SayPDF E-Sign API

Overview

All API endpoints are served at:

https://pdf.classicmovie.net/api

Base URL

Prepend /api to all endpoint paths below. For example, GET /esign/documents → https://pdf.classicmovie.net/api/esign/documents.

Response format

All responses are JSON. Successful responses always include "success": true and the relevant data key. Errors follow the NestJS exception format with statusCode, message.

Zapier, Make, n8n

Use your SayPDF API key (same as PDF conversion API) to create signing requests without JWT.

POST https://api.saypdf.com/api/v1/esign/documents
X-API-Key: your_api_key_here
Content-Type: multipart/form-data

pdf — binary PDF file
data — JSON string, same shape as CreateDocumentDto for POST /esign/documents (title, parties[], optional brandName, brandLogoUrl, …)

Response: {"success":true,"documentId":"…","status":"pending","parties":[…]}. Pair with webhooks for “document completed” triggers in Zapier.

Authentication

Obtaining a token

curl -X POST https://pdf.classicmovie.net/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"you@example.com","password":"••••••••"}'

# Response
{
  "access_token": "eyJhbGciOiJIUzI1NiIs..."
}

Errors

Rate Limits

Global limit: 60 requests / minute per IP. The signature submission endpoint is additionally capped at 5 requests / minute to prevent brute-force.

When rate limited you will receive HTTP 429 with a Retry-After header.

Documents

curl -X POST https://pdf.classicmovie.net/api/esign/documents \
  -H "Authorization: Bearer $TOKEN" \
  -F "pdf=@contract.pdf" \
  -F 'data={
    "title": "Service Agreement",
    "message": "Please review and sign.",
    "ownerEmail": "alice@company.com",
    "ownerName": "Alice",
    "expiresInDays": 7,
    "parties": [
      {
        "name": "Bob Smith",
        "email": "bob@example.com",
        "signingOrder": 1,
        "fields": [
          { "type": "signature", "page": 0,
            "x": 10, "y": 80, "width": 30, "height": 8 }
        ]
      }
    ]
  }'

{
  "success": true,
  "document": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "title": "Service Agreement",
    "status": "pending",
    "expiresAt": "2026-04-15T09:00:00.000Z"
  }
}

{
  "success": true,
  "documents": [/* SigningDocument[] */]
}

{
  "success": true,
  "document": {
    "id": "...",
    "status": "completed",
    "parties": [...],
    "auditLogs": [...]
  }
}

Templates

Templates let you upload a PDF once with predefined role-based field positions, then send it to different signers without re-uploading the PDF each time.

curl -X POST https://pdf.classicmovie.net/api/esign/templates \
  -H "Authorization: Bearer $TOKEN" \
  -F "pdf=@nda-template.pdf" \
  -F 'data={
    "name": "NDA Template",
    "description": "Standard non-disclosure agreement",
    "defaultMessage": "Please review and sign the NDA.",
    "roles": [
      {
        "role": "Employee",
        "color": "#2563eb",
        "fields": [
          { "type": "signature", "page": 0,
            "x": 10, "y": 80, "width": 30, "height": 8 }
        ]
      },
      {
        "role": "Manager",
        "color": "#16a34a",
        "fields": [
          { "type": "signature", "page": 0,
            "x": 60, "y": 80, "width": 30, "height": 8 }
        ]
      }
    ]
  }'

{
  "success": true,
  "templates": [
    {
      "id": "...",
      "name": "NDA Template",
      "usageCount": 14,
      "roles": [...]
    }
  ]
}

curl -X POST https://pdf.classicmovie.net/api/esign/templates/send \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "templateId": "550e8400-...",
    "title": "NDA with Bob Smith",
    "ownerEmail": "alice@company.com",
    "ownerName": "Alice",
    "signers": {
      "Employee": {
        "name": "Bob Smith",
        "email": "bob@example.com",
        "signingOrder": 1
      },
      "Manager": {
        "name": "Alice Manager",
        "email": "alice@company.com",
        "signingOrder": 2
      }
    }
  }'

Signer Endpoints

These endpoints are public — no JWT required. They are authenticated via the unique :token in the signing invitation URL.

{
  "success": true,
  "document": { "id": "...", "title": "...", "expiresAt": "..." },
  "party": {
    "id": "...", "name": "Bob Smith", "status": "pending",
    "fields": [{ "id": "...", "type": "signature", "page": 0,
      "x": 10, "y": 80, "width": 30, "height": 8 }]
  }
}

{
  "fields": [
    {
      "fieldId": "uuid-of-the-field",
      "value": "data:image/png;base64,iVBORw0KGg..."
    }
  ]
}

{ "reason": "I need to review with my lawyer first." }

Webhooks

Schemas

CreateDocumentDto

CreatePartyDto

CreateFieldDto

CreateTemplateDto

Document Status

Webhooks Guide

When document events occur, SayPDF sends a signed POST to your configured webhook URL. Configure your webhook URL in the dashboard settings.

Event types

Payload format

{
  "event": "document.completed",
  "documentId": "550e8400-...",
  "timestamp": "2026-04-08T12:34:56Z",
  "data": { /* SigningDocument object */ }
}

Verifying signatures

Every webhook request includes an X-SayPDF-Signature header containing an HMAC-SHA256 signature of the raw body using your webhook secret.

const crypto = require('crypto');

function verifyWebhook(rawBody, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature)
  );
}

Retry policy

Failed deliveries are retried up to 5 times with exponential backoff: 60s → 5min → 30min → 2h → 6h. You can also trigger an immediate replay from the dashboard or via the API.

Changelog

• 2026-04-08 NEW Document Templates — reuse PDFs with role-based field placements. New endpoints: POST /esign/templates, POST /esign/templates/send.
• 2026-04-07 NEW Webhook delivery logs with full retry history. Replay failed deliveries via POST /esign/webhooks/deliveries/:id/replay.
• 2026-04-05 NEW PKCS#7 digital signatures embedded in PDF — verifiable in Adobe Reader and other PDF validators.
• 2026-04-05 NEW Certificate of Completion generated after all parties sign, listing audit trail with IPs and timestamps.
• 2026-04-04 NEW Automatic reminders at 3 days and 1 day before expiry. Daily GDPR cleanup cron for retention-expired documents.