Skip to main content
This page describes the data that moves through the API and webhooks. The Privacy Policy remains the authority on what Flowsign itself collects and keeps.

​
What an API key can see

A key is bound to one workspace for its whole life and acts with the permissions of the role chosen when it was created, never as the person who issued it and never as an owner. Everything it can read or change (packages, templates, documents, recipients, audit events) is scoped to that workspace. Flowsign stores only a hash of the key. See Authentication.

​
Requests go to production

There is no sandbox. The code samples on each endpoint page point at https://my.flowsign.app, the production API, and nothing on these pages sends a request for you: every call comes from your own tooling with your own key. Creating a package with "status": "sent" really sends it. For testing, use a key with an expiry date and a minimal role, and revoke it from Settings > API keys when you are done. See Trying the API.

​
What webhook payloads contain

Every event carries the package id and metadata, the package’s custom field values, and every event except SESSION_OPENED carries the package title. Session events add the session id and the recipient’s name and email address. Void, hold, resume and delete events name the member who acted by email address, and decline events carry the reason the recipient typed. Titles, custom fields and decline reasons are free text, so a payload can contain personal information. Treat a webhook listener as a system that handles personal data: verify the signature, keep payloads only as long as you need them, and keep bodies out of shared logs. An endpoint belongs to the workspace it was created in and receives events only for that workspace’s packages. Flowsign keeps each endpoint’s delivery log for 30 days. See Webhooks and Events.

​
Where audit trails and certificates live

Every package keeps an audit trail with a timestamp, IP address and device per event. Read it on the package page, under Reports > Audit trail (Audit trail), or with GET /api/v1/packages/{packageId}/audit-events, which returns each event’s type, the email of whoever caused it, its signing session and its time. When the last recipient finishes, the signed documents and the certificate of completion are available from the package page. Through the API, GET /api/v1/packages/{packageId}/documents/{documentId} returns a download URL that serves the signed copy once the package has completed; it expires after an hour, so fetch it when needed rather than storing it. GET /api/v1/packages/{packageId}/download/certificate returns the certificate of completion once the package has completed. Retention is set out in the Privacy Policy.