docspring 4.1.0 → 4.2.0

data/docs/CreateSubmissionRequest.md

@@ -7,13 +7,13 @@
 | **test** | **Boolean** | Test PDFs have a watermark and are free. Live PDFs use credits. Submissions made with a test API token are always test submissions. | [optional] |
 | **editable** | **Boolean** | `true` keeps the PDF's text and check fields fillable, and `false` flattens every field. Left out, the template decides: its `editable_submissions` setting, or each field's own Editable option. A response shows the template's setting when the request left this out. Can't be `true` with `signature_requests`. | [optional] |
 | **data** | **Hash<String, Object>** | The values of the template's fields, by field name. Required for a PDF template, unless `signature_requests` collects the values. | [optional] |
-| **metadata** | **Hash<String, Object>** | Your own data about the submission, such as an ID from your app. It isn't printed on the PDF. | [optional] |
+| **metadata** | **Hash<String, Object>** | Your own data about the submission, such as an ID from your app. It isn't printed on the PDF. Two keys also change the PDF: `pdf_filename` names its file (`files.pdf.filename`, and its download), and `pdf_title` is its title in the PDF's document properties (and an HTML template's `<title>`, unless its HTML has one). Without `pdf_title`, the title is the template's name. In `pdf_filename`, a `.pdf` ending is removed, each run of characters other than letters, digits, `-`, `_` and `.` becomes one `_`, and the first 128 characters are kept, then `.pdf` is added. Without it, the file is named after the submission's ID (`sub_1234567890abcdef01.pdf`). | [optional] |
 | **password** | **String** | A password that the PDF needs to be opened with. It's never returned; `has_password` says if it's set. | [optional] |
 | **output_formats** | [**Array<OutputFormat>**](OutputFormat.md) | What the submission makes: `pdf`, and `png` (an image of each page of the PDF, up to 100 pages) when you ask for it. Default `["pdf"]`. POST /submissions/{submission_id}/generate_files adds `png` to a processed submission. | [optional] |
 | **expires_in** | **Integer** | Seconds after the PDF is generated until the submission expires, up to 10 years (315360000). Default the template's expiration setting. A submission that isn't processed, such as one with invalid data, is kept for at least 48 hours. | [optional] |
 | **field_overrides** | [**Hash<String, FieldOverride>**](FieldOverride.md) | Changes to field settings for this submission only, by field name, such as `{"name": {"required": false, "font_size": 9}}`. A setting that identifies the field (`id`, `name`, `type`), that only the template sets (such as `description`), or that doesn't apply to the field's type and display type (such as `check_character` on a field displayed as text) is a 422. With `signature_requests`, `editable: true` is a 422, and a `default` for a signature or initials field makes the submission `invalid_data`. | [optional] |
 | **html** | **String** | For an HTML template, HTML to use instead of the template's. | [optional] |
-| **css** | **String** | For an HTML template, CSS to use instead of the template's. | [optional] |
+| **css** | **String** | For an HTML template, SCSS (plain CSS works too) added after the template's styles, on the page and in its header and footer. It doesn't replace them: its rules come later, so they win over the template's rules of the same specificity. | [optional] |
 | **signature_requests** | [**Array<SignatureRequestInput>**](SignatureRequestInput.md) | The people who sign the PDF, and fill in their fields first. The PDF is generated once every signature request is completed. PDF templates only. Without `role`s, the first signature request is `Signer 1`, the second `Signer 2`, and so on. To leave a signer out, give every signature request its `role` and leave that one's out. Only the signers sign: a value for a signature or initials field in `data` makes the submission `invalid_data`. | [optional] |
 
 ## Example

data/docs/CreateTemplatePreviewRequest.md

@@ -0,0 +1,18 @@
+# DocSpring::CreateTemplatePreviewRequest
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **data** | **Hash<String, Object>** | The values of the template's fields, by field name, as you'd send them to create a submission. They're rendered as they are: they aren't checked against the template's fields. A value that a field can't print, such as an image URL that doesn't download, makes the preview's `state` `error`, with an `error_message`. |  |
+
+## Example
+
+```ruby
+require 'docspring'
+
+instance = DocSpring::CreateTemplatePreviewRequest.new(
+  data: null
+)
+```
+

data/docs/CreateTemplateRequest.md

@@ -15,7 +15,7 @@
 | **allow_skipping_optional_fields** | **Boolean** | Visual forms and signature request forms show the Continue button as soon as the required fields are filled in, without visiting each optional field. The `allowSkippingOptionalFields` embed option overrides it. | [optional] |
 | **default_form_mode** | [**TemplateFormMode**](TemplateFormMode.md) | The hosted form that /templates/{template_id}/form shows when its URL has no `mode` parameter: `web` (the web form), `visual` (the visual form, where fields are filled in on the PDF) or `dual` (both, in tabs). HTML templates have no visual form, so `web` is the only value they accept. | [optional] |
 | **editable_submissions** | **Boolean** | Generate PDFs whose text and check fields stay fillable ("Generate Editable PDFs"). A submission's `editable` overrides it. | [optional] |
-| **embed_domains** | **Array<String>** | The sites where the template's signature requests, forms and embedded template editor can be loaded: a host such as `app.example.com`, with an optional leading wildcard (`*.example.com`), port (`localhost:3000`) or scheme (`https://app.example.com`; without one, `http` and `https` both work). When it's empty, live signature requests don't load on any site, and the embedded template editor loads on every site. | [optional] |
+| **embed_domains** | **Array<String>** | The sites that can embed the template's live signature requests and its embedded template editor: a host such as `app.example.com`, with an optional leading wildcard (`*.example.com`), port (`localhost:3000`) or scheme (`https://app.example.com`; without one, `http` and `https` both work). Browsers open a live signature request in a frame only on these sites (and DocSpring's), so with an empty list it can't be embedded anywhere; a test signature request can be embedded on any site. The embedded template editor loads only for a page on one of these sites (by its Referer or Origin header), and on any site when the list is empty. Forms embedded on a page (Visual Forms JS and the simple form) aren't restricted. | [optional] |
 | **embed_edit_allow_settings** | **Boolean** | Allow the embedded template editor to change sensitive template settings (webhooks, redirect URL, encryption, public access, expiration and so on). | [optional] |
 | **embed_edit_allow_versioning** | **Boolean** | Allow the embedded template editor to publish, restore, compare and delete published versions. | [optional] |
 | **embed_edit_allow_document_replacement** | **Boolean** | Allow the embedded template editor to replace the template's PDF. | [optional] |
@@ -39,6 +39,7 @@
 | **header_html** | **String** | The HTML printed at the top of each page of an HTML template. | [optional] |
 | **footer_html** | **String** | The HTML printed at the bottom of each page of an HTML template. | [optional] |
 | **html_engine_options** | [**HtmlEngineOptionsInput**](HtmlEngineOptionsInput.md) | Null resets the options to their defaults. | [optional] |
+| **html_escape_data** | **Boolean** | Whether an HTML template HTML-escapes the values it prints. When true, `{{ value }}` prints a value as text, so a `<` or `&` in it is printed as that character, and `{{ value | raw }}` prints a value as HTML. New HTML templates default to true. Templates created before October 2026, or with API v1, default to false, which prints every value as HTML. Null for PDF templates. | [optional] |
 | **cache_id** | **String** | A PDF template's document: the `fields.key` of a file you uploaded with the presigned upload (GET /uploads/presign). A PDF template needs one of `cache_id`, `document_url` and `document_base64`. To upload the PDF with the request, use POST /templates/upload. | [optional] |
 | **document_url** | **String** | An https:// link to the template's PDF (up to 100 MB), instead of `cache_id`. DocSpring downloads it after responding, following redirects to other https:// links: the template's `document.state` is `downloading` until then (sync.api hosts wait for it). If it can't be downloaded, the state is `download_failed` and `document.error_message` says why. | [optional] |
 | **document_base64** | **String** | The template's PDF, encoded as base64 (a `data:` URI works too), instead of `cache_id`. Up to 7 MB before it's encoded: send a larger file with `cache_id` or `document_url`. | [optional] |
@@ -89,6 +90,7 @@ instance = DocSpring::CreateTemplateRequest.new(
   header_html: null,
   footer_html: null,
   html_engine_options: null,
+  html_escape_data: null,
   cache_id: null,
   document_url: null,
   document_base64: null,

