signedly 0.1.0__tar.gz

signedly-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Signedly
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

signedly-0.1.0/PKG-INFO

@@ -0,0 +1,18 @@
+Metadata-Version: 2.1
+Name: signedly
+Version: 0.1.0
+Summary: Signedly API
+Home-page: https://github.com/signedly/signedly-sdks
+Author: Signedly
+Author-email: info@signedly.com
+License: MIT
+Keywords: OpenAPI,OpenAPI-Generator,Signedly API
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: urllib3<3.0.0,>=1.25.3
+Requires-Dist: python-dateutil>=2.8.2
+Requires-Dist: pydantic>=2
+Requires-Dist: typing-extensions>=4.7.1
+
+     The Signedly REST API lets your system upload documents, add signatories and fields, send them for signing and download the signed result. Every path starts with &#x60;/ap1/&#x60;, and every request and response body is JSON unless an endpoint says otherwise (the uploads are &#x60;multipart/form-data&#x60;).  ## Authentication  1. In the Signedly web app, open **Account &amp; Settings → API** and generate a    **client ID** and **client secret** for your organisation. 2. &#x60;POST /ap1/token/&#x60; with them. You get an &#x60;access_token&#x60; (valid **2 hours**) and    a &#x60;refresh_token&#x60; (valid **7 days**). While both are still valid, calling    &#x60;/ap1/token/&#x60; again returns the same pair. 3. Send the access token on every other call:    &#x60;Authorization: Bearer &lt;access_token&gt;&#x60;. 4. When the access token expires, &#x60;POST /ap1/refreshtoken/&#x60; with the refresh token    for a new access token. When the refresh token has expired too, call    &#x60;/ap1/token/&#x60; again.  &#x60;/ap1/token/&#x60; and &#x60;/ap1/refreshtoken/&#x60; allow 60 calls a minute per IP address; more answer 429. A missing, unknown or expired access token answers 403 (&#x60;\&quot;Client not found\&quot;&#x60; or &#x60;\&quot;Access token expired\&quot;&#x60;).  The API acts for your **organisation&#39;s admin account**: documents you upload belong to it and appear in its Signedly web app, and you can reach only that account&#39;s documents, templates, signatories and fields. Another organisation&#39;s IDs answer 404, as if they didn&#39;t exist.  ## Plans  What the API allows depends on the Signedly plan of your **organisation&#39;s admin account** (Account &amp; Settings → Account &amp; Plan). The same rules apply to live and test keys.  | What | Free | Personal Pro | Business Pro | Teams | |---|---|---|---|---| | Generate live and test keys (Account &amp; Settings → API) | – | ✓ | ✓ | ✓ | | Every endpoint, &#x60;/ap1/token/&#x60; and &#x60;/ap1/refreshtoken/&#x60; included | – | ✓ | ✓ | ✓ | | &#x60;require_email_otp&#x60; on &#x60;POST /ap1/signatories/&#x60; and &#x60;POST /ap1/signatories/bulk/&#x60; | – | ✓ | ✓ | ✓ | | Bulk send: &#x60;GET /ap1/bulk-sends/columns/&#x60; and &#x60;POST /ap1/bulk-sends/&#x60; | – | – | – | ✓ |  The API is part of the paid plans. On Free (or with no plan) every call answers 403 &#x60;\&quot;... Your plan doesn&#39;t include API access.\&quot;&#x60;, with live or test keys, also with a token or keys made earlier; they work again once the plan is paid. On a paid plan, a feature it doesn&#39;t include answers 400 with &#x60;\&quot;Your plan doesn&#39;t include ...\&quot;&#x60; and changes nothing, and &#x60;GET /ap1/bulk-sends/{id}/&#x60; still reports bulk sends already made.  Live documents also need an API contract with Signedly. Without one, or with an unpaid API invoice, &#x60;POST /ap1/upload/&#x60; (except templates), &#x60;/ap1/upload_app/&#x60;, &#x60;/ap1/documents/fromtemplate/&#x60; and &#x60;/ap1/bulk-sends/&#x60; answer 402 with live keys. Test keys work without a contract (see Sandbox).  ## Sending a document for signing  1. &#x60;POST /ap1/upload/&#x60; a PDF or DOCX (&#x60;type&#x60; 2). The document is prepared in the    background: find it in &#x60;GET /ap1/documents/?name&#x3D;&lt;name&gt;&#x60; (its &#x60;upload.id&#x60; is    the upload&#39;s &#x60;id&#x60;), and wait until &#x60;GET /ap1/documents/{id}/pages/&#x60; lists its    pages. 2. &#x60;POST /ap1/signatories/&#x60; (one) or &#x60;POST /ap1/signatories/bulk/&#x60; (several) to    add the people who sign. 3. &#x60;POST /ap1/documents/fields/&#x60; to place the fields each signatory fills in. 4. Send it:    - &#x60;POST /ap1/document/send/&#x60; emails every signatory a signing link (with      ordered signing, only the first; each next one is emailed in      turn), or    - &#x60;POST /ap1/document/send_url/&#x60; sends no email and returns the first      signatory&#39;s signing link, for you to show or send yourself. 5. Poll &#x60;GET /ap1/documents-status-list/&#x60; (or &#x60;GET /ap1/documents/&#x60;) until the    status is 6 (Completed), then &#x60;GET /ap1/document/download-link/&#x60; for the    signed PDF and &#x60;GET /ap1/document/download-audit-link/&#x60; for its audit trail.  **From a template:** upload with &#x60;type&#x60; 4 and a &#x60;template_name&#x60; (or make the template in the web app), place its fields with &#x60;POST /ap1/templates/fields/&#x60;, then for each signing make a document with &#x60;POST /ap1/documents/fromtemplate/&#x60;, add its signatory, and send it.  **One signer, one call:** &#x60;POST /ap1/upload_app/&#x60; uploads a PDF or DOCX for one signer and returns their signing link in &#x60;redirect_url&#x60;; the signer places their own signature. After signing they go to the &#x60;redirect_url&#x60; you sent, and the signed PDF and its audit trail are emailed to &#x60;final_email&#x60; (otherwise to your organisation&#39;s admin).  ## Quick start with curl  Each step uses an ID from the step before. &#x60;$API&#x60; is this server, e.g. &#x60;https://l0ads.signedly.com&#x60;.  &#x60;&#x60;&#x60;bash # 1. Token curl -X POST $API/ap1/token/ -H &#39;Content-Type: application/json&#39; \   -d &#39;{\&quot;client_id\&quot;: \&quot;&lt;client id&gt;\&quot;, \&quot;client_secret\&quot;: \&quot;&lt;client secret&gt;\&quot;}&#39; TOKEN&#x3D;&lt;access_token from the answer&gt;  # 2. Upload a PDF (answers with the upload&#39;s id) curl -X POST $API/ap1/upload/ -H \&quot;Authorization: Bearer $TOKEN\&quot; \   -F file&#x3D;@nda.pdf -F name&#x3D;nda-ann-lee -F type&#x3D;2  # 3. Find the document, then wait until it has pages curl \&quot;$API/ap1/documents/?name&#x3D;nda-ann-lee\&quot; -H \&quot;Authorization: Bearer $TOKEN\&quot; DOC&#x3D;&lt;results[0].id&gt; curl $API/ap1/documents/$DOC/pages/ -H \&quot;Authorization: Bearer $TOKEN\&quot; PAGE&#x3D;&lt;[0].id&gt;  # 4. Add the signatory curl -X POST $API/ap1/signatories/ -H \&quot;Authorization: Bearer $TOKEN\&quot; \   -H &#39;Content-Type: application/json&#39; \   -d &#39;{\&quot;document_id\&quot;: \&quot;&#39;$DOC&#39;\&quot;, \&quot;name\&quot;: \&quot;Ann Lee\&quot;, \&quot;email\&quot;: \&quot;ann@example.com\&quot;}&#39; SIGNER&#x3D;&lt;id from the answer&gt;  # 5. Place her signature: 150 × 40 points, 72 points from the left, 640 from the top curl -X POST $API/ap1/documents/fields/ -H \&quot;Authorization: Bearer $TOKEN\&quot; \   -H &#39;Content-Type: application/json&#39; \   -d &#39;[{\&quot;document_id\&quot;: \&quot;&#39;$DOC&#39;\&quot;, \&quot;signatory_id\&quot;: \&quot;&#39;$SIGNER&#39;\&quot;, \&quot;kind\&quot;: 2,         \&quot;label\&quot;: \&quot;Signature\&quot;, \&quot;placeholder\&quot;: \&quot;Sign here\&quot;, \&quot;page\&quot;: \&quot;&#39;$PAGE&#39;\&quot;,         \&quot;page_number\&quot;: 0, \&quot;x\&quot;: 72, \&quot;y\&quot;: 640, \&quot;width\&quot;: 150, \&quot;height\&quot;: 40}]&#39;  # 6. Send it (Ann gets the signing email) curl -X POST $API/ap1/document/send/ -H \&quot;Authorization: Bearer $TOKEN\&quot; \   -H &#39;Content-Type: application/json&#39; \   -d &#39;{\&quot;document_id\&quot;: \&quot;&#39;$DOC&#39;\&quot;, \&quot;subject\&quot;: \&quot;Please sign the NDA\&quot;,        \&quot;message\&quot;: \&quot;Hi Ann, please sign by Friday.\&quot;, \&quot;expiry_date\&quot;: \&quot;2026-12-31\&quot;}&#39;  # 7. Poll until status is 6 (Completed), then get the signed PDF curl \&quot;$API/ap1/documents-status-list/?document_ids&#x3D;$DOC\&quot; -H \&quot;Authorization: Bearer $TOKEN\&quot; curl \&quot;$API/ap1/document/download-link/?id&#x3D;$DOC\&quot; -H \&quot;Authorization: Bearer $TOKEN\&quot; &#x60;&#x60;&#x60;  ## Postman  Import the whole API into Postman with **Import → Link** and &#x60;&lt;this server&gt;/swaggerap1/postman.json&#x60;. Set &#x60;client_id&#x60; and &#x60;client_secret&#x60; in the collection&#39;s **Variables**, run **Get an access token** (it saves the token for every other request), and set &#x60;document_id&#x60; when a request needs one.  ## Webhooks  Instead of polling, add an endpoint with &#x60;POST /ap1/webhooks/&#x60; (or in **Account &amp; Settings → API**) and Signedly posts your organisation&#39;s document events to it: &#x60;document.sent&#x60;, &#x60;document.viewed&#x60;, &#x60;document.signed&#x60;, &#x60;document.approved&#x60;, &#x60;document.completed&#x60;, &#x60;document.rejected&#x60; and &#x60;document.expired&#x60; (all of them, or the &#x60;events&#x60; you choose). Each is a JSON &#x60;POST&#x60;:  &#x60;&#x60;&#x60;json {\&quot;id\&quot;: \&quot;5b7f…\&quot;, \&quot;type\&quot;: \&quot;document.signed\&quot;, \&quot;created_at\&quot;: \&quot;2026-10-27T09:12:00+00:00\&quot;,  \&quot;test\&quot;: false,  \&quot;data\&quot;: {\&quot;document\&quot;: {\&quot;id\&quot;: \&quot;6f0c…\&quot;, \&quot;name\&quot;: \&quot;nda.pdf\&quot;, \&quot;status\&quot;: 5},           \&quot;recipient\&quot;: {\&quot;id\&quot;: \&quot;0b6e…\&quot;, \&quot;email\&quot;: \&quot;ann@example.com\&quot;, \&quot;name\&quot;: \&quot;Ann Lee\&quot;,                         \&quot;role\&quot;: \&quot;signer\&quot;}}} &#x60;&#x60;&#x60;  &#x60;recipient&#x60; is null for events no recipient caused (sent, completed, expired); &#x60;test&#x60; is true for documents made with your test keys. Fetch anything else, such as download links, with your access token: events never carry links.  **Check every event is from Signedly.** The &#x60;Signedly-Signature&#x60; header is &#x60;t&#x3D;&lt;unix seconds&gt;,v1&#x3D;&lt;signature&gt;&#x60;, where the signature is the hex HMAC-SHA256 of &#x60;&lt;t&gt;.&lt;raw body&gt;&#x60; with the endpoint&#39;s secret. Refuse an event whose signature doesn&#39;t match or whose &#x60;t&#x60; is more than 5 minutes off:  &#x60;&#x60;&#x60;python import hashlib, hmac, time  def is_from_signedly(secret, header, raw_body):     parts &#x3D; dict(item.split(\&quot;&#x3D;\&quot;, 1) for item in header.split(\&quot;,\&quot;))     signed &#x3D; f\&quot;{parts[&#39;t&#39;]}.