API

Built for the integration.

REST + JSON over HTTPS, per-workspace bearer-token auth, webhooks for every state transition. It's the signing layer underneath your CRM, not a separate destination.

Quick overview

The API mirrors the product: every concept maps to a resource you can read, create, or subscribe to. Authentication is a per-workspace bearer token you issue in settings. The reference implementation is VG Realestate, which uses the same endpoints documented here.

Base URL

https://vg-sign.com/api/v1/internal

Authentication

Issue a workspace API token in your settings, then call the API with Authorization: Bearer vgs_live_…. Tokens are scoped to your workspace, hashed at rest, and revocable at any time. For embedded CRM use, agents are signed in through a secure single-use SSO hand-off at /oauth/authorize, with no password round-trip.

Core endpoints

An envelope is created whole: recipients, signing order, and field placements are part of the create payload, not separate calls. That keeps a CRM-driven send atomic.

  • POST /envelopes: create and send an envelope from one or more uploaded PDFs, with recipients, signing order, and fields in a single payload.
  • POST /envelopes/from-refs: create an envelope from documents the CRM already holds, by reference.
  • GET /envelopes/:id: read envelope state and recipient progress.
  • GET /envelopes/:id/final: fetch the signed, flattened PDF(s).
  • GET /envelopes/:id/certificate: fetch the certificate of completion.
  • POST /envelopes/:id/remind: re-send the signing notification to pending recipients.
  • POST /envelopes/:id/void: void an in-flight envelope.
  • POST /webhooks · GET /webhooks · DELETE /webhooks/:id: manage lifecycle-event subscriptions.

Webhook events

Every state change emits a webhook with a signed payload. Events: envelope.sent, envelope.viewed, envelope.signed, envelope.completed, envelope.declined, envelope.voided.

Each delivery carries an X-VG-Signature: sha256=<hex>header, an HMAC-SHA256 of the raw request body, keyed with your subscription’s shared secret. Recompute it and compare before processing.

SDKs

The API is plain REST + JSON, so any HTTP client works. Official language SDKs are on the roadmap; we don’t publish one yet. For integration, request the current OpenAPI spec or Postman collection from info@vg-realestate.ca.

Rate limits

Each workspace token is limited to 600 requests per minute (and 600/min per source IP), measured over a rolling 60-second window. Reminder sends are capped tighter, at 60/min. Over-limit requests get a 429 with a Retry-After header. Need a higher ceiling? Contact us.

Reference

Full reference docs (every endpoint, every field, every error code) are being assembled. In the meantime, ask info@vg-realestate.ca for the staging Postman collection or an OpenAPI spec.