Sign

Select the exact signing workspace

Verify identity and organization, discover the actual Sign workspace grant, then bind it separately from action input. Reads require read access; organizer writes require read_write or admin. Archival requires admin, workspace:delete and an existing empty local mirror. Privacy operates across the whole organization.

Upload an immutable source

Upload the specifically authorized PDF, PNG or JPEG. Retain both document.id and document.documentRef, source/PDF hashes and page geometry. Source objects are immutable; a replacement is a new version. documents.get exposes metadata; documents.content.get and documents.pdf.get read the original and signing PDF. The SDK returns contentType, contentLength and contentBase64: decode the bytes, compare the byte length and verify SHA-256 against retained metadata.

Build a reusable template and editable draft

Use active templates to seed new envelopes. Define structured field type, assignee role/capacity and page placement; page is one-based and geometry is measured as page fractions from the top left. Create retains a draft without notifying signers. Every draft update replaces recipients: omission clears them, even when editing only message. Read back the complete intended list before sending.

Authorize sending and inspect each party

Sending requires an ingested document, nonempty subject and message, valid fields and recipients. It freezes the source/fields, revokes previous unsigned links and queues messages in routing order. Links are bearer secrets. Notify acceptance, dispatch outcome, recipient delivery, opening and signing are distinct states. Read envelope.deliveries and the actual Notify dispatch record; no acceptance response proves delivery.

Reissue or void deliberately

Reissue only an open unsigned recipient discovered on that exact envelope. The previous bearer link is revoked and a replacement request is queued. Void prevents further signing and cancels outstanding requests; it does not recall messages or remove prior evidence. Completed envelopes cannot be voided.

Keep recipient consent distinct from organizer actions

Recipient token links govern viewing and signing. A signer must inspect the actual agreement and provide their own consent. Organizer access, a synthetic fixture or an agent tool invocation is not signer consent or authority to enter a binding agreement. The local worked journey exercises synthetic consent solely to verify artifacts.

Verify completion and evidence

Completion artifacts bind the immutable source and completed document hashes to signer and audit evidence. Finalize retries missing artifacts for an already completed envelope and reuses existing artifacts. The stored certificate includes its hash and artifact list. envelopes.completed_document.get and envelopes.audit_certificate.pdf.get read the retained completed and certificate PDFs; verify decoded bytes against the exact artifact hash and length. A pre-immutable historical envelope may instead return certificate.legacy:true without a stored certificate hash; that projection must not be presented as equivalent evidence.

Preserve privacy and archive boundaries

Organization exports withhold signing credentials and sealed bearer links but still contain sensitive agreement and recipient information. Exact ERASE approval permanently removes all Sign organization records and stored objects, including completed-agreement evidence. Backup retention is separately reported. Archival of an empty workspace returns HTTP 204 with no body and follows Auth acceptance.

Action reference

• Export Sign organization data: Export every Sign record and signing-document metadata entry the organization owns — envelopes, recipients, templates and audit trails — as one portable payload for a data portability request.
• Erase organization data: Permanently erase all Sign records and signing-document objects for the organization after an explicit ERASE confirmation. Completed envelopes and their audit certificates go with it, so executed agreements lose their evidence.
• Get Sign workspace metrics: Read bounded counts of retained envelopes, open sent/viewed envelopes and completed envelopes in the granted workspace. This widget does not report token-expiry proximity or a time-period count.
• Get Sign identity and statuses: Read verified user and organization plus the supported template and envelope status values. Bootstrap does not return a workspace, effective permission projection or signing-token lifetime.
• Archive empty Sign workspace: Confirm that the granted Sign workspace has no retained records, ask Auth to archive it and remove its local mirror after Auth acceptance. Success is HTTP 204 without a body.
• List Sign envelopes: List signature envelopes in this workspace with their status, recipients and document, plus a status summary, so you can find the envelopeId every other envelope action needs.
• Create envelope: Create a signature envelope as a DRAFT. Nothing is sent and no signer is contacted; the envelope stays editable until envelopes.send. Seed it from an active template, or supply the document, fields and recipients directly.
• Get Sign envelope: Get one signature envelope with its document, field schema, recipients and their individual signing status, and the delivery record for every party message ($.envelope.deliveries: signing requests and completed copies, with Notify dispatch outcome).
• Update envelope: Edit a draft envelope, replacing its recipients with the complete supplied list. Omitted recipients are cleared; sent or closed envelopes cannot be edited.
• Get Sign audit certificate: Get the immutable audit certificate issued when an envelope completed: signer identities, capacities, consent and evidence hashes, the source and completed document SHA-256 and a hash chain over the audit trail, plus the certificate's own hash.
• Send envelope: Freeze the source and fields, revoke previous unsigned links, issue new signing links and queue recipient notifications in routing order. Notify acceptance is distinct from actual recipient delivery.
• Reissue signing link: Revoke an open unsigned recipient link, issue its replacement and queue a new request. Verify retained delivery and Notify dispatch state separately from link creation.
• Void envelope: Void a signature envelope so its outstanding signing links stop working and no further signature can be collected. A completed envelope cannot be voided; voiding is the only way to retract one already sent.
• List templates: List signature templates in this workspace with their status, signer roles and default subject and message.
• Create template: Create a signature template: a reusable document, field schema, signer roles and default subject and message that envelopes can be seeded from. Only an active template can seed an envelope.
• Get template: Get one signature template with its document, field schema, signer roles and defaults.
• Update template: Update a signature template: its name, description, status, document, field schema, signer roles or defaults. Envelopes already created from it keep the terms they were created with.
• Get Sign document metadata: Get metadata for an uploaded signing document: title, content type, size, original and signing-PDF SHA-256, version and predecessor, page count and page sizes, and upload provenance. The bytes are downloaded separately.
• Upload signing document: Upload a PDF, PNG or JPEG as an immutable signing source. The bytes are validated, stored under their SHA-256 and never overwritten; images get a derived signing PDF, and a replacement becomes a new version.
• Finalize completed envelope: Issue any missing completion artifact for a completed envelope: the flattened PDF and the audit certificate bound to its source and completed hashes. Idempotent; existing artifacts are never regenerated.
• Download original Sign document: Read hash-verified original document bytes from the exact granted workspace. The SDK returns contentType, contentLength and contentBase64.
• Download signing PDF: Read the hash-verified signing PDF derived from the retained source in the exact granted workspace. The SDK returns contentType, contentLength and contentBase64.
• Download completed Sign agreement: Read the immutable completed PDF only after the exact envelope is completed and its retained artifact is ready. The SDK returns contentType, contentLength and contentBase64.
• Download Sign certificate PDF: Read the retained audit certificate PDF only after the exact envelope is completed and its certificate artifact is ready. The SDK returns contentType, contentLength and contentBase64.

Evidence

Captured from the exported Sign Worker with the existing SQLite-backed D1 harness applying all core, envelope and audit migrations to one local database, in-memory R2 and synthetic Auth/workspace/archive/Notify transports. These examples prove local validation, persistence and artifact production. They do not prove separate deployed D1 topology, real recipient consent, provider delivery or a live signed agreement. All identities, signing links and documents are synthetic; replace identifiers through authorized discovery and never execute a fixture against a live organization. Binary download examples use the released SDK binary projection; tests Base64-decode and compare original bytes, lengths and server SHA-256 headers.