{raw_body.decode()}\&quot;.encode()     expected &#x3D; hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()     fresh &#x3D; abs(time.time() - int(parts[\&quot;t\&quot;])) &lt;&#x3D; 300     return fresh and hmac.compare_digest(parts[\&quot;v1\&quot;], expected) &#x60;&#x60;&#x60;  **Answer 2xx within 10 seconds**, then do the work. Anything else is retried after 1 and 5 minutes, then 30 minutes and 2, 5 and 10 hours (7 tries in about 18 hours). &#x60;Signedly-Event-Id&#x60; is the same on every try of an event: use it to ignore repeats. After 20 events in a row fail for good, Signedly switches the endpoint off and emails your organisation&#39;s admin; switch it on again with &#x60;PUT /ap1/webhooks/{id}/&#x60; and &#x60;\&quot;is_active\&quot;: true&#x60;. Each endpoint&#39;s deliveries and their last answers are at &#x60;GET /ap1/webhooks/{id}/deliveries/&#x60;, and any can be sent again.  ## Sandbox  Build and test against the API without paying for documents: in **Account &amp; Settings → API**, generate your **test keys**, and get a token with them at &#x60;/ap1/token/&#x60; as usual. Everything works the same, except that what you upload or make from a template with a test token is a **test document** (&#x60;is_test&#x60; on its upload):  - every page of its PDF and of its audit trail says **TEST – NOT LEGALLY BINDING**; - its emails are real, with &#x60;[TEST]&#x60; at the start of the subject; - it isn&#39;t billed or counted toward your plan; - your organisation can make 50 a calendar month (templates don&#39;t count); the next   upload answers 429.  ## Fields  Positions and sizes are in **PDF points** (1/72 inch), measured from the **top-left corner** of the page as it is displayed (rotation applied). &#x60;page_number&#x60; counts pages from 0. A field must sit wholly on its page (1 point of tolerance); otherwise it is refused with 400. A field&#39;s page and signatory can&#39;t be changed later: delete the field and add it again.  ## Status values  **Document &#x60;status&#x60;:** 1 Draft · 2 Signees Added · 3 Prepared · 4 Sent · 5 In Progress · 6 Completed · 7 Rejected · 8 Archived · 9 Expired. Signatories, fields and sends are only accepted while a document is 1–3 (not yet sent).  **Signatory &#x60;status&#x60;:** 1 Waiting · 2 Invited · 3 Signed · 4 Viewed · 5 Rejected.  ## Lists  &#x60;GET /ap1/documents/&#x60;, &#x60;/ap1/documents-status-list/&#x60;, &#x60;/ap1/templates/&#x60;, &#x60;/ap1/logs/&#x60; and &#x60;/ap1/logs/hits/&#x60; are paged: pass &#x60;limit&#x60; (default 10) and &#x60;offset&#x60;, and read &#x60;count&#x60;, &#x60;next&#x60;, &#x60;previous&#x60; and &#x60;results&#x60; from the response.  ## Errors  | Status | Meaning | |---|---| | 400 | The request was refused, also when your plan doesn&#39;t include it (see Plans); the body says why (&#x60;{\&quot;error\&quot;: \&quot;...\&quot;}&#x60;, or the name of each bad field with its messages). Nothing was changed. | | 403 | The access token is missing, unknown or expired; the client ID and secret or the refresh token were refused; the organisation&#39;s plan has no API access (Free, see Plans); or an &#x60;expiry_date&#x60; isn&#39;t in the future (&#x60;\&quot;Invalid Date Entered\&quot;&#x60;). | | 402 | No API contract, or an unpaid API invoice: live documents are refused (test keys keep working). | | 404 | The document, template, signatory or field doesn&#39;t exist or isn&#39;t yours. | | 429 | Too many token requests (wait a minute), or this month&#39;s 50 test documents are used. | | 5xx | Our side failed; retry later. |  A send that times out may still have worked: check the document&#39;s status before sending again (a second send of a sent document answers 400).  Download, view and audit links are valid for about 7 days; ask for a new one whenever you need it. 
+    

signedly-0.1.0/README.md

@@ -0,0 +1,453 @@
+# signedly
+
+The Signedly REST API lets your system upload documents, add signatories and
+fields, send them for signing and download the signed result. Every path starts
+with `/ap1/`, and every request and response body is JSON unless an endpoint says
+otherwise (the uploads are `multipart/form-data`).
+
+## Authentication
+
+1. In the Signedly web app, open **Account & Settings → API** and generate a
+   **client ID** and **client secret** for your organisation.
+2. `POST /ap1/token/` with them. You get an `access_token` (valid **2 hours**) and
+   a `refresh_token` (valid **7 days**). While both are still valid, calling
+   `/ap1/token/` again returns the same pair.
+3. Send the access token on every other call:
+   `Authorization: Bearer <access_token>`.
+4. When the access token expires, `POST /ap1/refreshtoken/` with the refresh token
+   for a new access token. When the refresh token has expired too, call
+   `/ap1/token/` again.
+
+`/ap1/token/` and `/ap1/refreshtoken/` allow 60 calls a minute per IP address;
+more answer 429. A missing, unknown or expired access token answers 403
+(`\"Client not found\"` or `\"Access token expired\"`).
+
+The API acts for your **organisation's admin account**: documents you upload
+belong to it and appear in its Signedly web app, and you can reach only that
+account's documents, templates, signatories and fields. Another organisation's
+IDs answer 404, as if they didn't exist.
