Assinafy Users API

openapi: 3.2.0
info:
  title: Assinafy Com Br Users API
  version: 1.0.0
  description: 'Operations tagged Users across 2 of this provider''s published API definitions: assinafy-com-br-openapi.json, assinafy-com-br-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.assinafy.com.br
  description: Production
- url: https://sandbox.assinafy.com.br
  description: Sandbox
tags:
- name: Users
  description: User account endpoints.
paths:
  /v1/users/self/notification-preferences:
    get:
      tags:
      - Users
      summary: Get my notification preferences
      description: 'Which owner-facing document notifications the authenticated user receives by e-mail. All thirteen keys are always returned; everything defaults to `true`. Account and security e-mail (welcome, password reset, invitations, account deletion) is not configurable and never appears here. Not available to third-party OAuth applications (`403`), whatever their scopes: these are the user''s personal settings. Assinafy''s own apps can reach it.


        Copy as Markdown Open in ChatGPT Open in Claude'
      operationId: d51841b1f067607aec5746058815cd28
      responses:
        '200':
          description: The current preferences
          content:
            application/json:
              schema:
                type: object
                allOf:
                - $ref: '#/components/schemas/Envelope'
                - properties:
                    data:
                      $ref: '#/components/schemas/NotificationPreferences'
                  type: object
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/ServerError'
      security:
      - bearerAuth: []
      - apiKeyAuth: []
    put:
      tags:
      - Users
      summary: Update my notification preferences
      description: 'Merges the supplied map into the authenticated user''s preferences. Send only the keys you want to change — omitted keys keep their current value. Setting a key to `false` stops that e-mail for this user in every account they belong to. Returns the full map. An unknown code, a non-boolean value, or an empty body is rejected with 400 and nothing is written. Not available to third-party OAuth applications (`403`), whatever their scopes: these are the user''s personal settings. Assinafy''s own apps can reach it.


        Copy as Markdown Open in ChatGPT Open in Claude'
      operationId: 12356f56a66792b8a3e54010a1d4639f
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/NotificationPreferences'
      responses:
        '200':
          description: The updated preferences
          content:
            application/json:
              schema:
                type: object
                allOf:
                - $ref: '#/components/schemas/Envelope'
                - properties:
                    data:
                      $ref: '#/components/schemas/NotificationPreferences'
                  type: object
        '400':
          $ref: '#/components/responses/ValidationError'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/ServerError'
      security:
      - bearerAuth: []
      - apiKeyAuth: []
    servers:
    - url: https://api.assinafy.com.br
      description: Production
    - url: https://sandbox.assinafy.com.br
      description: Sandbox
  /v1/users/self/stats:
    get:
      tags:
      - Users
      summary: My cross-account document KPIs
      description: 'The authenticated user''s document-funnel KPIs summed across all accounts they currently belong to. `granularity=monthly` (default) returns the last 12 months, most recent first; `granularity=daily` with `month=YYYY-MM` returns that month''s days. Series are zero-filled. Not available to OAuth access tokens (`403`): a token is bound to one workspace, so an OAuth app reads that workspace''s figures from **Account document KPIs** instead.


        Copy as Markdown Open in ChatGPT Open in Claude'
      operationId: 3244687bf958f0d655d5ea992b592c1c
      parameters:
      - name: granularity
        in: query
        description: '`monthly` (default) or `daily`.'
        schema:
          type: string
          enum:
          - monthly
          - daily
      - name: month
        in: query
        description: Target month `YYYY-MM` (required when `granularity=daily`).
        schema:
          type: string
          example: 2026-06
      responses:
        '200':
          description: KPI series
          content:
            application/json:
              schema:
                type: object
                allOf:
                - $ref: '#/components/schemas/Envelope'
                - properties:
                    data:
                      type: array
                      items:
                        $ref: '#/components/schemas/DocumentStatsRow'
                  type: object
        '400':
          $ref: '#/components/responses/ValidationError'
          description: Invalid month
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/ServerError'
      security:
      - bearerAuth: []
      - apiKeyAuth: []
    servers:
    - url: https://api.assinafy.com.br
      description: Production
    - url: https://sandbox.assinafy.com.br
      description: Sandbox
  /v1/users/self:
    get:
      tags:
      - Users
      summary: Get the authenticated user
      description: 'Returns the profile of the user owning the access token. Not available to OAuth access tokens (`403`); an OAuth app reads the user''s identity from `GET /v1/oauth/userinfo`.