data/docs/ErrorDetail.md

@@ -7,7 +7,7 @@
 | **code** | **String** | What's wrong: `required`, `unknown_property`, `type`, `enum`, `format`, a JSON Schema keyword such as `minLength`, or a DocSpring code. New codes can be added. |  |
 | **message** | **String** | A human-readable explanation of the problem. |  |
 | **pointer** | **String** | A JSON pointer to the value in the request body (RFC 6901). An empty string means the whole body. In a submission's `data_errors`, it points into the request that created the submission. | [optional] |
-| **parameter** | **String** | The query parameter the detail is about. | [optional] |
+| **parameter** | **String** | The query parameter or header the detail is about. | [optional] |
 | **submission_id** | **String** | For a batch item that failed validation, the ID of the submission recorded for it. | [optional] |
 
 ## Example

data/docs/ErrorInfo.md

@@ -4,13 +4,13 @@
 
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
-| **code** | [**ErrorCode**](ErrorCode.md) | A machine-readable error code. Clients should handle codes they don't know: new codes can be added. `invalid_data`: a submission's data doesn't match its template's fields. The submission is still recorded. `insufficient_credits` (402): your credit balance can't cover a live PDF. The record was saved and waits for credits in the `insufficient_credits` state: its ID is in `submission_id`, `submission_batch_id` or `combined_pdf_id`. `upgrade_required` (403): your plan doesn't include this, such as more templates or the embedded template editor. `account_suspended` (403): the account is suspended, so it can't create submissions. `polling_timeout`: on a sync.api host, the PDF wasn't ready in time. The record was created and is still being processed: its ID is in `submission_id`, `submission_batch_id`, `combined_pdf_id` or `template_id`. Without one of these IDs, the request itself got no answer in time, and the record may or may not have been created. |  |
+| **code** | [**ErrorCode**](ErrorCode.md) | A machine-readable error code. Clients should handle codes they don't know: new codes can be added. `invalid_data`: a submission's data doesn't match its template's fields. The submission is still recorded. `insufficient_credits` (402): your credit balance can't cover a live PDF. The record was saved and waits for credits in the `insufficient_credits` state: its ID is in `submission_id`, `submission_batch_id` or `combined_pdf_id`. `upgrade_required` (403): your plan doesn't include this, such as more templates or the embedded template editor. `account_suspended` (403): the account is suspended, so it can't create submissions. `polling_timeout`: on a sync.api host, the PDF wasn't ready in time. The record was created and is still being processed: its ID is in `submission_id`, `submission_batch_id`, `combined_pdf_id` or `template_id`. Without one of these IDs, the request itself got no answer in time, and the record may or may not have been created. `idempotency_key_in_use` (409): a request with the same Idempotency-Key is still being processed. Send the request again in a few seconds; when the first request has already created its record, its ID is in `submission_id`, `submission_batch_id` or `combined_pdf_id`. `idempotency_key_reused` (422): the Idempotency-Key was already used for a different request. |  |
 | **message** | **String** | A human-readable explanation, safe to show to developers. |  |
 | **details** | [**Array<ErrorDetail>**](ErrorDetail.md) | What was wrong with each part of the request. Empty when the error isn't about one part of it. |  |
 | **request_id** | **String** | The ID of the request. Include it when you contact support. |  |
-| **submission_id** | **String** | When a submission's data fails validation, the submission is still recorded (state `invalid_data`) so you can see it in the dashboard. This is its ID. With `insufficient_credits`, the submission that waits for credits. With `polling_timeout`, the submission that's still being processed. | [optional] |
-| **submission_batch_id** | **String** | The ID of the recorded batch, when items in a batch fail validation. With `insufficient_credits`, the batch whose submissions wait for credits. With `polling_timeout`, the batch that's still being processed. | [optional] |
-| **combined_pdf_id** | **String** | With `insufficient_credits`, the combined PDF that waits for credits. With `polling_timeout`, the combined PDF that's still being processed. | [optional] |
+| **submission_id** | **String** | When a submission's data fails validation, the submission is still recorded (state `invalid_data`) so you can see it in the dashboard. This is its ID. With `insufficient_credits`, the submission that waits for credits. With `polling_timeout` or `idempotency_key_in_use`, the submission that's still being processed. | [optional] |
+| **submission_batch_id** | **String** | The ID of the recorded batch, when items in a batch fail validation. With `insufficient_credits`, the batch whose submissions wait for credits. With `polling_timeout` or `idempotency_key_in_use`, the batch that's still being processed. | [optional] |
+| **combined_pdf_id** | **String** | With `insufficient_credits`, the combined PDF that waits for credits. With `polling_timeout` or `idempotency_key_in_use`, the combined PDF that's still being processed. | [optional] |
 | **template_id** | **String** | With `polling_timeout`, the template whose PDF is still being processed. | [optional] |
 
