Developers
XOsign API
Create a document, add its recipients, and send it for signature — from your own backend, in a handful of HTTP calls.
Every request goes to https://xosign.ai/api/v1 and carries an API key you issue yourself from Settings → API keys. Here is the whole of authentication:
curl https://xosign.ai/api/v1/account \
-H "Authorization: Bearer $XOSIGN_API_KEY"A 200 comes back with your account, the mode of the key you used, and the scopes it was granted. If that works, everything else will.
Server-to-server only
These endpoints send no CORS headers, so they cannot be called from browser JavaScript — and should not be, since doing so would expose your API key to anyone who opens the page. Call them from your backend.What you can do today
The API is deliberately small and covers one job end to end: getting a document signed. Everything it does is listed here — there is nothing undocumented.
- GET
/accountRetrieve the current account - GET
/documentsList documents - POST
/documentsCreate a draft document - GET
/documents/{id}Retrieve a document - POST
/documents/{id}/sendSend a document for signature - GET
/documents/{id}/recipientsList a document's recipients
Anything not in that list does not exist yet. Rather than leave you to discover that by trial and error, the roadmap names the gaps outright.
How a signature flow fits together
- Create a draft with
POST /documents, giving it a title and its recipients. Nothing is delivered yet. - Send it with
POST /documents/{id}/send. Each recipient gets a signature request over their channel. - Track it with a webhook that fires the moment it completes — or by polling
GET /documents/{id}andGET /documents/{id}/recipients.
The quickstart walks through all three with runnable cURL, Node, and Python.
Start here
Authentication
API keys, live vs test mode, scopes, and the one host you must call.
Quickstart
Send your first document for signature in four calls.
Webhooks
Get told when a document is signed, instead of polling for it.
Errors
The error envelope and every code the API can return.
Rate limits
What your plan allows and which headers tell you where you stand.
Pagination
Cursor paging through lists.
Idempotency
Retry a write safely without creating it twice.
API reference
Every endpoint, parameter, and response.
OpenAPI spec
The machine-readable description, for clients and Postman.
Versioning
What can change inside v1 without warning, and what cannot.
Changelog
Every change to the API, newest first.
Roadmap
What the API cannot do yet, stated plainly.