        Copy as Markdown Open in ChatGPT Open in Claude'
      operationId: 072ee2a4df4601447e3e35ab26f528fa
      responses:
        '200':
          description: The current user
          content:
            application/json:
              schema:
                type: object
                allOf:
                - $ref: '#/components/schemas/Envelope'
                - properties:
                    data:
                      $ref: '#/components/schemas/AuthUser'
                  type: object
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/ServerError'
      security:
      - bearerAuth: []
      - apiKeyAuth: []
    servers:
    - url: https://api.assinafy.com.br
      description: Production
    - url: https://sandbox.assinafy.com.br
      description: Sandbox
components:
  schemas:
    NotificationPreferences:
      description: Owner-facing document notifications, keyed by notification type. `true` means the e-mail is sent.
      properties:
        DocumentCompleted:
          description: Every signer has signed and the document is certified.
          type: boolean
          example: true
        SignerDeclined:
          description: A signer declined to sign.
          type: boolean
          example: true
        DocumentCancelled:
          description: The document was cancelled.
          type: boolean
          example: true
        DocumentAboutToExpire:
          description: The signature deadline is approaching.
          type: boolean
          example: true
        DocumentExpired:
          description: The signature deadline passed.
          type: boolean
          example: true
        DocumentExpirationReset:
          description: The signature deadline was extended.
          type: boolean
          example: true
        DocumentProcessingFailed:
          description: An uploaded document could not be processed.
          type: boolean
          example: true
        TemplateProcessingFailed:
          description: A template could not be processed.
          type: boolean
          example: true
        SignerWhatsappFailed:
          description: A WhatsApp notification to a signer could not be delivered.
          type: boolean
          example: true
        ContractRenewalNotice:
          description: 'A tracked contract entered its notice period: it is about to end or to renew.'
          type: boolean
          example: true
        ContractExpiring:
          description: A tracked contract ends in 45 or in 30 days.
          type: boolean
          example: true
        ContractExpired:
          description: A tracked contract ended without renewal.
          type: boolean
          example: true
        ContractRenewed:
          description: A tracked contract was auto-renewed into its next term.
          type: boolean
          example: true
      type: object
    DocumentStatsRow:
      description: 'One period of the document-funnel KPI series. `period` is `YYYY-MM` (monthly) or `YYYY-MM-DD` (daily); series are zero-filled, no gaps. Signature requests come with two independent breakdowns: the `signature_requests_notification_*` counters split them by the channels the signer was notified on — a signer reached on more than one channel counts once per channel, so these add up to at least `signature_requests` — while the `signature_requests_verification_*` counters split them by how the signer''s identity is verified, and since each request has exactly one verification method those four always add up to `signature_requests`.'
      properties:
        period:
          description: '`YYYY-MM` (monthly) or `YYYY-MM-DD` (daily).'
          type: string
          example: 2026-06
        documents_uploaded:
          type: integer
          example: 42
        documents_sent:
          type: integer
          example: 37
        signature_requests:
          type: integer
          example: 61
        signature_requests_notification_email:
          description: Requests notified by e-mail.
          type: integer
          example: 55
        signature_requests_notification_whatsapp:
          description: Requests notified by WhatsApp.
          type: integer
          example: 18
        signature_requests_notification_bypass:
          description: Requests with no notification sent (`Bypass`).
          type: integer
          example: 3
        signature_requests_verification_email:
          description: Requests verified by an e-mail token.
          type: integer
          example: 48
        signature_requests_verification_whatsapp:
          description: Requests verified by a WhatsApp token.
          type: integer
          example: 6
        signature_requests_verification_bypass:
          description: Requests signed without token verification (`Bypass`).
          type: integer
          example: 3
        signature_requests_verification_digital_certificate:
          description: Requests signed with the signer's own ICP-Brasil digital certificate.
          type: integer
          example: 4
        signature_requests_viewed:
          description: Signature requests whose document was first viewed during the period.
          type: integer
          example: 44
        signature_requests_completed:
          description: Signature requests completed by individual signers during the period.
          type: integer
          example: 52
        documents_certified:
          type: integer
          example: 30
      type: object
    AuthUser:
      properties:
        id:
          type: string
          example: bgjazeo5r9v2lq7l36dx48np
        name:
          type: string
          example: John Smith
        email:
          type: string
          format: email
          example: example@example.com
        telephone:
          type:
          - string
          - 'null'
          example: '17989206641'