 ## Example

data/docs/Submission.md

@@ -13,22 +13,22 @@
 | **state** | [**SubmissionState**](SubmissionState.md) | `pending` until the PDF has been generated, then `processed`. `waiting_for_signature_requests` until every signature request is completed. `insufficient_credits`: waiting for credits; `error_message` says whether the PDF is generated once you add them. `account_suspended`: waiting for the account to be reactivated, for up to 30 days. Waiting ends in `error` if it's discarded or takes over 30 days. Every other state is final, with no PDF: `invalid_data` (the data doesn't match the template's fields: see `data_errors`), `declined` (a signature request was declined), and the states where generating the PDF failed, which have an `error_message`: `syntax_error` (a mistake in an HTML template's Liquid or SCSS), `image_download_failed` or `image_processing_failed` (an image in the data or the template couldn't be downloaded or read) and `error` (anything else). Older submissions can also be `license_revoked` or `accidental`. |  |
 | **test** | **Boolean** | Test PDFs have a watermark and are free. Live PDFs use credits. Submissions made with a test API token are always test submissions. |  |
 | **editable** | **Boolean** | `true` keeps the PDF's text and check fields fillable, and `false` flattens every field. Left out, the template decides: its `editable_submissions` setting, or each field's own Editable option. A response shows the template's setting when the request left this out. Can't be `true` with `signature_requests`. |  |
-| **data** | **Hash<String, Object>** | The submission's data, with the values entered in completed signature requests. Lists leave it out (null) unless you pass `include_data=true`. Empty once the submission has expired. |  |
+| **data** | **Hash<String, Object>** | The submission's data, with the values entered in completed signature requests. Empty once the submission has expired. Null in a batch's submissions unless you pass `include_data=true`, and in the events of a webhook that leaves out submission data. |  |
 | **data_errors** | [**Array<ErrorDetail>**](ErrorDetail.md) | Why the data doesn't match the template's fields, when `state` is `invalid_data`: the same details as the 422 response that recorded it, with pointers into the request that created the submission (`/data/name`). Cleared once the submission has expired. |  |
 | **error_message** | **String** | Why the PDF couldn't be generated, when `state` is `error`. |  |
-| **metadata** | **Hash<String, Object>** | Your own data about the submission, such as an ID from your app. It isn't printed on the PDF. |  |
-| **has_password** | **Boolean** | Whether the PDF needs a password to open (`password`). |  |
-| **signature_requests** | [**Array<SignatureRequest>**](SignatureRequest.md) | The people asked to sign the submission (and fill in their fields), in order. |  |
-| **actions** | [**Array<SubmissionAction>**](SubmissionAction.md) | The uploads of the submission's PDF to your storage (account integrations). |  |
-| **truncated_text** | **Hash<String, Array<String>>** | The text of each field that didn't fit in it, by field name. Left out (null) with `data`, and empty once the submission has expired. |  |
-| **output_formats** | [**Array<OutputFormat>**](OutputFormat.md) | What the submission makes: `pdf`, and `png` (an image of each page of the PDF, up to 100 pages) when you ask for it. Default `["pdf"]`. POST /submissions/{submission_id}/generate_files adds `png` to a processed submission. |  |
+| **metadata** | **Hash<String, Object>** | Your own data about the submission, such as an ID from your app. It isn't printed on the PDF. Two keys also change the PDF: `pdf_filename` names its file (`files.pdf.filename`, and its download), and `pdf_title` is its title in the PDF's document properties (and an HTML template's `<title>`, unless its HTML has one). Without `pdf_title`, the title is the template's name. In `pdf_filename`, a `.pdf` ending is removed, each run of characters other than letters, digits, `-`, `_` and `.` becomes one `_`, and the first 128 characters are kept, then `.pdf` is added. Without it, the file is named after the submission's ID (`sub_1234567890abcdef01.pdf`). |  |
 | **files** | [**SubmissionFiles**](SubmissionFiles.md) | The generated files: `pdf` once the submission has been processed, `png` (the images of the PDF's pages, when `output_formats` has it: `files.png.pages[0]` is page 1), `audit_trail` once its signature requests are completed, and `preview` once a preview PDF has been generated. Empty once the submission has expired. |  |
-| **preview_generated_at** | **Time** | When the preview PDF was generated. Null if there is no preview. |  |
 | **expired** | **Boolean** | An expired submission's data, metadata, password and PDF have been deleted. |  |
 | **expires_at** | **Time** | When the submission expires. Null if it's kept until you delete it. |  |
 | **processed_at** | **Time** | When the PDF was generated. Null until then. |  |
 | **created_at** | **Time** | When the submission was created. |  |
 | **updated_at** | **Time** | When the submission was last updated. |  |
+| **has_password** | **Boolean** | Whether the PDF needs a password to open (`password`). |  |
+| **signature_requests** | [**Array<SignatureRequest>**](SignatureRequest.md) | The people asked to sign the submission (and fill in their fields), in order. |  |
+| **actions** | [**Array<SubmissionAction>**](SubmissionAction.md) | The uploads of the submission's PDF to your storage (account integrations). |  |
+| **truncated_text** | **Hash<String, Array<String>>** | The text of each field that didn't fit in it, by field name. Left out (null) with `data`, and empty once the submission has expired. |  |
+| **output_formats** | [**Array<OutputFormat>**](OutputFormat.md) | What the submission makes: `pdf`, and `png` (an image of each page of the PDF, up to 100 pages) when you ask for it. Default `["pdf"]`. POST /submissions/{submission_id}/generate_files adds `png` to a processed submission. |  |
+| **preview_generated_at** | **Time** | When the preview PDF was generated. Null if there is no preview. |  |
 