+
+## Plans
+
+What the API allows depends on the Signedly plan of your **organisation's admin
+account** (Account & Settings → Account & Plan). The same rules apply to live and
+test keys.
+
+| What | Free | Personal Pro | Business Pro | Teams |
+|---|---|---|---|---|
+| Generate live and test keys (Account & Settings → API) | – | ✓ | ✓ | ✓ |
+| Every endpoint, `/ap1/token/` and `/ap1/refreshtoken/` included | – | ✓ | ✓ | ✓ |
+| `require_email_otp` on `POST /ap1/signatories/` and `POST /ap1/signatories/bulk/` | – | ✓ | ✓ | ✓ |
+| Bulk send: `GET /ap1/bulk-sends/columns/` and `POST /ap1/bulk-sends/` | – | – | – | ✓ |
+
+The API is part of the paid plans. On Free (or with no plan) every call answers
+403 `\"... Your plan doesn't include API access.\"`, with live or test keys, also
+with a token or keys made earlier; they work again once the plan is paid. On a
+paid plan, a feature it doesn't include answers 400 with
+`\"Your plan doesn't include ...\"` and changes nothing, and
+`GET /ap1/bulk-sends/{id}/` still reports bulk sends already made.
+
+Live documents also need an API contract with Signedly. Without one, or with an
+unpaid API invoice, `POST /ap1/upload/` (except templates), `/ap1/upload_app/`,
+`/ap1/documents/fromtemplate/` and `/ap1/bulk-sends/` answer 402 with live keys.
+Test keys work without a contract (see Sandbox).
+
+## Sending a document for signing
+
+1. `POST /ap1/upload/` a PDF or DOCX (`type` 2). The document is prepared in the
+   background: find it in `GET /ap1/documents/?name=<name>` (its `upload.id` is
+   the upload's `id`), and wait until `GET /ap1/documents/{id}/pages/` lists its
+   pages.
+2. `POST /ap1/signatories/` (one) or `POST /ap1/signatories/bulk/` (several) to
+   add the people who sign.
+3. `POST /ap1/documents/fields/` to place the fields each signatory fills in.
+4. Send it:
+   - `POST /ap1/document/send/` emails every signatory a signing link (with
+     ordered signing, only the first; each next one is emailed in
+     turn), or
+   - `POST /ap1/document/send_url/` sends no email and returns the first
+     signatory's signing link, for you to show or send yourself.
+5. Poll `GET /ap1/documents-status-list/` (or `GET /ap1/documents/`) until the
+   status is 6 (Completed), then `GET /ap1/document/download-link/` for the
+   signed PDF and `GET /ap1/document/download-audit-link/` for its audit trail.
+
+**From a template:** upload with `type` 4 and a `template_name` (or make the
+template in the web app), place its fields with `POST /ap1/templates/fields/`,
+then for each signing make a document with `POST /ap1/documents/fromtemplate/`,
+add its signatory, and send it.
+
+**One signer, one call:** `POST /ap1/upload_app/` uploads a PDF or DOCX for one
+signer and returns their signing link in `redirect_url`; the signer places their
+own signature. After signing they go to the `redirect_url` you sent, and the
+signed PDF and its audit trail are emailed to `final_email` (otherwise to your
+organisation's admin).
+
+## Quick start with curl
+
+Each step uses an ID from the step before. `$API` is this server, e.g.
+`https://l0ads.signedly.com`.
+
+```bash
+# 1. Token
+curl -X POST $API/ap1/token/ -H 'Content-Type: application/json' \\
+  -d '{\"client_id\": \"<client id>\", \"client_secret\": \"<client secret>\"}'
+TOKEN=<access_token from the answer>
+
+# 2. Upload a PDF (answers with the upload's id)
+curl -X POST $API/ap1/upload/ -H \"Authorization: Bearer $TOKEN\" \\
+  -F file=@nda.pdf -F name=nda-ann-lee -F type=2
+
+# 3. Find the document, then wait until it has pages
+curl \"$API/ap1/documents/?name=nda-ann-lee\" -H \"Authorization: Bearer $TOKEN\"
+DOC=<results[0].id>
+curl $API/ap1/documents/$DOC/pages/ -H \"Authorization: Bearer $TOKEN\"
+PAGE=<[0].id>
+
+# 4. Add the signatory
+curl -X POST $API/ap1/signatories/ -H \"Authorization: Bearer $TOKEN\" \\
+  -H 'Content-Type: application/json' \\
+  -d '{\"document_id\": \"'$DOC'\", \"name\": \"Ann Lee\", \"email\": \"ann@example.com\"}'
+SIGNER=<id from the answer>
+
+# 5. Place her signature: 150 × 40 points, 72 points from the left, 640 from the top
+curl -X POST $API/ap1/documents/fields/ -H \"Authorization: Bearer $TOKEN\" \\
+  -H 'Content-Type: application/json' \\
+  -d '[{\"document_id\": \"'$DOC'\", \"signatory_id\": \"'$SIGNER'\", \"kind\": 2,
+        \"label\": \"Signature\", \"placeholder\": \"Sign here\", \"page\": \"'$PAGE'\",
+        \"page_number\": 0, \"x\": 72, \"y\": 640, \"width\": 150, \"height\": 40}]'
+
+# 6. Send it (Ann gets the signing email)
+curl -X POST $API/ap1/document/send/ -H \"Authorization: Bearer $TOKEN\" \\
+  -H 'Content-Type: application/json' \\
+  -d '{\"document_id\": \"'$DOC'\", \"subject\": \"Please sign the NDA\",
+       \"message\": \"Hi Ann, please sign by Friday.\", \"expiry_date\": \"2026-12-31\"}'
+
+# 7. Poll until status is 6 (Completed), then get the signed PDF
+curl \"$API/ap1/documents-status-list/?document_ids=$DOC\" -H \"Authorization: Bearer $TOKEN\"
+curl \"$API/ap1/document/download-link/?id=$DOC\" -H \"Authorization: Bearer $TOKEN\"
+```
+
+## Postman
+
+Import the whole API into Postman with **Import → Link** and
+`<this server>/swaggerap1/postman.json`. Set `client_id` and `client_secret` in the
+collection's **Variables**, run **Get an access token** (it saves the token for
+every other request), and set `document_id` when a request needs one.
