API changelog

1.5.0 (2026-10-03)

Behaviour note (no new fields, 2026-10-03). SignWren adds a fresh document timestamp to stored sealed PDFs once a year so they stay checkable after the timestamp authority's certificate runs out. After that refresh, GET /envelopes/{envelope_id}/documents/combined sends the newest copy, with ETag and Repr-Digest from that copy's SHA-256, and POST /envelopes/{envelope_id}/file_links with signed_pdf links to it (its sha256 is the newest copy's). The envelope's final_sha256 doesn't change: it stays the hash of the PDF as completed, as envelope.completed reported it. Both copies carry the same signatures and content, and both pass the public check page. Download links made before a refresh keep working and give the newest copy.

Action needed: none, unless your code compares a downloaded file's hash with final_sha256. Compare it with the response's ETag instead, or accept either.

Data region, signature level and signature meaning (additive, 2026-10-02). GET /me now carries organization.region (us or eu, read-only; set when the organization was created, and us for every organization today). Every envelope carries signature_level: null until it completes, then simple, because SignWren signatures are electronic signatures under Article 3(10) of the EU eIDAS Regulation, not advanced or qualified ones. Every recipient carries signature_meaning (null unless set), and recipients take signature_meaning on create and update: one of the organization's meanings ("Reviewed"), for a signer who is a member of the organization and signs from their own emailed link, when the organization has turned on signature meaning (Business plan). That signer confirms who they are at the moment of signing, and their printed name, the date and time and the meaning are drawn next to their signature and repeated on the certificate. These are features for your own 21 CFR Part 11 program; SignWren doesn't certify or validate Part 11 compliance. A meaning for anyone else is 422 VALIDATION with param: signature_meaning.

Action needed: none. Clients that check for unknown properties should allow the three new ones.

1.4.0 (2026-10-02)

Audit log and IP allowlists (additive, 2026-10-02). New scope audit:read and three operations for owners and admins on the Business plan, with live keys or tokens only: GET /audit-events (pages of the security log or of envelope audit events for a date range, newest first; envelope pages carry each event's prev_hash and hash and a chains list with the result of recomputing each envelope's hash chain), POST /audit-exports (prepare a ZIP of a range up to 366 days: CSV or JSON Lines files and a manifest with the SHA-256 of each file) and GET /audit-exports/{export_id} (its status and, when ready, a 60-minute download link). New id prefixes aex_, sev_ and eev_. New error codes LIVE_KEY_REQUIRED (403, a sandbox key or token on the audit log) and IP_NOT_ALLOWED (403, on every operation: the organization turned on an IP allowlist and the request came from outside it).

Action needed: none for existing integrations, unless an organization turns on an IP allowlist; then requests from addresses outside it get 403 IP_NOT_ALLOWED.

1.3.0 (2026-10-01)

For the Outlook add-in and the Gmail add-on (additive, 2026-10-01). POST /envelopes/{envelope_id}/sender_view_url now works with an OAuth access token too (it answered 403 FORBIDDEN before). The view acts as the app and the person who connected it, and stops at once if the app is disconnected. SignWren's own add-ins may ask for frame_origin set to SignWren's own address; every other client still names one of the sites allowed in Settings. The OAuth authorization endpoint now takes a state of up to 2,000 characters (it was 500), for the Gmail add-on's OAuth library.

Action needed: none.

1.2.0 (2026-10-01)

For no-code automation apps (additive, 2026-10-01). New: GET /me (who a key or access token acts for: the organization's name, the environment, the person and the scopes; any valid credential, no scope), POST /envelopes/{envelope_id}/file_links (a link to the signed PDF or the certificate of a completed envelope that works without a key for 5 to 60 minutes, for tools that fetch files by URL; every download through it is in the audit trail; new error code FILE_LINKS_NOT_CONFIGURED, 503) and the metadata_key and metadata_value filters on GET /envelopes (one exact metadata pair). Webhook endpoints made by an app connected with OAuth now belong to that connection: they carry app (null on every other endpoint), only that connection sees and changes them, and they are deleted when the connection ends or the receiver answers 410 Gone. Each app connection has room for 50 such endpoints, apart from the 16 per environment for everything else.

For sync jobs (additive, 2026-10-01, the ServiceNow app's fallback when an instance can't receive webhooks): GET /envelopes takes updated_since (an RFC 3339 date-time; envelopes that changed at or after it, 422 VALIDATION with param: updated_since for anything else) and every list item carries updated_at, which moves with every event on the envelope.

Action needed: none for keys. An app connected with OAuth that listed or changed endpoints it didn't make no longer sees them; manage those with a key or in Settings.

1.1.0 (2026-10-01)

Embedded signing and sending (additive, 2026-10-01). Recipients take embedded and client_user_id, and both come back on every recipient. New: POST /envelopes/{envelope_id}/recipients/{recipient_id}/signing_url (a 5-minute, one-browser signing URL for an embedded signer, framed only by an allowed site, with return_url for a redirect instead of a frame) and POST /envelopes/{envelope_id}/sender_view_url (the field editor for one draft). The embedded pages post a versioned message (source: "signwren", version: 1) to the parent window; the Embedded section of the reference lists every type. A web component (/embedded/v1/signwren.js, <signwren-signing> and <signwren-sending>) turns those messages into DOM events.

OAuth 2.0 for apps and merge fields (additive, 2026-10-01). Every /v1 operation also accepts an OAuth access token (Authorization: Bearer swo_at_...) from SignWren's new authorization server: authorization code with PKCE (S256 only), rotating refresh tokens with reuse detection, the API key scopes, a consent screen, revocation (RFC 7009) and metadata at /.well-known/oauth-authorization-server; the spec gains an oauth2 security scheme. POST /templates/{template_id}/envelopes takes merge_fields and merge_from_record and answers with merge (applied, ignored, missing); a required merge field without a value keeps the envelope a draft, and with send: true that is 422 MERGE_FIELDS_MISSING. Templates list their merge fields: merge_fields (names, now filled in) and the new merge_field_mappings. New error code INTEGRATIONS_NOT_CONFIGURED (503).

Action needed: none. Everything in 1.1.0 is additive, so code written for 1.0.0 keeps working unchanged.

1.0.0 (2026-10-01)

First version of the spec (2026-10-01, not live yet). Documents, envelopes, recipients, fields, send, remind, void, the audit trail, downloads of the original documents, the signed PDF and the certificate, and account templates. API keys with scopes and live and sandbox environments, idempotency keys, rate limits and one error model.

Webhooks: endpoints per environment (/webhook-endpoints), events signed with SignWren-Signature (HMAC-SHA256, two signatures during a secret rotation), retries for up to 3 days, a delivery log with resend, a test event, and livemode: false on sandbox events.

Action needed: none. This is where /v1 starts.