 ## Example
 
@@ -49,18 +49,18 @@ instance = DocSpring::Submission.new(
   data_errors: null,
   error_message: null,
   metadata: null,
-  has_password: null,
-  signature_requests: null,
-  actions: null,
-  truncated_text: null,
-  output_formats: null,
   files: null,
-  preview_generated_at: null,
   expired: null,
   expires_at: null,
   processed_at: null,
   created_at: null,
-  updated_at: null
+  updated_at: null,
+  has_password: null,
+  signature_requests: null,
+  actions: null,
+  truncated_text: null,
+  output_formats: null,
+  preview_generated_at: null
 )
 ```
 

data/docs/SubmissionInput.md

@@ -7,13 +7,13 @@
 | **test** | **Boolean** | Test PDFs have a watermark and are free. Live PDFs use credits. Submissions made with a test API token are always test submissions. | [optional] |
 | **editable** | **Boolean** | `true` keeps the PDF's text and check fields fillable, and `false` flattens every field. Left out, the template decides: its `editable_submissions` setting, or each field's own Editable option. A response shows the template's setting when the request left this out. Can't be `true` with `signature_requests`. | [optional] |
 | **data** | **Hash<String, Object>** | The values of the template's fields, by field name. Required for a PDF template. | [optional] |
-| **metadata** | **Hash<String, Object>** | Your own data about the submission, such as an ID from your app. It isn't printed on the PDF. | [optional] |
+| **metadata** | **Hash<String, Object>** | Your own data about the submission, such as an ID from your app. It isn't printed on the PDF. Two keys also change the PDF: `pdf_filename` names its file (`files.pdf.filename`, and its download), and `pdf_title` is its title in the PDF's document properties (and an HTML template's `<title>`, unless its HTML has one). Without `pdf_title`, the title is the template's name. In `pdf_filename`, a `.pdf` ending is removed, each run of characters other than letters, digits, `-`, `_` and `.` becomes one `_`, and the first 128 characters are kept, then `.pdf` is added. Without it, the file is named after the submission's ID (`sub_1234567890abcdef01.pdf`). | [optional] |
 | **password** | **String** | A password that the PDF needs to be opened with. It's never returned; `has_password` says if it's set. | [optional] |
 | **output_formats** | [**Array<OutputFormat>**](OutputFormat.md) | What the submission makes: `pdf`, and `png` (an image of each page of the PDF, up to 100 pages) when you ask for it. Default `["pdf"]`. POST /submissions/{submission_id}/generate_files adds `png` to a processed submission. | [optional] |
 | **expires_in** | **Integer** | Seconds after the PDF is generated until the submission expires, up to 10 years (315360000). Default the template's expiration setting. A submission that isn't processed, such as one with invalid data, is kept for at least 48 hours. | [optional] |
 | **field_overrides** | [**Hash<String, FieldOverride>**](FieldOverride.md) | Changes to field settings for this submission only, by field name, such as `{"name": {"required": false, "font_size": 9}}`. A setting that identifies the field (`id`, `name`, `type`), that only the template sets (such as `description`), or that doesn't apply to the field's type and display type (such as `check_character` on a field displayed as text) is a 422. With `signature_requests`, `editable: true` is a 422, and a `default` for a signature or initials field makes the submission `invalid_data`. | [optional] |
 | **html** | **String** | For an HTML template, HTML to use instead of the template's. | [optional] |
-| **css** | **String** | For an HTML template, CSS to use instead of the template's. | [optional] |
+| **css** | **String** | For an HTML template, SCSS (plain CSS works too) added after the template's styles, on the page and in its header and footer. It doesn't replace them: its rules come later, so they win over the template's rules of the same specificity. | [optional] |
 | **template_id** | **String** | The submission's template. Default the batch's `template_id`. | [optional] |
 | **template_version** | **String** | The version of the submission's template. Default the batch's `template_version`. | [optional] |
 

data/docs/SubmissionList.md

@@ -4,7 +4,7 @@
 
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
-| **data** | [**Array<Submission>**](Submission.md) | The items on this page. |  |
+| **data** | [**Array<SubmissionSummary>**](SubmissionSummary.md) | The items on this page. |  |
 | **next_cursor** | **String** | Pass it as `cursor` to get the next page. Null on the last page. |  |
 
 ## Example

data/docs/SubmissionSummary.md

@@ -0,0 +1,54 @@
+# DocSpring::SubmissionSummary
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **id** | **String** | The submission's ID. |  |
+| **template_id** | **String** | Null once the template has been permanently deleted. |  |
+| **template_type** | [**TemplateType**](TemplateType.md) | The template's type: `pdf` or `html`. |  |
+| **template_version** | **String** | The published version of the template the submission used. Null for the draft. |  |
+| **batch_id** | **String** | The ID of the batch the submission was created in. |  |
+| **source** | [**SubmissionSource**](SubmissionSource.md) | `api`: created with the API. `web`: a web form. `reprocess`: a copy of another submission, made to generate its PDF again. |  |
+| **state** | [**SubmissionState**](SubmissionState.md) | `pending` until the PDF has been generated, then `processed`. `waiting_for_signature_requests` until every signature request is completed. `insufficient_credits`: waiting for credits; `error_message` says whether the PDF is generated once you add them. `account_suspended`: waiting for the account to be reactivated, for up to 30 days. Waiting ends in `error` if it's discarded or takes over 30 days. Every other state is final, with no PDF: `invalid_data` (the data doesn't match the template's fields: see `data_errors`), `declined` (a signature request was declined), and the states where generating the PDF failed, which have an `error_message`: `syntax_error` (a mistake in an HTML template's Liquid or SCSS), `image_download_failed` or `image_processing_failed` (an image in the data or the template couldn't be downloaded or read) and `error` (anything else). Older submissions can also be `license_revoked` or `accidental`. |  |
+| **test** | **Boolean** | Test PDFs have a watermark and are free. Live PDFs use credits. Submissions made with a test API token are always test submissions. |  |
+| **editable** | **Boolean** | `true` keeps the PDF's text and check fields fillable, and `false` flattens every field. Left out, the template decides: its `editable_submissions` setting, or each field's own Editable option. A response shows the template's setting when the request left this out. Can't be `true` with `signature_requests`. |  |
+| **data** | **Hash<String, Object>** | The submission's data, with the values entered in completed signature requests. Null unless you pass `include_data=true`. Empty once the submission has expired. |  |
+| **data_errors** | [**Array<ErrorDetail>**](ErrorDetail.md) | Why the data doesn't match the template's fields, when `state` is `invalid_data`: the same details as the 422 response that recorded it, with pointers into the request that created the submission (`/data/name`). Cleared once the submission has expired. |  |
+| **error_message** | **String** | Why the PDF couldn't be generated, when `state` is `error`. |  |
+| **metadata** | **Hash<String, Object>** | Your own data about the submission, such as an ID from your app. It isn't printed on the PDF. Two keys also change the PDF: `pdf_filename` names its file (`files.pdf.filename`, and its download), and `pdf_title` is its title in the PDF's document properties (and an HTML template's `<title>`, unless its HTML has one). Without `pdf_title`, the title is the template's name. In `pdf_filename`, a `.pdf` ending is removed, each run of characters other than letters, digits, `-`, `_` and `.` becomes one `_`, and the first 128 characters are kept, then `.pdf` is added. Without it, the file is named after the submission's ID (`sub_1234567890abcdef01.pdf`). |  |
+| **files** | [**SubmissionFiles**](SubmissionFiles.md) | Empty unless you pass `include_files=true`: then the generated files, as when you get the submission, without the `png` pages' links (`files.png.pages` is null). Get the submission for its page images. |  |
+| **expired** | **Boolean** | An expired submission's data, metadata, password and PDF have been deleted. |  |
+| **expires_at** | **Time** | When the submission expires. Null if it's kept until you delete it. |  |
+| **processed_at** | **Time** | When the PDF was generated. Null until then. |  |
+| **created_at** | **Time** | When the submission was created. |  |
+| **updated_at** | **Time** | When the submission was last updated. |  |
+
+## Example
+
+```ruby
+require 'docspring'
+
+instance = DocSpring::SubmissionSummary.new(
+  id: null,
+  template_id: null,
+  template_type: null,
+  template_version: null,
+  batch_id: null,
+  source: null,
+  state: null,
+  test: null,
+  editable: null,
+  data: null,
+  data_errors: null,
+  error_message: null,