+
+## Webhooks
+
+Instead of polling, add an endpoint with `POST /ap1/webhooks/` (or in **Account &
+Settings → API**) and Signedly posts your organisation's document events to it:
+`document.sent`, `document.viewed`, `document.signed`, `document.approved`,
+`document.completed`, `document.rejected` and `document.expired` (all of them,
+or the `events` you choose). Each is a JSON `POST`:
+
+```json
+{\"id\": \"5b7f…\", \"type\": \"document.signed\", \"created_at\": \"2026-10-27T09:12:00+00:00\",
+ \"test\": false,
+ \"data\": {\"document\": {\"id\": \"6f0c…\", \"name\": \"nda.pdf\", \"status\": 5},
+          \"recipient\": {\"id\": \"0b6e…\", \"email\": \"ann@example.com\", \"name\": \"Ann Lee\",
+                        \"role\": \"signer\"}}}
+```
+
+`recipient` is null for events no recipient caused (sent, completed, expired);
+`test` is true for documents made with your test keys. Fetch anything else, such
+as download links, with your access token: events never carry links.
+
+**Check every event is from Signedly.** The `Signedly-Signature` header is
+`t=<unix seconds>,v1=<signature>`, where the signature is the hex HMAC-SHA256 of
+`<t>.<raw body>` with the endpoint's secret. Refuse an event whose signature
+doesn't match or whose `t` is more than 5 minutes off:
+
+```python
+import hashlib, hmac, time
+
+def is_from_signedly(secret, header, raw_body):
+    parts = dict(item.split(\"=\", 1) for item in header.split(\",\"))
+    signed = f\"{parts['t']}.{raw_body.decode()}\".encode()
+    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
+    fresh = abs(time.time() - int(parts[\"t\"])) <= 300
+    return fresh and hmac.compare_digest(parts[\"v1\"], expected)
+```
+
+**Answer 2xx within 10 seconds**, then do the work. Anything else is retried after
+1 and 5 minutes, then 30 minutes and 2, 5 and 10 hours (7 tries in about 18
+hours). `Signedly-Event-Id` is the same on every try of an event: use it to
+ignore repeats. After 20 events in a row fail for good, Signedly switches the
+endpoint off and emails your organisation's admin; switch it on again with
+`PUT /ap1/webhooks/{id}/` and `\"is_active\": true`. Each endpoint's deliveries and
+their last answers are at `GET /ap1/webhooks/{id}/deliveries/`, and any can be
+sent again.
+
+## Sandbox
+
+Build and test against the API without paying for documents: in **Account &
+Settings → API**, generate your **test keys**, and get a token with them at
+`/ap1/token/` as usual. Everything works the same, except that what you upload or
+make from a template with a test token is a **test document** (`is_test` on its
+upload):
+
+- every page of its PDF and of its audit trail says **TEST – NOT LEGALLY BINDING**;
+- its emails are real, with `[TEST]` at the start of the subject;
+- it isn't billed or counted toward your plan;
+- your organisation can make 50 a calendar month (templates don't count); the next
+  upload answers 429.
+
+## Fields
+
+Positions and sizes are in **PDF points** (1/72 inch), measured from the
+**top-left corner** of the page as it is displayed (rotation applied).
+`page_number` counts pages from 0. A field must sit wholly on its page (1 point
+of tolerance); otherwise it is refused with 400. A field's page and signatory
+can't be changed later: delete the field and add it again.
+
+## Status values
+
+**Document `status`:** 1 Draft · 2 Signees Added · 3 Prepared · 4 Sent ·
+5 In Progress · 6 Completed · 7 Rejected · 8 Archived · 9 Expired. Signatories,
+fields and sends are only accepted while a document is 1–3 (not yet sent).
+
+**Signatory `status`:** 1 Waiting · 2 Invited · 3 Signed · 4 Viewed · 5 Rejected.
+
+## Lists
+
+`GET /ap1/documents/`, `/ap1/documents-status-list/`, `/ap1/templates/`,
+`/ap1/logs/` and `/ap1/logs/hits/` are paged: pass `limit` (default 10) and
+`offset`, and read `count`, `next`, `previous` and `results` from the response.
+
+## Errors
+
+| Status | Meaning |
+|---|---|
+| 400 | The request was refused, also when your plan doesn't include it (see Plans); the body says why (`{\"error\": \"...\"}`, or the name of each bad field with its messages). Nothing was changed. |
+| 403 | The access token is missing, unknown or expired; the client ID and secret or the refresh token were refused; the organisation's plan has no API access (Free, see Plans); or an `expiry_date` isn't in the future (`\"Invalid Date Entered\"`). |
+| 402 | No API contract, or an unpaid API invoice: live documents are refused (test keys keep working). |
+| 404 | The document, template, signatory or field doesn't exist or isn't yours. |
+| 429 | Too many token requests (wait a minute), or this month's 50 test documents are used. |
+| 5xx | Our side failed; retry later. |
+
+A send that times out may still have worked: check the document's status before
+sending again (a second send of a sent document answers 400).
+
+Download, view and audit links are valid for about 7 days; ask for a new one
+whenever you need it.
+
+
+This Python package is automatically generated by the [OpenAPI Generator](https://openapi-generator.tech) project:
+
+- API version: v1
+- Package version: 0.1.0
+- Generator version: 7.10.0
+- Build package: org.openapitools.codegen.languages.PythonClientCodegen
+For more information, please visit [https://signedly.com](https://signedly.com)
+
+## Requirements.
+
+Python 3.8+
+
+## Installation & Usage
+### pip install
+
+If the python package is hosted on a repository, you can install directly using:
+
+```sh
+pip install git+https://github.com/signedly/signedly-sdks.git
+```
+(you may need to run `pip` with root permission: `sudo pip install git+https://github.com/signedly/signedly-sdks.git`)
+
+Then import the package:
+```python
+import signedly
+```
+
+### Setuptools
+
+Install via [Setuptools](http://pypi.python.org/pypi/setuptools).
