letssign.now
Start now

OpenAPI spec

The machine-readable v1 contract — import it into Postman, Insomnia or a client generator.

Every v1 endpoint, request schema, response shape, status code and webhook event is described in one OpenAPI 3.1 document:

https://www.wesign.now/openapi.json

The same file is served on the letssign.now alias host. It declares both API hosts as servers — https://api.wesign.now/v1 (canonical) and https://api.letssign.now/v1 (permanent alias) — so a generated client can target either.

What is in it

  • All 21 paths under /v1 with their zod-derived request bodies, every documented error code per status, and the Idempotency-Key / Idempotent-Replayed / Retry-After / RateLimit-* headers.
  • bearer security scheme covering wsk_live_… keys and legacy lsk_live_… keys.
  • A webhooks section with one entry per event (signing_request.sent, signing_request.signed, signing_request.expired, document.completed, template_instance.staged, template_instance.confirmed, template_instance.discarded), the delivery envelope, and the signature scheme — both header families, t=…,v1=…, and the signed message ${t}.${rawBody} — under the top-level x-webhook-signature.
  • The Enterprise gate: /templates/{id}/generate, /templates/{id}/instantiate and /documents/{id}/confirm carry a 402 enterprise-required response.
  • The two retired endpoints (POST /documents, POST /embedded/sessions) marked deprecated with their stable 410.

Import it

Import → Link, paste https://www.wesign.now/openapi.json, then set the collection variable baseUrl to https://api.wesign.now/v1 and add your key under Authorization → Bearer Token.

Create → Import → URL, paste the spec URL. Pick the canonical server when prompted and set the bearer token on the environment.

npx @openapitools/openapi-generator-cli generate \
  -i https://www.wesign.now/openapi.json \
  -g typescript-fetch \
  -o ./wesign-client

Any generator target works (python, go, java, csharp, …). The spec uses 3.1.0 features — webhooks, type arrays for nullables, const — so use a generator release from 2023 or later.

Point any hosted viewer at the URL, e.g. https://redocly.github.io/redoc/?url=https://www.wesign.now/openapi.json.

The spec is written by hand from the route handlers' zod schemas and response builders — it is not generated at build time. A unit test (tests/openapi.test.ts, run on every build) guards it against drift: every route directory must have a path, every documented method must be exported by its route file, every status: literal in a handler must be documented, Enterprise-gated routes must carry a 402, and the webhook entries must match the event catalogue exactly.

Reading the spec by hand

  • Paths are relative to the server URL, so /documents/{id} means https://api.wesign.now/v1/documents/{id}.
  • Error responses reference one Error schema ({ error, code, meta? }); the response description lists the code values that status can carry. See Errors for the prose version.
  • Binary responses (/documents/{id}/signed, /documents/{id}/pdf, /documents/{id}/audit-trail, and the default mode of /templates/{id}/generate) are application/pdf.
  • POST /templates/{id}/generate and POST /templates/{id}/instantiate return different shapes depending on validate_only and review; the 200 and 201 responses spell each one out.

On this page

What is in itImport itReading the spec by hand