+  metadata: null,
+  files: null,
+  expired: null,
+  expires_at: null,
+  processed_at: null,
+  created_at: null,
+  updated_at: null
+)
+```
+

data/docs/Template.md

@@ -8,21 +8,24 @@
 | **name** | **String** | The template's name. |  |
 | **description** | **String** | Shown under the template's name at the top of its hosted forms, and used as their meta description. Not shown on embedded forms or signature requests. |  |
 | **template_type** | [**TemplateType**](TemplateType.md) | `pdf`: fields placed on an uploaded PDF. `html`: a PDF rendered from HTML and SCSS. It can't be changed after the template is created. |  |
-| **ready** | **Boolean** | Whether the template can generate PDFs. HTML templates are always ready. A PDF template is ready once its document has been processed (`document.state` is `processed`). |  |
+| **ready** | **Boolean** | Whether the template can generate PDFs. HTML templates are always ready. A PDF template is ready once DocSpring has stored its PDF, made an image of each page and finished looking for fields on each page, which can be after `document.state` becomes `processed`. A PDF template with no PDF (`document` is null) isn't ready. |  |
 | **document** | [**TemplateDocument**](TemplateDocument.md) | The PDF of a PDF template. Null for HTML templates, and for a PDF template that has no PDF yet. |  |
 | **parent_folder_id** | **String** | The ID of the folder the template is in. Null for a template at the root. Setting it moves the template and all of its published versions. |  |
 | **path** | **String** | The path of the folder the template is in, such as `/Contracts`. `/` for a template at the root. |  |
-| **version** | **String** | The published version this is, such as `1.2.0`. Null for the draft. |  |
 | **latest_version** | **String** | The template's latest published version. Null if no version has been published. |  |
 | **version_published_at** | **Time** | When this version was published. Null for the draft. |  |
 | **locked** | **Boolean** | A locked template can't be changed or deleted until it's unlocked (`locked` can always be changed). |  |
+| **last_changed_at** | **Time** | When the draft was last changed. |  |
+| **created_at** | **Time** | When the template was created. |  |
+| **updated_at** | **Time** | When the template was last updated. |  |
+| **version** | **String** | The published version this is, such as `1.2.0`. Null for the draft. |  |
 | **add_signature_request_submission_id_footers** | **Boolean** | Print the submission ID in the footer of each page of PDFs signed through signature requests. |  |
 | **ai_field_naming_language** | [**AiFieldNamingLanguage**](AiFieldNamingLanguage.md) | The language AI field setup names fields in: `auto` uses the form's language when it's written in the Latin alphabet without accents, and English otherwise; `english` always uses English; `form_language` uses the form's language and script. New templates take it from your account's template settings. Null for HTML templates. |  |
 | **allow_additional_properties** | **Boolean** | Accept submission data with properties that aren't fields of the template. |  |
 | **allow_skipping_optional_fields** | **Boolean** | Visual forms and signature request forms show the Continue button as soon as the required fields are filled in, without visiting each optional field. The `allowSkippingOptionalFields` embed option overrides it. |  |
 | **default_form_mode** | [**TemplateFormMode**](TemplateFormMode.md) | The hosted form that /templates/{template_id}/form shows when its URL has no `mode` parameter: `web` (the web form), `visual` (the visual form, where fields are filled in on the PDF) or `dual` (both, in tabs). HTML templates have no visual form, so `web` is the only value they accept. |  |
 | **editable_submissions** | **Boolean** | Generate PDFs whose text and check fields stay fillable ("Generate Editable PDFs"). A submission's `editable` overrides it. |  |
-| **embed_domains** | **Array<String>** | The sites where the template's signature requests, forms and embedded template editor can be loaded: a host such as `app.example.com`, with an optional leading wildcard (`*.example.com`), port (`localhost:3000`) or scheme (`https://app.example.com`; without one, `http` and `https` both work). When it's empty, live signature requests don't load on any site, and the embedded template editor loads on every site. |  |
+| **embed_domains** | **Array<String>** | The sites that can embed the template's live signature requests and its embedded template editor: a host such as `app.example.com`, with an optional leading wildcard (`*.example.com`), port (`localhost:3000`) or scheme (`https://app.example.com`; without one, `http` and `https` both work). Browsers open a live signature request in a frame only on these sites (and DocSpring's), so with an empty list it can't be embedded anywhere; a test signature request can be embedded on any site. The embedded template editor loads only for a page on one of these sites (by its Referer or Origin header), and on any site when the list is empty. Forms embedded on a page (Visual Forms JS and the simple form) aren't restricted. |  |
 | **embed_edit_allow_settings** | **Boolean** | Allow the embedded template editor to change sensitive template settings (webhooks, redirect URL, encryption, public access, expiration and so on). |  |
 | **embed_edit_allow_versioning** | **Boolean** | Allow the embedded template editor to publish, restore, compare and delete published versions. |  |
 | **embed_edit_allow_document_replacement** | **Boolean** | Allow the embedded template editor to replace the template's PDF. |  |
@@ -37,10 +40,7 @@
 | **public_web_form** | **Boolean** | Allow anyone to fill in the template's web form. |  |
 | **redirect_url** | **String** | Where the web form sends people after they submit it. |  |
 | **has_slack_webhook_url** | **Boolean** | Whether `slack_webhook_url` is set. |  |
-| **last_changed_at** | **Time** | When the draft was last changed. |  |
 | **last_changed_by** | [**TemplateActor**](TemplateActor.md) | Who last changed the draft: a user in your account, an API token, or someone using the embedded template editor. Null if no change has been recorded. |  |
-| **created_at** | **Time** | When the template was created. |  |
-| **updated_at** | **Time** | When the template was last updated. |  |
 | **defaults** | [**TemplateDefaults**](TemplateDefaults.md) |  |  |
 | **field_dependencies** | [**Array<TemplateFieldDependency>**](TemplateFieldDependency.md) | Conditional logic: each rule shows or hides its target fields, or makes them required, depending on the values of other fields. |  |
 | **field_groups** | [**Array<FieldGroup>**](FieldGroup.md) | The groups of the template's fields, with their settings. A field's name puts it in groups: `address/city` is in the group `address`, and `items/0/price` is in the list `items` and its items' group `items/~`. |  |
@@ -51,6 +51,7 @@
 | **header_html** | **String** | The HTML printed at the top of each page of an HTML template. |  |
 | **footer_html** | **String** | The HTML printed at the bottom of each page of an HTML template. |  |
 | **html_engine_options** | [**HtmlEngineOptions**](HtmlEngineOptions.md) | How an HTML template's PDFs are printed. Null for PDF templates. Setting it replaces the whole object: options left out use their defaults. |  |
+| **html_escape_data** | **Boolean** | Whether an HTML template HTML-escapes the values it prints. When true, `{{ value }}` prints a value as text, so a `<` or `&` in it is printed as that character, and `{{ value | raw }}` prints a value as HTML. New HTML templates default to true. Templates created before October 2026, or with API v1, default to false, which prints every value as HTML. Null for PDF templates. |  |
 | **embed_edit_token** | **String** | The token that opens the template in the embedded template editor. |  |
 | **versions** | [**Array<TemplateVersion>**](TemplateVersion.md) | The template's published versions, newest first (up to 100). |  |
 
@@ -68,10 +69,13 @@ instance = DocSpring::Template.new(
   document: null,
   parent_folder_id: null,
   path: null,
-  version: null,
   latest_version: null,
   version_published_at: null,
   locked: null,
+  last_changed_at: null,
+  created_at: null,
+  updated_at: null,
+  version: null,
   add_signature_request_submission_id_footers: null,
   ai_field_naming_language: null,
   allow_additional_properties: null,
@@ -93,10 +97,7 @@ instance = DocSpring::Template.new(
   public_web_form: null,
   redirect_url: null,
   has_slack_webhook_url: null,
-  last_changed_at: null,
   last_changed_by: null,
-  created_at: null,
-  updated_at: null,
   defaults: null,
   field_dependencies: null,
   field_groups: null,
@@ -107,6 +108,7 @@ instance = DocSpring::Template.new(
   header_html: null,
   footer_html: null,
   html_engine_options: null,
+  html_escape_data: null,
   embed_edit_token: null,
   versions: null
 )

data/docs/TemplateActor.md

@@ -4,7 +4,7 @@
 
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
-| **type** | [**TemplateActorType**](TemplateActorType.md) | `user`: a user in your account. `api`: an API token. `external_user`: someone using the embedded template editor, as identified by your app. |  |
