Skip to main content
This page describes the data that moves through the API and webhooks. The Privacy Policy remains the authority on what Flowsign itself collects and keeps.

​
What an API key can see

A key is bound to one workspace for its whole life and acts with the permissions of the role chosen when it was created, never as the person who issued it and never as an owner. Everything it can read or change (packages, templates, documents, recipients, audit events) is scoped to that workspace. Flowsign stores only a hash of the key. See Authentication.

​
Requests go to production

There is no sandbox. The code samples on each endpoint page point at https://my.flowsign.app, the production API, and nothing on these pages sends a request for you: every call comes from your own tooling with your own key. Creating a package with "status": "sent" really sends it. For testing, use a key with an expiry date and a minimal role, and revoke it from Settings > API keys when you are done. See Trying the API.

​
What webhook payloads contain

Every event carries the package id, the package title and metadata, the package’s custom field values. Session events add the recipient’s name, email address and turn timestamps. Titles and custom fields are free text typed by your senders, so a payload can contain personal information. Treat a webhook listener as a system that handles personal data: verify the signature, keep payloads only as long as you need them, and keep bodies out of shared logs. Endpoints belong to the organisation and receive events from every workspace. See Webhooks and Events.

​
Where audit trails and certificates live

Every package keeps an audit trail with a timestamp, IP address and device per event. Read it on the package page, under Reports > Audit trail (Audit trail), or with GET /api/v1/packages/{packageId}/audit-events. When the last recipient finishes, the signed documents and the certificate of completion are available from the package page. Through the API, GET /api/v1/packages/{packageId}/documents/{documentId} returns a download URL that serves the signed copy once the package has completed; it expires after an hour, so fetch it when needed rather than storing it. Retention is set out in the Privacy Policy.