+
+```sh
+python setup.py install --user
+```
+(or `sudo python setup.py install` to install the package for all users)
+
+Then import the package:
+```python
+import signedly
+```
+
+### Tests
+
+Execute `pytest` to run the tests.
+
+## Getting Started
+
+Please follow the [installation procedure](#installation--usage) and then run the following:
+
+```python
+
+import signedly
+from signedly.rest import ApiException
+from pprint import pprint
+
+# Defining the host is optional and defaults to https://l0ads.signedly.com
+# See configuration.py for a list of all supported configuration parameters.
+configuration = signedly.Configuration(
+    host = "https://l0ads.signedly.com"
+)
+
+# The client must configure the authentication and authorization parameters
+# in accordance with the API server security policy.
+# Examples for each auth method are provided below, use the example that
+# satisfies your auth use case.
+
+# Configure API key authorization: Bearer
+configuration.api_key['Bearer'] = os.environ["API_KEY"]
+
+# Uncomment below to setup prefix (e.g. Bearer) for API key, if needed
+# configuration.api_key_prefix['Bearer'] = 'Bearer'
+
+
+# Enter a context with an instance of the API client
+with signedly.ApiClient(configuration) as api_client:
+    # Create an instance of the API class
+    api_instance = signedly.APIRequestLogsApi(api_client)
+    method = 'method_example' # str | Only this HTTP method. (optional)
+    path = 'path_example' # str | Only paths that contain this, e.g. `/ap1/document/`. (optional)
+    limit = 56 # int | How many results to return (default 10). (optional)
+    offset = 56 # int | How many results to skip. (optional)
+
+    try:
+        # Count your API calls per path
+        api_response = api_instance.list_request_counts(method=method, path=path, limit=limit, offset=offset)
+        print("The response of APIRequestLogsApi->list_request_counts:\n")
+        pprint(api_response)
+    except ApiException as e:
+        print("Exception when calling APIRequestLogsApi->list_request_counts: %s\n" % e)
+
+```
+
+## Documentation for API Endpoints
+
+All URIs are relative to *https://l0ads.signedly.com*
+
+Class | Method | HTTP request | Description
+------------ | ------------- | ------------- | -------------
+*APIRequestLogsApi* | [**list_request_counts**](docs/APIRequestLogsApi.md#list_request_counts) | **GET** /ap1/logs/hits/ | Count your API calls per path
+*APIRequestLogsApi* | [**list_request_logs**](docs/APIRequestLogsApi.md#list_request_logs) | **GET** /ap1/logs/ | List your API calls
+*AuthenticationApi* | [**get_access_token**](docs/AuthenticationApi.md#get_access_token) | **POST** /ap1/token/ | Get an access token
+*AuthenticationApi* | [**refresh_access_token**](docs/AuthenticationApi.md#refresh_access_token) | **POST** /ap1/refreshtoken/ | Refresh the access token
+*BulkSendingApi* | [**create_bulk_send**](docs/BulkSendingApi.md#create_bulk_send) | **POST** /ap1/bulk-sends/ | Send a template to many people
+*BulkSendingApi* | [**get_bulk_send**](docs/BulkSendingApi.md#get_bulk_send) | **GET** /ap1/bulk-sends/{id}/ | Follow a bulk send
+*BulkSendingApi* | [**list_bulk_send_columns**](docs/BulkSendingApi.md#list_bulk_send_columns) | **GET** /ap1/bulk-sends/columns/ | List the columns a template&#39;s bulk send needs
+*DocumentsApi* | [**create_document_from_template**](docs/DocumentsApi.md#create_document_from_template) | **POST** /ap1/documents/fromtemplate/ | Make a document from a template
+*DocumentsApi* | [**delete_document**](docs/DocumentsApi.md#delete_document) | **DELETE** /ap1/documents-status/{id}/ | Delete a template or an unsent document
+*DocumentsApi* | [**get_download_status**](docs/DocumentsApi.md#get_download_status) | **GET** /ap1/documents-status/{id}/ | Check whether the signed PDF is ready
+*DocumentsApi* | [**list_document_pages**](docs/DocumentsApi.md#list_document_pages) | **GET** /ap1/documents/{id}/pages/ | List a document&#39;s pages and their fields
+*DocumentsApi* | [**list_document_statuses**](docs/DocumentsApi.md#list_document_statuses) | **GET** /ap1/documents-status-list/ | List the status of your organisation&#39;s documents
+*DocumentsApi* | [**list_documents**](docs/DocumentsApi.md#list_documents) | **GET** /ap1/documents/ | List the documents this API client created
+*DocumentsApi* | [**upload_document**](docs/DocumentsApi.md#upload_document) | **POST** /ap1/upload/ | Upload a document or template
+*DocumentsApi* | [**upload_document_for_one_signer**](docs/DocumentsApi.md#upload_document_for_one_signer) | **POST** /ap1/upload_app/ | Upload a document for one signer and get their signing link
+*DownloadsApi* | [**get_audit_trail_link**](docs/DownloadsApi.md#get_audit_trail_link) | **GET** /ap1/document/download-audit-link/ | Get a link to the audit trail
+*DownloadsApi* | [**get_download_link**](docs/DownloadsApi.md#get_download_link) | **GET** /ap1/document/download-link/ | Get a link to the signed PDF
+*DownloadsApi* | [**get_view_link**](docs/DownloadsApi.md#get_view_link) | **GET** /ap1/document/view-link/ | Get a link to view the document