+| **type** | [**TemplateActorType**](TemplateActorType.md) | `user`: a user in your account, also when they make the change with an app they connected (an OAuth access token). `api`: an API token. `external_user`: someone using the embedded template editor, as identified by your app. |  |
 | **user_id** | **String** | The user's ID, for `user`. |  |
 | **external_id** | **String** | The ID your app gave the embedded editor's user, for `external_user`. |  |
 | **name** | **String** | The user's name, or the name your app gave the embedded editor's user. |  |

data/docs/TemplateDocument.md

@@ -5,11 +5,11 @@
 | Name | Type | Description | Notes |
 | ---- | ---- | ----------- | ----- |
 | **filename** | **String** | The PDF's file name. Null until a `document_url` has been downloaded. |  |
-| **md5** | **String** | The MD5 hash of the PDF. |  |
-| **state** | [**TemplateDocumentState**](TemplateDocumentState.md) | `pending` while DocSpring processes the PDF, then `processed`. `password_required`, `malformed_pdf` and `unknown_error` mean the PDF couldn't be processed, and `error_message` says why: upload it again or upload another one. `downloading` while DocSpring downloads a `document_url`, then as for an upload. `download_failed` means it couldn't be downloaded, and `error_message` says why. A template keeps its PDF while a new one is downloaded, and when it couldn't be. |  |
+| **state** | [**TemplateDocumentState**](TemplateDocumentState.md) | `pending` while DocSpring processes the PDF, then `processed` (`ready` says when its pages are done too). `password_required`, `malformed_pdf` and `unknown_error` mean the PDF couldn't be processed, and `error_message` says why: upload it again or upload another one. `downloading` while DocSpring downloads a `document_url`, then as for an upload. `download_failed` means it couldn't be downloaded, and `error_message` says why. A template keeps its PDF while a new one is downloaded, and when it couldn't be. |  |
 | **error_message** | **String** | Why the PDF couldn't be processed or downloaded, and how to fix it. Null unless `state` is an error. |  |
-| **field_reimport_state** | [**FieldReimportState**](FieldReimportState.md) | Whether the fields are being re-imported from this PDF (`reimport_fields` when the PDF was replaced): `requested` while DocSpring processes the PDF, then `imported`, or `no_fields` when the PDF had no fillable fields and the template kept its fields. `none` when no re-import was asked for, or when it couldn't run (the PDF couldn't be processed, or the template was locked or published while it was). |  |
 | **page_count** | **Integer** | 0 until the PDF has been processed. |  |
+| **md5** | **String** | The MD5 hash of the PDF. |  |
+| **field_reimport_state** | [**FieldReimportState**](FieldReimportState.md) | Whether the fields are being re-imported from this PDF (`reimport_fields` when the PDF was replaced): `requested` while DocSpring processes the PDF, then `imported`, or `no_fields` when the PDF had no fillable fields and the template kept its fields. `none` when no re-import was asked for, or when it couldn't run (the PDF couldn't be processed, or the template was locked or published while it was). |  |
 | **page_dimensions** | **Array<Array<Float>>** | Each page's width and height in PDF points. Null until the PDF has been processed. |  |
 | **has_fillable_fields** | **Boolean** | Whether the PDF has fillable form fields. Null until DocSpring has read the PDF. |  |
 | **page_processing_statuses** | [**Array<TemplatePageProcessingStatus>**](TemplatePageProcessingStatus.md) | How processing is going on each page, in page order: its image, and its fields when DocSpring sets them up (`detect_fields` when the template was created). `state` becomes `processed` once every page is done. Empty until DocSpring has read the PDF, and for PDFs uploaded before DocSpring recorded page statuses. |  |
@@ -24,11 +24,11 @@ require 'docspring'
 
 instance = DocSpring::TemplateDocument.new(
   filename: null,
-  md5: null,
   state: null,
   error_message: null,
-  field_reimport_state: null,
   page_count: null,
+  md5: null,
+  field_reimport_state: null,
   page_dimensions: null,
   has_fillable_fields: null,
   page_processing_statuses: null,

data/docs/TemplateDocumentSummary.md

@@ -0,0 +1,24 @@
+# DocSpring::TemplateDocumentSummary
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **filename** | **String** | The PDF's file name. Null until a `document_url` has been downloaded. |  |
+| **state** | [**TemplateDocumentState**](TemplateDocumentState.md) | `pending` while DocSpring processes the PDF, then `processed` (`ready` says when its pages are done too). `password_required`, `malformed_pdf` and `unknown_error` mean the PDF couldn't be processed, and `error_message` says why: upload it again or upload another one. `downloading` while DocSpring downloads a `document_url`, then as for an upload. `download_failed` means it couldn't be downloaded, and `error_message` says why. A template keeps its PDF while a new one is downloaded, and when it couldn't be. |  |
+| **error_message** | **String** | Why the PDF couldn't be processed or downloaded, and how to fix it. Null unless `state` is an error. |  |
+| **page_count** | **Integer** | 0 until the PDF has been processed. |  |
+
+## Example
+
+```ruby
+require 'docspring'
+
+instance = DocSpring::TemplateDocumentSummary.new(
+  filename: null,
+  state: null,
+  error_message: null,
+  page_count: null
+)
+```
+

data/docs/TemplatePreview.md

@@ -0,0 +1,32 @@
+# DocSpring::TemplatePreview
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+| **id** | **String** | The preview's ID. |  |
+| **template_id** | **String** | The template's ID. |  |
+| **version** | **String** | The published version that was rendered, such as `1.2.0`. Null for the draft. |  |
+| **state** | [**TemplatePreviewState**](TemplatePreviewState.md) | `pending` while it renders (usually a few seconds), then `processed`, or `error` with an `error_message`. |  |
+| **error_message** | **String** | Why the preview couldn't be rendered, such as an error in an HTML template's Liquid, or a value in the data that a field can't print. |  |
+| **page_count** | **Integer** | How many pages the template printed, once it's processed. |  |
+| **pages** | [**Array<PageImage>**](PageImage.md) | A PNG image of each page once it's processed, in order: `pages[0]` is page 1. A preview has no PDF. Their `download_url`s expire, so get the preview again when you need them. |  |
+| **expires_at** | **Time** | When the preview and its images are deleted. |  |
+
+## Example
+
+```ruby
+require 'docspring'
+
+instance = DocSpring::TemplatePreview.new(
+  id: null,
+  template_id: null,
+  version: null,
+  state: null,
+  error_message: null,
+  page_count: null,
+  pages: null,
+  expires_at: null
+)
+```
+

data/docs/TemplatePreviewState.md

@@ -0,0 +1,15 @@
+# DocSpring::TemplatePreviewState
+
+## Properties
+
+| Name | Type | Description | Notes |
+| ---- | ---- | ----------- | ----- |
+
+## Example
+
+```ruby
+require 'docspring'
+
+instance = DocSpring::TemplatePreviewState.new()
+```
+

data/docs/TemplateSummary.md

@@ -8,37 +8,14 @@
 | **name** | **String** | The template's name. |  |
 | **description** | **String** | Shown under the template's name at the top of its hosted forms, and used as their meta description. Not shown on embedded forms or signature requests. |  |
 | **template_type** | [**TemplateType**](TemplateType.md) | `pdf`: fields placed on an uploaded PDF. `html`: a PDF rendered from HTML and SCSS. It can't be changed after the template is created. |  |
-| **ready** | **Boolean** | Whether the template can generate PDFs. HTML templates are always ready. A PDF template is ready once its document has been processed (`document.state` is `processed`). |  |
-| **document** | [**TemplateDocument**](TemplateDocument.md) | The PDF of a PDF template. Null for HTML templates, and for a PDF template that has no PDF yet. |  |
+| **ready** | **Boolean** | Whether the template can generate PDFs. HTML templates are always ready. A PDF template is ready once DocSpring has stored its PDF, made an image of each page and finished looking for fields on each page, which can be after `document.state` becomes `processed`. A PDF template with no PDF (`document` is null) isn't ready. |  |
+| **document** | [**TemplateDocumentSummary**](TemplateDocumentSummary.md) | The PDF of a PDF template: its file name, page count and processing state. Null for HTML templates, and for a PDF template that has no PDF yet. |  |
 | **parent_folder_id** | **String** | The ID of the folder the template is in. Null for a template at the root. Setting it moves the template and all of its published versions. |  |
 | **path** | **String** | The path of the folder the template is in, such as `/Contracts`. `/` for a template at the root. |  |
-| **version** | **String** | The published version this is, such as `1.2.0`. Null for the draft. |  |
 | **latest_version** | **String** | The template's latest published version. Null if no version has been published. |  |
 | **version_published_at** | **Time** | When this version was published. Null for the draft. |  |
