REST API
Server-to-server calls use `Authorization: Bearer esk_test_…` or `esk_live_…`. The tenant comes from the key. Upload, the envelope wizard, and webhook registration use the admin session.
What a tenant API key can call
| Call | Scope on the key | What you get back |
|---|---|---|
| GET /api/v1/zapier/auth/test | integrations:zapier | Your tenant id and name. Use this to confirm the key. |
| GET /api/v1/zapier/triggers/{event}/sample | integrations:zapier | Sample payloads for document.signed, document.completed, document.expired, and template.created. |
| POST /api/v1/zapier/actions/create-from-template | integrations:zapier | A new document id from a template you already have. |
| POST /api/v1/zapier/actions/send-for-signing | integrations:zapier | The document moves to link-sent and the signer is emailed. |
| POST /api/v1/signing-sessions/{sessionId}/tokens | signing:write | A short-lived st_… token for the embed. The browser uses that token, not the API key. |
Admin session
Sign in to the admin app for these. A Bearer API key on these routes is refused.
| Work | Where |
|---|---|
| Upload a PDF, customers, templates | Admin documents and customers |
| Envelope wizard: create, send, cancel | Admin envelopes |
| Register, rotate, and replay webhooks | Admin → Developer → Webhooks |
Confirm the key, then send a template document
Prerequisites: an `esk_test_…` or `esk_live_…` key with `integrations:zapier`, and a template id. Expected output: HTTP 200 from the auth test, HTTP 201 with `documentId`, then `status: "link-sent"`.
curl -sS https://api.endorsedsign.com/api/v1/zapier/auth/test \
-H "Authorization: Bearer $ENDORSED_API_KEY"
curl -sS -X POST https://api.endorsedsign.com/api/v1/zapier/actions/create-from-template \
-H "Authorization: Bearer $ENDORSED_API_KEY" \
-H 'Content-Type: application/json' \
-d '{
"templateId": "'"$ENDORSED_TEMPLATE_ID"'",
"recipientEmail": "signer@example.com",
"recipientName": "Signer Example"
}'
curl -sS -X POST https://api.endorsedsign.com/api/v1/zapier/actions/send-for-signing \
-H "Authorization: Bearer $ENDORSED_API_KEY" \
-H 'Content-Type: application/json' \
-d '{
"documentId": "'"$ENDORSED_DOCUMENT_ID"'",
"channel": "email"
}'New integrations should call `/api/v1/…` or `/api/v2/…`. `/api/v2` is the 2026-09-01 contract. Mutating calls that support it should send `Idempotency-Key`.
Common questions
API keys in the tenant developer workspace
Create a named key, assign scopes, and see the prefix in the same admin chrome your operators already use.
SDK quickstarts beside active credentials
Operators can rotate keys and hand off language-specific SDK onboarding from the same tenant developer workspace.
Developer workspace with live data
A single developer surface showing active tenant API key controls in the admin workspace.
Get your API key in one call
POST /api/auth/register with `mode: sandbox` returns an `esk_test_` key. Confirm it with GET /api/v1/zapier/auth/test. OpenAPI is at /api/docs.json on an API host that has docs enabled.