+*FieldsApi* | [**create_document_fields**](docs/FieldsApi.md#create_document_fields) | **POST** /ap1/documents/fields/ | Add fields to a document
+*FieldsApi* | [**create_template_fields**](docs/FieldsApi.md#create_template_fields) | **POST** /ap1/templates/fields/ | Add fields to a template
+*FieldsApi* | [**delete_field**](docs/FieldsApi.md#delete_field) | **DELETE** /ap1/documents/fields/{id}/ | Delete a field
+*FieldsApi* | [**list_document_fields**](docs/FieldsApi.md#list_document_fields) | **GET** /ap1/documents/fields/ | List a document&#39;s fields
+*FieldsApi* | [**list_template_fields**](docs/FieldsApi.md#list_template_fields) | **GET** /ap1/templates/fields/ | List a template&#39;s fields
+*FieldsApi* | [**update_document_field**](docs/FieldsApi.md#update_document_field) | **PUT** /ap1/documents/fields/{id}/ | Change a document&#39;s field
+*FieldsApi* | [**update_document_field_by_body**](docs/FieldsApi.md#update_document_field_by_body) | **PUT** /ap1/documents/fields/ | Change a document&#39;s field (ID in the body)
+*FieldsApi* | [**update_template_field**](docs/FieldsApi.md#update_template_field) | **PUT** /ap1/templates/fields/{id}/ | Change a template&#39;s field
+*SendingApi* | [**fill_and_send_document**](docs/SendingApi.md#fill_and_send_document) | **POST** /ap1/document/update_and_send/ | Fill in fields, add a signatory and send, in one call
+*SendingApi* | [**send_document**](docs/SendingApi.md#send_document) | **POST** /ap1/document/send/ | Send a document for signing by email
+*SendingApi* | [**send_document_by_link**](docs/SendingApi.md#send_document_by_link) | **POST** /ap1/document/send_url/ | Send a document and get the signing link
+*SignatoriesApi* | [**create_signatories**](docs/SignatoriesApi.md#create_signatories) | **POST** /ap1/signatories/bulk/ | Add several signatories
+*SignatoriesApi* | [**create_signatory**](docs/SignatoriesApi.md#create_signatory) | **POST** /ap1/signatories/ | Add a signatory
+*SignatoriesApi* | [**delete_signatory**](docs/SignatoriesApi.md#delete_signatory) | **DELETE** /ap1/signatories/{id}/ | Remove a signatory
+*SignatoriesApi* | [**list_signatories**](docs/SignatoriesApi.md#list_signatories) | **GET** /ap1/signatories/ | List a document&#39;s signatories
+*TemplatesApi* | [**create_template_fields**](docs/TemplatesApi.md#create_template_fields) | **POST** /ap1/templates/fields/ | Add fields to a template
+*TemplatesApi* | [**delete_document**](docs/TemplatesApi.md#delete_document) | **DELETE** /ap1/documents-status/{id}/ | Delete a template or an unsent document
+*TemplatesApi* | [**list_template_fields**](docs/TemplatesApi.md#list_template_fields) | **GET** /ap1/templates/fields/ | List a template&#39;s fields
+*TemplatesApi* | [**list_templates**](docs/TemplatesApi.md#list_templates) | **GET** /ap1/templates/ | List your organisation&#39;s templates
+*TemplatesApi* | [**update_template_field**](docs/TemplatesApi.md#update_template_field) | **PUT** /ap1/templates/fields/{id}/ | Change a template&#39;s field
+*WebhooksApi* | [**create_webhook_endpoint**](docs/WebhooksApi.md#create_webhook_endpoint) | **POST** /ap1/webhooks/ | Add a webhook endpoint
+*WebhooksApi* | [**delete_webhook_endpoint**](docs/WebhooksApi.md#delete_webhook_endpoint) | **DELETE** /ap1/webhooks/{id}/ | Delete a webhook endpoint
+*WebhooksApi* | [**get_webhook_endpoint**](docs/WebhooksApi.md#get_webhook_endpoint) | **GET** /ap1/webhooks/{id}/ | Get a webhook endpoint
+*WebhooksApi* | [**list_webhook_deliveries**](docs/WebhooksApi.md#list_webhook_deliveries) | **GET** /ap1/webhooks/{id}/deliveries/ | List an endpoint&#39;s deliveries
+*WebhooksApi* | [**list_webhook_endpoints**](docs/WebhooksApi.md#list_webhook_endpoints) | **GET** /ap1/webhooks/ | List your webhook endpoints
+*WebhooksApi* | [**redeliver_webhook**](docs/WebhooksApi.md#redeliver_webhook) | **POST** /ap1/webhooks/deliveries/{id}/redeliver/ | Send a delivery again
+*WebhooksApi* | [**rotate_webhook_secret**](docs/WebhooksApi.md#rotate_webhook_secret) | **POST** /ap1/webhooks/{id}/rotate-secret/ | Replace a webhook endpoint&#39;s secret
+*WebhooksApi* | [**send_test_webhook**](docs/WebhooksApi.md#send_test_webhook) | **POST** /ap1/webhooks/{id}/test/ | Send a test event
+*WebhooksApi* | [**update_webhook_endpoint**](docs/WebhooksApi.md#update_webhook_endpoint) | **PUT** /ap1/webhooks/{id}/ | Change or switch a webhook endpoint on or off
+
+
+## Documentation For Models
+
+ - [CreateBulkSend202Response](docs/CreateBulkSend202Response.md)
+ - [CreateBulkSendRequest](docs/CreateBulkSendRequest.md)
+ - [CreateDocumentFieldsRequestInner](docs/CreateDocumentFieldsRequestInner.md)
+ - [CreateDocumentFromTemplate200Response](docs/CreateDocumentFromTemplate200Response.md)
+ - [CreateDocumentFromTemplateRequest](docs/CreateDocumentFromTemplateRequest.md)
+ - [CreateDocumentFromTemplateRequestRecipientsInner](docs/CreateDocumentFromTemplateRequestRecipientsInner.md)
+ - [CreateSignatoriesRequest](docs/CreateSignatoriesRequest.md)
+ - [CreateSignatoriesRequestSignatoriesInner](docs/CreateSignatoriesRequestSignatoriesInner.md)
+ - [CreateSignatoryRequest](docs/CreateSignatoryRequest.md)
+ - [CreateTemplateFieldsRequestInner](docs/CreateTemplateFieldsRequestInner.md)