 | **locked** | **Boolean** | A locked template can't be changed or deleted until it's unlocked (`locked` can always be changed). |  |
-| **add_signature_request_submission_id_footers** | **Boolean** | Print the submission ID in the footer of each page of PDFs signed through signature requests. |  |
-| **ai_field_naming_language** | [**AiFieldNamingLanguage**](AiFieldNamingLanguage.md) | The language AI field setup names fields in: `auto` uses the form's language when it's written in the Latin alphabet without accents, and English otherwise; `english` always uses English; `form_language` uses the form's language and script. New templates take it from your account's template settings. Null for HTML templates. |  |
-| **allow_additional_properties** | **Boolean** | Accept submission data with properties that aren't fields of the template. |  |
-| **allow_skipping_optional_fields** | **Boolean** | Visual forms and signature request forms show the Continue button as soon as the required fields are filled in, without visiting each optional field. The `allowSkippingOptionalFields` embed option overrides it. |  |
-| **default_form_mode** | [**TemplateFormMode**](TemplateFormMode.md) | The hosted form that /templates/{template_id}/form shows when its URL has no `mode` parameter: `web` (the web form), `visual` (the visual form, where fields are filled in on the PDF) or `dual` (both, in tabs). HTML templates have no visual form, so `web` is the only value they accept. |  |
-| **editable_submissions** | **Boolean** | Generate PDFs whose text and check fields stay fillable ("Generate Editable PDFs"). A submission's `editable` overrides it. |  |
-| **embed_domains** | **Array<String>** | The sites where the template's signature requests, forms and embedded template editor can be loaded: a host such as `app.example.com`, with an optional leading wildcard (`*.example.com`), port (`localhost:3000`) or scheme (`https://app.example.com`; without one, `http` and `https` both work). When it's empty, live signature requests don't load on any site, and the embedded template editor loads on every site. |  |
-| **embed_edit_allow_settings** | **Boolean** | Allow the embedded template editor to change sensitive template settings (webhooks, redirect URL, encryption, public access, expiration and so on). |  |
-| **embed_edit_allow_versioning** | **Boolean** | Allow the embedded template editor to publish, restore, compare and delete published versions. |  |
-| **embed_edit_allow_document_replacement** | **Boolean** | Allow the embedded template editor to replace the template's PDF. |  |
-| **encrypt_pdfs** | **Boolean** | Encrypt generated PDFs with `encrypt_pdfs_password`. |  |
-| **has_encrypt_pdfs_password** | **Boolean** | Whether `encrypt_pdfs_password` is set. |  |
-| **expire_submissions** | **Boolean** | Delete each submission's data and PDF after `expire_after` `expiration_interval`. |  |
-| **expire_after** | **Integer** | How many `expiration_interval`s a submission's data and PDF are kept for, when `expire_submissions` is on. At most 5256000 (10 years in minutes). |  |
-| **expiration_interval** | [**ExpirationInterval**](ExpirationInterval.md) | The unit of `expire_after`. |  |
-| **merge_audit_trail_pdf** | **Boolean** | Add the audit trail to the end of PDFs signed through signature requests. |  |
-| **parse_dates_using_template_date_format** | **Boolean** | Date fields also accept NN/NN/YYYY dates (with slashes, dashes or dots), read in the order of the template's default date format: month first for %m/%d/%Y, day first for %d/%m/%Y. When false, date fields only accept YYYY-MM-DD. Applies to PDF templates: an HTML template's date fields only accept YYYY-MM-DD. Date fields that include a time take RFC 3339 date-times either way. |  |
-| **public_submissions** | **Boolean** | Allow anyone with a submission's ID to download its PDF. |  |
-| **public_web_form** | **Boolean** | Allow anyone to fill in the template's web form. |  |
-| **redirect_url** | **String** | Where the web form sends people after they submit it. |  |
-| **has_slack_webhook_url** | **Boolean** | Whether `slack_webhook_url` is set. |  |
 | **last_changed_at** | **Time** | When the draft was last changed. |  |
-| **last_changed_by** | [**TemplateActor**](TemplateActor.md) | Who last changed the draft: a user in your account, an API token, or someone using the embedded template editor. Null if no change has been recorded. |  |
 | **created_at** | **Time** | When the template was created. |  |
 | **updated_at** | **Time** | When the template was last updated. |  |
 
@@ -56,33 +33,10 @@ instance = DocSpring::TemplateSummary.new(
   document: null,
   parent_folder_id: null,
   path: null,
-  version: null,
   latest_version: null,
   version_published_at: null,
   locked: null,
-  add_signature_request_submission_id_footers: null,
-  ai_field_naming_language: null,
-  allow_additional_properties: null,
-  allow_skipping_optional_fields: null,
-  default_form_mode: null,
-  editable_submissions: null,
-  embed_domains: null,
-  embed_edit_allow_settings: null,
-  embed_edit_allow_versioning: null,
-  embed_edit_allow_document_replacement: null,
-  encrypt_pdfs: null,
-  has_encrypt_pdfs_password: null,
-  expire_submissions: null,
-  expire_after: null,
-  expiration_interval: null,
-  merge_audit_trail_pdf: null,
-  parse_dates_using_template_date_format: null,
-  public_submissions: null,
-  public_web_form: null,
-  redirect_url: null,
-  has_slack_webhook_url: null,
   last_changed_at: null,
-  last_changed_by: null,
   created_at: null,
   updated_at: null
 )

data/docs/UpdateTemplateRequest.md

@@ -14,7 +14,7 @@
 | **allow_skipping_optional_fields** | **Boolean** | Visual forms and signature request forms show the Continue button as soon as the required fields are filled in, without visiting each optional field. The `allowSkippingOptionalFields` embed option overrides it. | [optional] |
 | **default_form_mode** | [**TemplateFormMode**](TemplateFormMode.md) | The hosted form that /templates/{template_id}/form shows when its URL has no `mode` parameter: `web` (the web form), `visual` (the visual form, where fields are filled in on the PDF) or `dual` (both, in tabs). HTML templates have no visual form, so `web` is the only value they accept. | [optional] |
 | **editable_submissions** | **Boolean** | Generate PDFs whose text and check fields stay fillable ("Generate Editable PDFs"). A submission's `editable` overrides it. | [optional] |
-| **embed_domains** | **Array<String>** | The sites where the template's signature requests, forms and embedded template editor can be loaded: a host such as `app.example.com`, with an optional leading wildcard (`*.example.com`), port (`localhost:3000`) or scheme (`https://app.example.com`; without one, `http` and `https` both work). When it's empty, live signature requests don't load on any site, and the embedded template editor loads on every site. | [optional] |
+| **embed_domains** | **Array<String>** | The sites that can embed the template's live signature requests and its embedded template editor: a host such as `app.example.com`, with an optional leading wildcard (`*.example.com`), port (`localhost:3000`) or scheme (`https://app.example.com`; without one, `http` and `https` both work). Browsers open a live signature request in a frame only on these sites (and DocSpring's), so with an empty list it can't be embedded anywhere; a test signature request can be embedded on any site. The embedded template editor loads only for a page on one of these sites (by its Referer or Origin header), and on any site when the list is empty. Forms embedded on a page (Visual Forms JS and the simple form) aren't restricted. | [optional] |
 | **embed_edit_allow_settings** | **Boolean** | Allow the embedded template editor to change sensitive template settings (webhooks, redirect URL, encryption, public access, expiration and so on). | [optional] |
 | **embed_edit_allow_versioning** | **Boolean** | Allow the embedded template editor to publish, restore, compare and delete published versions. | [optional] |
 | **embed_edit_allow_document_replacement** | **Boolean** | Allow the embedded template editor to replace the template's PDF. | [optional] |
@@ -39,6 +39,7 @@
 | **header_html** | **String** | The HTML printed at the top of each page of an HTML template. | [optional] |
 | **footer_html** | **String** | The HTML printed at the bottom of each page of an HTML template. | [optional] |
 | **html_engine_options** | [**HtmlEngineOptionsInput**](HtmlEngineOptionsInput.md) | Null resets the options to their defaults. | [optional] |
+| **html_escape_data** | **Boolean** | Whether an HTML template HTML-escapes the values it prints. When true, `{{ value }}` prints a value as text, so a `<` or `&` in it is printed as that character, and `{{ value | raw }}` prints a value as HTML. New HTML templates default to true. Templates created before October 2026, or with API v1, default to false, which prints every value as HTML. Null for PDF templates. | [optional] |
 
 ## Example
 
@@ -80,7 +81,8 @@ instance = DocSpring::UpdateTemplateRequest.new(
   scss: null,
   header_html: null,
   footer_html: null,
-  html_engine_options: null
+  html_engine_options: null,
+  html_escape_data: null
 )
 ```
 

