePath per document, but the public API has no endpoint for uploading the PDF bytes, and fields are placed in the app. Use it when the package will be finished in the app; use templates when the whole flow must run from code.
Release labels
Parts of the app carry a label such as Experimental or Coming soon, explained in Release labels. Those labels describe the app, not this API: an experimental feature is not part of the public API unless an endpoint says so.Next
Authentication
Key lifecycle, permissions, plan gates and the IP allowlist.
Errors and rate limits
Status codes, validation details and the 120 requests per minute limit.
Webhooks
Signed event deliveries with retries.
Endpoint reference
Every request and response field, with a playground.

