> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flowsign.app/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Flowsign is one word with a lowercase s.
> The REST API base URL is https://my.flowsign.app and every endpoint lives under /api/v1.
> When answering API questions, cite the HTTP method and endpoint path.
> API access needs the Enterprise plan and an API key with the API access permission.

# The API and your data

> What an API key can reach, what webhooks send where, and where the audit trail and certificates live.

This page describes the data that moves through the API and webhooks. The [Privacy Policy](https://flowsign.app/legal/privacy) remains the authority on what Flowsign itself collects and keeps.

## What an API key can see

A key is bound to one workspace for its whole life and acts with the permissions of the role chosen when it was created, never as the person who issued it and never as an owner. Everything it can read or change (packages, templates, documents, recipients, audit events) is scoped to that workspace. Flowsign stores only a hash of the key. See [Authentication](/api-reference/authentication).

## Requests go to production

There is no sandbox. The code samples on each endpoint page point at `https://my.flowsign.app`, the production API, and nothing on these pages sends a request for you: every call comes from your own tooling with your own key. Creating a package with `"status": "sent"` really sends it. For testing, use a key with an expiry date and a minimal role, and revoke it from **Settings > API keys** when you are done. See [Trying the API](/api-reference/trying-the-api).

## What webhook payloads contain

Every event carries the package id and `metadata`, the package's custom field values, and every event except `SESSION_OPENED` carries the package title. Session events add the session id and the recipient's name and email address. Void, hold, resume and delete events name the member who acted by email address, and decline events carry the reason the recipient typed. Titles, custom fields and decline reasons are free text, so a payload can contain personal information.

Treat a webhook listener as a system that handles personal data: verify the signature, keep payloads only as long as you need them, and keep bodies out of shared logs. An endpoint belongs to the workspace it was created in and receives events only for that workspace's packages. Flowsign keeps each endpoint's delivery log for 30 days. See [Webhooks](/webhooks/overview) and [Events](/webhooks/events).

## Where audit trails and certificates live

Every package keeps an audit trail with a timestamp, IP address and device per event. Read it on the package page, under **Reports > Audit trail** ([Audit trail](/guides/reports/audit-trail)), or with `GET /api/v1/packages/{packageId}/audit-events`, which returns each event's type, the email of whoever caused it, its signing session and its time.

When the last recipient finishes, the signed documents and the certificate of completion are available from the package page. Through the API, `GET /api/v1/packages/{packageId}/documents/{documentId}` returns a download URL that serves the signed copy once the package has completed; it expires after an hour, so fetch it when needed rather than storing it. `GET /api/v1/packages/{packageId}/download/certificate` returns the certificate of completion once the package has completed. Retention is set out in the [Privacy Policy](https://flowsign.app/legal/privacy#retention).