Send a template
Design a document pack once in the web app, then send it with a small, fast call. Lightest on your API allowance.
POST /api/templates/send
Send your own PDFs
Every document unique? Upload to your cloud drive and send by file id. Fields are placed automatically and you get a signing link per signer.
POST /api/sessions/send
Receive webhooks
HMAC-signed notifications when documents are signed, declined, or completed. No polling.
X-NomaSign-Signature
Authenticate
Exchange your refresh token for a short-lived access token at POST /connect/token, and store the new refresh token it returns in place of the old one.
Send
Call a send endpoint with a Bearer token; every request and response schema is documented below.
Track
Receive webhooks, or cancel outstanding links with POST /api/sessions/cancel.
Webhook events
Register an HTTPS endpoint for your integration and NomaSign posts a JSON payload when any of these happen. Failed deliveries are retried automatically with increasing delays.
signing_participant.signed | One signer has signed. Fires once per signer, so you can show progress on documents with several signers. |
signing_session.completed | Everyone has signed and the document is final. |
signing_session.declined | A signer declined to sign, with the reason they gave. |
signing_session.cancelled | The request was cancelled, in the web app or through the API. |
Verify every delivery
Each request carries X-NomaSign-Signature: t=<timestamp>,v1=<signature>. Compute an HMAC-SHA256 of <timestamp>.<raw body> with your webhook secret and compare it with v1. Reject old timestamps to block replays, and use X-NomaSign-Event-Id to skip a delivery you have already processed.
Credentials
API access runs through an Integrator account in your NomaSign organisation, so automated sends are kept apart from your team's own logins. You generate a refresh token and a webhook secret for it once, in the web app. Your system exchanges the refresh token for a short-lived access token whenever it needs one. Every exchange returns a new refresh token: store it in place of the old one.
New to the API?
The setup tutorial takes you from no account to your first signed document:
| Endpoint | What it does |
|---|---|
POST /connect/token | Exchange your refresh token for an access token (OAuth2) |
POST /api/templates/send | Send documents for signature using a reusable template, to one or many recipients at once |
POST /api/sessions/send | Send your own PDF documents for signature and get a signing link for each signer |
POST /api/sessions/cancel | Cancel a signing request and revoke its signing links |
Loading the interactive reference…