        government_id:
          type:
          - string
          - 'null'
          example: '15774136604'
        is_email_verified:
          type: boolean
          example: false
        has_accepted_terms:
          type: boolean
          example: true
        created_at:
          type: string
          format: date-time
          example: '2023-03-03T11:51:34Z'
        to_be_deleted_at:
          type:
          - string
          - 'null'
          format: date-time
          example: null
      type: object
    Envelope:
      description: Standard success wrapper. Operations add their own `data`.
      properties:
        status:
          description: HTTP status code, mirrored in the body.
          type: integer
          example: 200
        message:
          description: Human-readable message; empty on success.
          type: string
          example: ''
      type: object
    ErrorEnvelope:
      description: Standard error wrapper. `status` mirrors the HTTP status code.
      properties:
        status:
          type: integer
          example: 400
        message:
          description: Human-readable error message.
          type: string
          example: Bad request.
        data:
          type:
          - object
          - 'null'
          example: null
      type: object
  responses:
    Unauthorized:
      description: Missing or invalid credentials.
      content:
        application/json:
          schema:
            type: object
            allOf:
            - $ref: '#/components/schemas/ErrorEnvelope'
            - properties:
                status:
                  type: integer
                  example: 401
                message:
                  type: string
                  example: Your request was made with invalid credentials.
              type: object
    ValidationError:
      description: One or more fields failed validation.
      content:
        application/json:
          schema:
            type: object
            allOf:
            - $ref: '#/components/schemas/ErrorEnvelope'
            - properties:
                status:
                  type: integer
                  example: 422
                message:
                  type: string
                  example: One or more fields failed validation.
              type: object
    ServerError:
      description: Unexpected server error.
      content:
        application/json:
          schema:
            type: object
            allOf:
            - $ref: '#/components/schemas/ErrorEnvelope'
            - properties:
                status:
                  type: integer
                  example: 500
                message:
                  type: string
                  example: An unexpected error occurred.
              type: object
  securitySchemes:
    bearerAuth:
      type: http
      description: 'Access token: `Authorization: Bearer {access_token}`.'
      bearerFormat: JWT
      scheme: bearer
    apiKeyAuth:
      type: apiKey
      description: Permanent API key (recommended for back-end integrations).
      name: X-Api-Key
      in: header
    signerAccessCode:
      type: apiKey
      description: 'Signer access code used by signer-facing (Signing) endpoints instead of a user token: the code in the signer''s signing link, sent as the `signer-access-code` query or body parameter. It can be used again and has no expiry; it stops working when the signing request is removed. Treat it as a secret.'
      name: signer-access-code
      in: query
    oauth2:
      type: oauth2
      description: 'OAuth 2.1 authorization code flow with mandatory PKCE (S256), for applications and AI assistants acting in a user''s workspace with that user''s permission — as opposed to `apiKeyAuth`/`bearerAuth`, which authenticate the workspace or user directly. A token carries only the scopes the user approved and works for one workspace. Endpoints are published by the authorization server at `https://auth.assinafy.com.br/.well-known/oauth-authorization-server`. An OAuth token cannot reach billing, account lifecycle, credential management or admin surfaces regardless of scope. A missing scope answers `403` with `WWW-Authenticate: Bearer error="insufficient_scope"` naming it. See **OAuth Integration Guide** for the full flow.'
      flows:
        authorizationCode:
          authorizationUrl: https://auth.assinafy.com.br/oauth/authorize
          tokenUrl: https://api.assinafy.com.br/v1/oauth/token
          refreshUrl: https://api.assinafy.com.br/v1/oauth/token
          scopes:
            documents:read: Read documents, their pages, tags, signers, assignments and activity, and the WhatsApp notifications sent for an assignment.
            documents:write: Create, update and delete documents, and manage their signers, assignments and activity.
            templates:read: Read reusable document templates, their pages, roles, fields and tags.
            templates:write: Create, update and delete templates, their pages, roles, fields and tags.
            account:read: Read the workspace's profile, theme and logo.
            webhooks:write: Change the workspace's webhook subscription (delivery URL, events, contact email), deactivate it, manage webhook endpoints and re-send a delivery.
            openid: Identify the authenticated user (OpenID Connect `sub` claim) and enable the `/v1/oauth/userinfo` endpoint.
            profile: Include the user's name in the `id_token`/userinfo claims.
            email: Include the user's email and its verification status in the `id_token`/userinfo claims.
            offline_access: Request a refresh token, so the app keeps working after the user's session expires without prompting them again. Only granted to a client that explicitly asks for it.
x-refined-from:
- assinafy-com-br-openapi.json
- assinafy-com-br-openapi.json