DocFila API

Build DocFila into your product. An organization-scoped REST API for documents, folders, e-signature envelopes with signing evidence, audit trails and accounting export — with signed webhooks and an OpenAPI 3.0 spec, available on request.

Get an API Key Talk to Us

Quickstart

Create a document, upload the PDF, and send it for signature, with cURL. Every write takes an Idempotency-Key header, so a retried request never creates a second document or envelope.

# 1. Create the document record (returns its id)
curl -X POST https://docfila-api.web.app/v1/documents \
  -H "Authorization: Bearer dfk_live_..." \
  -H "Idempotency-Key: create-contract-0001" \
  -H "Content-Type: application/json" \
  -d '{"title":"Service agreement"}'

# 2. Ask for an upload URL, PUT the PDF to it, then complete the upload
curl -X POST https://docfila-api.web.app/v1/documents/$DOC_ID/upload-url \
  -H "Authorization: Bearer dfk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"contentLength":48213}'
curl -X PUT "$UPLOAD_URL" -H "Content-Type: application/pdf" --data-binary @contract.pdf
curl -X POST https://docfila-api.web.app/v1/documents/$DOC_ID/uploads/complete \
  -H "Authorization: Bearer dfk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"uploadId":"$UPLOAD_ID"}'

# 3. Send it for signature: one signer, at least one field (positions are fractions of the page)
curl -X POST https://docfila-api.web.app/v1/signatures/requests \
  -H "Authorization: Bearer dfk_live_..." \
  -H "Idempotency-Key: send-contract-0001" \
  -H "Content-Type: application/json" \
  -d '{"documentId":"$DOC_ID","signerEmail":"client@example.com","fields":[{"type":"signature","pageNumber":1,"x":0.1,"y":0.8,"width":0.3,"height":0.06}]}'

# 4. Pull the completed evidence bundle when envelope.completed fires
curl https://docfila-api.web.app/v1/signatures/requests/$ID/evidence \
  -H "Authorization: Bearer dfk_live_..."

Endpoints

Documents

POST /v1/documents create
GET /v1/documents list
GET /v1/documents/:id retrieve
GET /v1/documents/:id/download
DELETE /v1/documents/:id

Uploads

POST /v1/documents/:id/upload-url signed PUT URL (PDF up to 100 MB, valid 15 minutes)
POST /v1/documents/:id/uploads/complete
GET /v1/folders · POST /v1/folders

Signature envelopes

POST /v1/signatures/requests send
GET /v1/signatures/requests/:id status
POST /v1/signatures/requests/:id/remind
POST /v1/signatures/requests/:id/void · /correct · /reassign

Evidence & artifacts

GET /v1/signatures/requests/:id/evidence
GET /v1/signatures/requests/:id/artifacts/:artifact
POST /v1/signatures/requests/:id/embedded-session
POST /v1/signatures/workflows/sequential

Webhooks & keys

GET /v1/signatures/webhooks · POST · DELETE /:id
POST /v1/signatures/webhooks/:id/rotate-secret
POST /v1/api-keys · GET /v1/account

Audit & export

GET /v1/documents/:id/audit-events
GET /v1/organization/audit-events
GET /v1/organization/members
POST /v1/export/datev · POST /v1/workflows/:id/run

Authentication

Bearer token in the Authorization header. Keys are organization-scoped and carry explicit permissions — documentsRead, signaturesWrite, auditRead and ten more — so a key can only reach what you granted it. Each key has its own per-minute request limit (100 requests a minute by default), and keys are created, scoped and revoked from Organization settings in the app.

curl https://docfila-api.web.app/v1/documents \
  -H "Authorization: Bearer dfk_live_..."

Webhooks & events

Subscribe to envelope events: envelope.created, envelope.completed, envelope.declined, envelope.expired and envelope.voided. Every delivery is signed — x-docfila-signature: v1=<HMAC-SHA256 of timestamp.body> alongside x-docfila-timestamp, so you can verify the payload and reject replays. Failed deliveries retry with exponential backoff, capped at 6 hours between attempts, for up to 12 attempts before the event is marked failed. Rotate an endpoint’s secret at any time without recreating it.

Clients

OpenAPI 3.0

The full v1 surface is described in an OpenAPI 3.0 document — 26 paths, request and response schemas, and the scope each endpoint requires. Ask developers@docfila.com for the spec.

Generate your own client

Point openapi-generator or oapi-codegen at the spec and you have a typed client in TypeScript, Python, Go, Dart, Java or C# in one command.

Plain HTTP

Every endpoint is ordinary JSON over HTTPS with a bearer token, so cURL, fetch, requests or your language's standard HTTP client is enough — no dependency required.

Sandbox first

Create a scoped key limited to documentsRead, try it against your own workspace, then widen the scopes once the integration works.