> ## Documentation Index > Fetch the complete documentation index at: https://docs.flowsign.app/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Flowsign is one word with a lowercase s. > The REST API base URL is https://my.flowsign.app and every endpoint lives under /api/v1. > When answering API questions, cite the HTTP method and endpoint path. > API access needs the Enterprise plan and an API key with the API access permission. # Get a recipient's signing URL > Returns the signing URL for a recipient's active session, for signing inside your own product. Requires canSendPackages. ## OpenAPI ````yaml /api-reference/openapi.json post /api/v1/packages/{packageId}/signing-url openapi: 3.0.3 info: title: Flowsign API version: 1.0.0 description: >- Public v1 API for Flowsign. Every endpoint is authenticated with a Bearer API key (prefix `fsk_`). Errors use `{ error, details? }`; success responses wrap payload data as `{ data }`. An organisation is divided into workspaces. A key is issued for one workspace and acts there on every request (see `GET /api/v1/workspaces`); `X-Workspace-Id` is optional and may only name that workspace. Packages, templates, contacts and members are scoped to the key's workspace. servers: - url: https://my.flowsign.app description: Production security: - ApiKey: [] paths: /api/v1/packages/{packageId}/signing-url: post: tags: - Packages summary: Get a recipient's signing URL description: >- Returns the signing URL for a recipient's active session, for signing inside your own product. Requires canSendPackages. operationId: postPackagesByPackageIdSigning-url parameters: - schema: type: string required: true name: packageId in: path - schema: type: string description: >- The workspace the key was issued for, as returned by `GET /api/v1/workspaces`. Optional: omitting it acts in the key's workspace, and any other id is rejected with 401. required: false name: x-workspace-id in: header requestBody: required: true content: application/json: schema: type: object properties: recipientId: type: string minLength: 1 description: >- The id of one of the package's recipients, as listed on `GET /api/v1/packages/:packageId`. Give this or `recipientEmail`, not both. example: cmg4v8q2k0002s7xh6k4m1p9c recipientEmail: type: string format: email description: >- The email address of one of the package's recipients, matched ignoring case. An address two recipients share is a 409, so use `recipientId` then. example: jane.ahu@example.co.nz responses: '200': description: Success content: application/json: schema: type: object properties: data: type: object properties: signingUrl: type: string description: >- The page where the recipient signs (or views, for a view-only recipient). For an in-person recipient this is the host's page instead, which checks who is holding the device before handing over. example: >- https://my.flowsign.app/sign/Q3h7vK2mN9pL4sT8wYbC1dF6gH0jR5uXeZaI2oPqMlk embeddedUrl: type: string nullable: true description: >- The same page with `?embedded=true`, which drops Flowsign's surrounding chrome so it can sit in an iframe. Null for an in-person recipient. example: >- https://my.flowsign.app/sign/Q3h7vK2mN9pL4sT8wYbC1dF6gH0jR5uXeZaI2oPqMlk?embedded=true recipientId: type: string description: The recipient the URL is for. example: cmg4v8q2k0002s7xh6k4m1p9c sessionId: type: string description: >- The signing session the URL opens, as listed on `recipientSessions` in `GET /api/v1/packages/{packageId}`. example: cmg1p4k2a000fv9x0s7e2n4q6 recipientName: type: string nullable: true description: >- The recipient's name as recorded on the session, or null when none was captured. example: Jane Ahu recipientEmail: type: string nullable: true description: >- The recipient's email address as recorded on the session, or null when none was captured. example: jane.ahu@example.co.nz status: allOf: - $ref: '#/components/schemas/RecipientSessionStatus' - description: >- The session's status. Always `ACTIVE` here, since only an active session has a signing URL. required: - signingUrl - embeddedUrl - recipientId - sessionId - recipientName - recipientEmail - status required: - data '400': description: The body is not valid JSON content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: Missing or invalid API key content: application/json: schema: $ref: '#/components/schemas/Error' '402': description: Caller's plan does not include this feature (publicApi / webhooks) content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: API key present but caller lacks the required permission content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: >- No package with that id is visible to the caller with edit access, the recipient has no active signing session (including one whose turn has not come yet), or the session has no signing link yet content: application/json: schema: $ref: '#/components/schemas/Error' '409': description: >- `recipientEmail` matches more than one recipient with an active session; use `recipientId` content: application/json: schema: $ref: '#/components/schemas/Error' '422': description: Request failed schema validation; details keyed by field content: application/json: schema: $ref: '#/components/schemas/Error' '429': description: Rate limit exceeded; see `Retry-After` content: application/json: schema: $ref: '#/components/schemas/Error' components: schemas: RecipientSessionStatus: type: string enum: - WAITING - ACTIVE - COMPLETED - DECLINED - CANCELLED description: >- A signing session's status. WAITING is not yet invited, because an earlier recipient's turn or this recipient's delay has not come; ACTIVE is invited and able to sign; COMPLETED is finished; DECLINED is refused by the recipient; CANCELLED is ended without finishing because the package ended first. example: ACTIVE Error: type: object properties: error: type: string description: What went wrong, in plain words. example: 'Missing permission: canSendPackages' details: type: object additionalProperties: type: array items: type: string description: >- Validation problems keyed by field path. Present only on 422 responses. example: recipients.0.email: - Invalid email required: - error securitySchemes: ApiKey: type: http scheme: bearer bearerFormat: fsk_* ````