APISign API Keys API

openapi: 3.2.0
info:
  title: Sign API Keys API
  description: 'Programmatically create, send, and manage contracts for e-signatures. Contracts are created as drafts and charged when sent ($0.25 per send at the default price; test-mode sends are free). Errors return `{ "error": string }`; request validation errors add a `details` array. API key requests are not rate limited.'
  version: 1.0.0
  contact:
    name: API Sign Support
    url: https://apisign.io
servers:
- url: https://apisign.io/api
  description: Production
security:
- ApiKeyAuth: []
tags:
- name: API Keys
  description: Manage API keys
paths:
  /apikey/create:
    post:
      summary: Create an API key
      description: Create an API key. The raw key is returned only in this response.
      operationId: createApiKey
      tags:
      - API Keys
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - name
              properties:
                name:
                  type: string
                  minLength: 1
                  maxLength: 100
                permission:
                  $ref: '#/components/schemas/ApiKeyPermission'
                expiresInDays:
                  type: number
                  description: Days until the key expires. Omit for no expiry.
      responses:
        '200':
          description: Key created
          content:
            application/json:
              schema:
                type: object
                properties:
                  apiKey:
                    allOf:
                    - $ref: '#/components/schemas/ApiKey'
                    - type: object
                      properties:
                        key:
                          type: string
                          description: The raw API key (starts with `ask_`). Shown only once.
                  message:
                    type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/ServerError'
  /apikey/list:
    get:
      summary: List API keys
      description: List the organization's API keys, newest first. Raw keys are never returned.
      operationId: listApiKeys
      tags:
      - API Keys
      responses:
        '200':
          description: Keys
          content:
            application/json:
              schema:
                type: object
                properties:
                  apiKeys:
                    type: array
                    items:
                      allOf:
                      - $ref: '#/components/schemas/ApiKey'
                      - type: object
                        properties:
                          lastRequest:
                            type:
                            - string
                            - 'null'
                            format: date-time
                          requestCount:
                            type: integer
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/ServerError'
  /apikey/delete:
    post:
      summary: Delete an API key
      description: Permanently delete an API key.
      operationId: deleteApiKey
      tags:
      - API Keys
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - keyId
              properties:
                keyId:
                  type: string
                  description: API key ID
      responses:
        '200':
          description: Key deleted
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  message:
                    type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
components:
  schemas:
    ApiKeyPermission:
      type: string
      enum:
      - read
      - read_write
      default: read_write
      description: Applies to the MCP server only; REST endpoints do not check it
    Error:
      type: object
      required:
      - error
      properties:
        error:
          type: string
          description: Error message
        details:
          type: array
          description: Present on request validation errors
          items:
            type: object
            properties:
              field:
                type: string
                description: Dot path of the invalid field
              message:
                type: string
    ApiKey:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        start:
          type: string
          description: First 8 characters of the key
        permission:
          $ref: '#/components/schemas/ApiKeyPermission'
        enabled:
          type: boolean
        expiresAt:
          type:
          - string
          - 'null'
          format: date-time
        createdAt:
          type: string
          format: date-time
  responses:
    ServerError:
      description: Internal server error (also returned for a request body that is not valid JSON)
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    BadRequest:
      description: Invalid request, or the action is not allowed in the resource's current state
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Unauthorized:
      description: 'Missing, invalid, expired or deleted API key. Body: `{ "error": "Unauthorized" }`'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    NotFound:
      description: Resource not found in this organization
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key
      description: API key from the dashboard (Account → MCP & API Keys). Keys start with `ask_`. A key's `read`/`read_write` permission applies only to the MCP server; REST endpoints do not check it.