data/docs/ValidateSubmissionRequest.md

@@ -7,13 +7,13 @@
 | **test** | **Boolean** | Test PDFs have a watermark and are free. Live PDFs use credits. Submissions made with a test API token are always test submissions. | [optional] |
 | **editable** | **Boolean** | `true` keeps the PDF's text and check fields fillable, and `false` flattens every field. Left out, the template decides: its `editable_submissions` setting, or each field's own Editable option. A response shows the template's setting when the request left this out. Can't be `true` with `signature_requests`. | [optional] |
 | **data** | **Hash<String, Object>** | The values of the template's fields, by field name. Required for a PDF template, unless `signature_requests` collects the values. | [optional] |
-| **metadata** | **Hash<String, Object>** | Your own data about the submission, such as an ID from your app. It isn't printed on the PDF. | [optional] |
+| **metadata** | **Hash<String, Object>** | Your own data about the submission, such as an ID from your app. It isn't printed on the PDF. Two keys also change the PDF: `pdf_filename` names its file (`files.pdf.filename`, and its download), and `pdf_title` is its title in the PDF's document properties (and an HTML template's `<title>`, unless its HTML has one). Without `pdf_title`, the title is the template's name. In `pdf_filename`, a `.pdf` ending is removed, each run of characters other than letters, digits, `-`, `_` and `.` becomes one `_`, and the first 128 characters are kept, then `.pdf` is added. Without it, the file is named after the submission's ID (`sub_1234567890abcdef01.pdf`). | [optional] |
 | **password** | **String** | A password that the PDF needs to be opened with. It's never returned; `has_password` says if it's set. | [optional] |
 | **output_formats** | [**Array<OutputFormat>**](OutputFormat.md) | What the submission makes: `pdf`, and `png` (an image of each page of the PDF, up to 100 pages) when you ask for it. Default `["pdf"]`. POST /submissions/{submission_id}/generate_files adds `png` to a processed submission. | [optional] |
 | **expires_in** | **Integer** | Seconds after the PDF is generated until the submission expires, up to 10 years (315360000). Default the template's expiration setting. A submission that isn't processed, such as one with invalid data, is kept for at least 48 hours. | [optional] |
 | **field_overrides** | [**Hash<String, FieldOverride>**](FieldOverride.md) | Changes to field settings for this submission only, by field name, such as `{"name": {"required": false, "font_size": 9}}`. A setting that identifies the field (`id`, `name`, `type`), that only the template sets (such as `description`), or that doesn't apply to the field's type and display type (such as `check_character` on a field displayed as text) is a 422. With `signature_requests`, `editable: true` is a 422, and a `default` for a signature or initials field makes the submission `invalid_data`. | [optional] |
 | **html** | **String** | For an HTML template, HTML to use instead of the template's. | [optional] |
-| **css** | **String** | For an HTML template, CSS to use instead of the template's. | [optional] |
+| **css** | **String** | For an HTML template, SCSS (plain CSS works too) added after the template's styles, on the page and in its header and footer. It doesn't replace them: its rules come later, so they win over the template's rules of the same specificity. | [optional] |
 | **signature_requests** | [**Array<SignatureRequestInput>**](SignatureRequestInput.md) | The people who sign the PDF, and fill in their fields first. The PDF is generated once every signature request is completed. PDF templates only. Without `role`s, the first signature request is `Signer 1`, the second `Signer 2`, and so on. To leave a signer out, give every signature request its `role` and leave that one's out. Only the signers sign: a value for a signature or initials field in `data` makes the submission `invalid_data`. | [optional] |
 
 ## Example