+ - [CreateWebhookEndpointRequest](docs/CreateWebhookEndpointRequest.md)
+ - [DeleteFieldRequest](docs/DeleteFieldRequest.md)
+ - [Document](docs/Document.md)
+ - [DocumentPage](docs/DocumentPage.md)
+ - [DocumentStatusPage](docs/DocumentStatusPage.md)
+ - [DocumentStatusRow](docs/DocumentStatusRow.md)
+ - [FillAndSendDocumentRequest](docs/FillAndSendDocumentRequest.md)
+ - [FillAndSendDocumentRequestElementsInner](docs/FillAndSendDocumentRequestElementsInner.md)
+ - [GetAccessTokenRequest](docs/GetAccessTokenRequest.md)
+ - [GetAuditTrailLink200Response](docs/GetAuditTrailLink200Response.md)
+ - [GetDownloadStatus200Response](docs/GetDownloadStatus200Response.md)
+ - [ListBulkSendColumns200ResponseInner](docs/ListBulkSendColumns200ResponseInner.md)
+ - [ModelField](docs/ModelField.md)
+ - [Page](docs/Page.md)
+ - [RefreshAccessToken200Response](docs/RefreshAccessToken200Response.md)
+ - [RefreshAccessTokenRequest](docs/RefreshAccessTokenRequest.md)
+ - [RequestCountPage](docs/RequestCountPage.md)
+ - [RequestHit](docs/RequestHit.md)
+ - [RequestLog](docs/RequestLog.md)
+ - [RequestLogPage](docs/RequestLogPage.md)
+ - [SendDocument200Response](docs/SendDocument200Response.md)
+ - [SendDocumentByLink200Response](docs/SendDocumentByLink200Response.md)
+ - [SendDocumentByLinkRequest](docs/SendDocumentByLinkRequest.md)
+ - [SendDocumentRequest](docs/SendDocumentRequest.md)
+ - [Signatory](docs/Signatory.md)
+ - [Template](docs/Template.md)
+ - [TemplateField](docs/TemplateField.md)
+ - [TemplatePage](docs/TemplatePage.md)
+ - [UpdateDocumentFieldByBodyRequest](docs/UpdateDocumentFieldByBodyRequest.md)
+ - [UpdateDocumentFieldByBodyRequestItemsInner](docs/UpdateDocumentFieldByBodyRequestItemsInner.md)
+ - [UpdateWebhookEndpointRequest](docs/UpdateWebhookEndpointRequest.md)
+ - [Upload](docs/Upload.md)
+ - [UploadDocumentForOneSigner200Response](docs/UploadDocumentForOneSigner200Response.md)
+ - [UploadDocumentForOneSignerRequest](docs/UploadDocumentForOneSignerRequest.md)
+ - [UploadDocumentRequest](docs/UploadDocumentRequest.md)
+ - [WebhookDelivery](docs/WebhookDelivery.md)
+ - [WebhookDeliveryPage](docs/WebhookDeliveryPage.md)
+ - [WebhookEndpoint](docs/WebhookEndpoint.md)
+ - [WebhookEndpointWithSecret](docs/WebhookEndpointWithSecret.md)
+
+
+<a id="documentation-for-authorization"></a>
+## Documentation For Authorization
+
+
+Authentication schemes defined for the API:
+<a id="Bearer"></a>
+### Bearer
+
+- **Type**: API key
+- **API key parameter name**: Authorization
+- **Location**: HTTP header
+
+
+## Author
+
+info@signedly.com
+
+

signedly-0.1.0/pyproject.toml

@@ -0,0 +1,89 @@
+[tool.poetry]
+name = "signedly"
+version = "0.1.0"
+description = "Signedly API"
+authors = ["Signedly <info@signedly.com>"]
+license = "MIT"
+readme = "README.md"
+repository = "https://github.com/signedly/signedly-sdks"
+keywords = ["OpenAPI", "OpenAPI-Generator", "Signedly API"]
+include = ["signedly/py.typed"]
+
+[tool.poetry.dependencies]
+python = "^3.8"
+
+urllib3 = ">= 1.25.3 < 3.0.0"
+python-dateutil = ">= 2.8.2"
+pydantic = ">= 2"
+typing-extensions = ">= 4.7.1"
+
+[tool.poetry.dev-dependencies]
+pytest = ">= 7.2.1"
+pytest-cov = ">= 2.8.1"
+tox = ">= 3.9.0"
+flake8 = ">= 4.0.0"
+types-python-dateutil = ">= 2.8.19.14"
+mypy = ">= 1.5"
+
+
+[build-system]
+requires = ["setuptools"]
+build-backend = "setuptools.build_meta"
+
+[tool.pylint.'MESSAGES CONTROL']
+extension-pkg-whitelist = "pydantic"
+
+[tool.mypy]
+files = [
+  "signedly",
+  #"test",  # auto-generated tests
+  "tests", # hand-written tests
+]
+# TODO: enable "strict" once all these individual checks are passing
+# strict = true
+
+# List from: https://mypy.readthedocs.io/en/stable/existing_code.html#introduce-stricter-options
+warn_unused_configs = true
+warn_redundant_casts = true
+warn_unused_ignores = true
+
+## Getting these passing should be easy
+strict_equality = true
+extra_checks = true
+
+## Strongly recommend enabling this one as soon as you can
+check_untyped_defs = true
+
+## These shouldn't be too much additional work, but may be tricky to
+## get passing if you use a lot of untyped libraries
+disallow_subclassing_any = true
+disallow_untyped_decorators = true
+disallow_any_generics = true
+
+### These next few are various gradations of forcing use of type annotations
+#disallow_untyped_calls = true
+#disallow_incomplete_defs = true
+#disallow_untyped_defs = true
+#
+### This one isn't too hard to get passing, but return on investment is lower
+#no_implicit_reexport = true
+#
+### This one can be tricky to get passing if you use a lot of untyped libraries
+#warn_return_any = true
+
+[[tool.mypy.overrides]]
+module = [
+  "signedly.configuration",
+]
+warn_unused_ignores = true
+strict_equality = true
+extra_checks = true
+check_untyped_defs = true
+disallow_subclassing_any = true
+disallow_untyped_decorators = true
+disallow_any_generics = true
+disallow_untyped_calls = true
+disallow_incomplete_defs = true
+disallow_untyped_defs = true
+no_implicit_reexport = true
+warn_return_any = true

signedly-0.1.0/setup.cfg

@@ -0,0 +1,7 @@
+[flake8]
+max-line-length = 99
+
+[egg_info]
+tag_build = 
+tag_date = 0
+