SignTulip

SignTulip API

Integrate e-signatures into your product with a REST API and webhooks.

Authentication

Create a key in Settings → API & webhooks and send it as a Bearer token in the Authorization header.

curl https://signtulip.com/api/v1/templates \
  -H "Authorization: Bearer st_live_..."

Rate limit: 120 requests per minute per API key

Endpoints

GET/api/v1/templatesList templates (yours and your team's).
POST/api/v1/documentsCreate a document from a template and send it.
GET/api/v1/documentsList documents. Query: status, limit (≤100), offset.
GET/api/v1/documents/:idDocument status, recipients and signing links.
GET/api/v1/documents/:id/downloadRedirect to the signed PDF (?type=original for the original).
POST/api/v1/documents/:id/voidVoid a pending document. Body: { reason }.
curl -X POST https://signtulip.com/api/v1/documents \
  -H "Authorization: Bearer st_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "template_id": "5b0c…",
    "title": "NDA — Acme Inc.",
    "locale": "en",
    "expires_in_days": 14,
    "recipients": [
      { "role": "Signer 1", "name": "Jane Doe", "email": "jane@acme.com" }
    ]
  }'
// 201 Created
{
  "data": {
    "id": "8f3e…",
    "title": "NDA — Acme Inc.",
    "status": "pending",
    "recipients": [
      { "name": "Jane Doe", "email": "jane@acme.com", "status": "sent",
        "signing_url": "https://signtulip.com/sign/…" }
    ]
  }
}

Webhooks

When an event happens we POST a JSON payload to your URL. Verify requests with the SignTulip-Signature header.

Event types

document.sentrecipient.viewedrecipient.signedrecipient.declineddocument.completeddocument.voideddocument.expired
{
  "id": "evt_…",
  "type": "document.completed",
  "created_at": "2026-09-27T09:00:00.000Z",
  "data": { "document": { "id": "8f3e…", "status": "completed", "recipients": [ … ] } }
}

Verifying signatures

// SignTulip-Signature: t=1695804000,v1=5f2b…
import crypto from "node:crypto";

function verify(rawBody, header, secret) {
  const { t, v1 } = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const expected = crypto.createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  const fresh = Math.abs(Date.now() / 1000 - Number(t)) < 300;
  return fresh && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1));
}

Errors

Errors look like { "error": { "code", "message" } } and come with a matching HTTP status code.

{ "error": { "code": "template_not_found", "message": "Template not found." } }