> ## Documentation Index
> Fetch the complete documentation index at: https://staging.docs.flowsign.app/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Flowsign is one word with a lowercase s.
> The REST API base URL is https://my.flowsign.app and every endpoint lives under /api/v1.
> When answering API questions, cite the HTTP method and endpoint path.
> API access needs the Enterprise plan and an API key with the API access permission.

# The API and your data

> What an API key can reach, what webhooks send where, and where the audit trail and certificates live.

This page describes the data that moves through the API and webhooks. The [Privacy Policy](https://flowsign.app/legal/privacy) remains the authority on what Flowsign itself collects and keeps.

## What an API key can see

A key is bound to one workspace for its whole life and acts with the permissions of the role chosen when it was created, never as the person who issued it and never as an owner. Everything it can read or change (packages, templates, documents, recipients, audit events) is scoped to that workspace. Flowsign stores only a hash of the key. See [Authentication](/api-reference/authentication).

## Requests go to production

There is no sandbox. The code samples on each endpoint page point at `https://my.flowsign.app`, the production API, and nothing on these pages sends a request for you: every call comes from your own tooling with your own key. Creating a package with `"status": "sent"` really sends it. For testing, use a key with an expiry date and a minimal role, and revoke it from **Settings > API keys** when you are done. See [Trying the API](/api-reference/trying-the-api).

## What webhook payloads contain

Every event carries the package id, the package title and `metadata`, the package's custom field values. Session events add the recipient's name, email address and turn timestamps. Titles and custom fields are free text typed by your senders, so a payload can contain personal information.

Treat a webhook listener as a system that handles personal data: verify the signature, keep payloads only as long as you need them, and keep bodies out of shared logs. Endpoints belong to the organisation and receive events from every workspace. See [Webhooks](/webhooks/overview) and [Events](/webhooks/events).

## Where audit trails and certificates live

Every package keeps an audit trail with a timestamp, IP address and device per event. Read it on the package page, under **Reports > Audit trail** ([Audit trail](/guides/reports/audit-trail)), or with `GET /api/v1/packages/{packageId}/audit-events`.

When the last recipient finishes, the signed documents and the certificate of completion are available from the package page. Through the API, `GET /api/v1/packages/{packageId}/documents/{documentId}` returns a download URL that serves the signed copy once the package has completed; it expires after an hour, so fetch it when needed rather than storing it. Retention is set out in the [Privacy Policy](https://flowsign.app/legal/privacy#retention).