Assinafy provides a free electronic signature platform for Brazilian users, allowing online signing of documents with legal validity under ICP‑Brasil standards. The service offers a public, fully documented API for developers to integrate signature workflows into their applications, supports unlimited users per document, customizable branding, and a range of plans for businesses such as software houses, law firms, accountants, SaaS platforms, marketplaces, fintechs, and more.
Assinafy publishes 14 API contracts indexed on the APIs.io network, including Accounts API, Assignments API, Authentication API, and 11 more. Tagged areas include E-Signature, Document Management, Brazil, and Free.
The Assinafy catalog on APIs.io includes 1 event-driven AsyncAPI specification, 1 JSON-LD context, and 1 Spectral governance ruleset.
Assinafy’s developer surface includes CLI, authentication, documentation, API reference, getting-started guide, support, engineering blog, and 27 more developer resources.
Regulatory Posture applies to this provider. Its tags matched the
Horizontal (data, software, accessibility, platform) regime, so
Regulatory Posture carries 15 points of the composite.
If this regime is wrong for your business, say so on your
provider repo — the
applicability map is public and we will correct it.
Create-or-Update Ergonomics could not be measured. We hold no machine-readable contract for
this provider to read, so there is nothing to measure a write surface against. Excluded rather than scored zero:
never-measured and measured-empty are different facts. Publishing an OpenAPI is what makes this facet — and
several others — scorable at all.
The six quality facets above are damped to 85 points between them,
because the conditional facet above carries the other
15. That is why each facet's contribution is shown against a damped
maximum: raising a quality facet moves the composite by 85% of its nominal
weight, not 100%. The full arithmetic is at apis.io/rating/.
Show this score on your site.
It updates itself when the score changes. Paste this where you link to your API docs:
<a href="https://apis.io/providers/assinafy-com-br/"><img src="https://apis.io/badge/assinafy-com-br/card.svg" alt="Assinafy on APIs.io — Kin Score by API Evangelist"></a>
Other styles, a README pill and a shields.io endpoint are on the badge page.
Raise your score.
Agent readiness — checks not met, largest first (exact, from this profile):
MCP Server+12 pts — deployment.mode + probe verdict on the mcp/ manifest, not the pointer; an unprobed slug falls back to authorship
Idempotency+9 pts — OpenAPI mutating operations declare an idempotency key — a header, a request-body property, or a named de-duplication token whose own description says so (verified); else common[].type matches /idempoten/i (documented)
A2A Agent Card+8 pts — a2a/-a2a.yml manifest, graded on conformance.grade against A2A 1.0.0
Documented Reversibility+6 pts — a reversal operation in the contract, graded up when a window is documented too
Agentic Commerce Well-Known Document+5 pts — a parsing /.well-known/ucp.json or acp.json declaring a version and at least one service — `self` when its endpoints are on the provider's own domain, `platform` when they are on a vendor's
2 more unmet checks in the Agent Readiness table above.
Kin Score — facets with the most composite points still available (weight × headroom):
Standards this provider implements or carries. De facto ones are profiled and measured by the API Commons; formal ones come from the standards directory and are linked by the provider's own tags. The evidence column says how each claim was established — not that it was made.
Authentication can be done in three ways: - API key in the `X-Api-Key` header: `X-Api-Key: {api-key}` - Access token in the `Authorization` header: `Authorization: Bearer {acces...
Contract terms tracked on documents: counterparty, value, dates and renewal terms. A contract always belongs to a document of the workspace, and tracking it never changes how th...
The token, revocation and userinfo endpoints an OAuth application calls, and this API's protected-resource metadata. New to OAuth with Assinafy? Read **OAuth Integration Guide**...
This section documents the HTTP request your endpoint receives whenever a subscribed event is triggered, and the shape of the JSON body sent for each event type. ### Delivery co...
Outbound webhook endpoints and delivery history. An account can register **1 webhook endpoint**, or **up to 3** on paid plans. Each endpoint has its own URL, event list and sign...
Overlays applied on top of this provider's contracts. Each card says who wrote it: a document the provider publishes, or one API Evangelist derived or generated.
aid: assinafy-com-br
name: Assinafy
description: Assinafy provides a free electronic signature platform for Brazilian users, allowing online signing of documents
with legal validity under ICP‑Brasil standards. The service offers a public, fully documented API for developers to integrate
signature workflows into their applications, supports unlimited users per document, customizable branding, and a range of
plans for businesses such as software houses, law firms, accountants, SaaS platforms, marketplaces, fintechs, and more.
url: https://artifacts.apis.io/assinafy-com-br/apis.yml
x-type: company
x-source: harvest:mcp-registry
x-tier: profiled
x-tier-reason: enrichment pass 2026-11-01 (modular-v1; was harvest)
accessModel:
pricing: freemium
onboarding: self-serve
trial: false
try_now: true
public: false
gated: none
gated_source:
- onboarding
label: Freemium · Self-serve signup
confidence: high
source:
- plans
- authentication
- rate-limits
- security
generated: '2026-11-02'
method: derived
specificationVersion: '0.20'
created: '2026-11-01'
modified: '2026-11-02'
tags:
- E-Signature
- Document Management
- Brazil
- Free
tags_raw:
- ElectronicSignature
- DocumentManagement
- API
- Brazil
- Free
image: https://www.assinafy.com.br/images/favicon-assetfy/favicon-32x32.png
maintainers:
- FN: Kin Lane
email: kin@apievangelist.com
- FN: APIs.json
email: info@apis.io
common:
- type: AgenticAccess
url: agentic-access/assinafy-com-br-agentic-access.yml
- type: RateLimits
url: rate-limits/assinafy-com-br-rate-limits.yml
- type: Plans
url: plans/assinafy-com-br-plans-pricing.yml
- type: Spectral
url: rules/assinafy-com-br-rules.yml
- type: JSONLD
url: json-ld/assinafy-com-br-context.jsonld
- type: Vocabulary
url: vocabulary/assinafy-com-br-vocabulary.yml
- type: AgentSkill
url: skills/_index.yml
- type: Webhooks
url: asyncapi/assinafy-com-br-webhooks.yml
- type: DataModel
url: data-model/assinafy-com-br-data-model.yml
- type: CLI
url: cli/assinafy-com-br-cli.yml
- type: Conventions
url: conventions/assinafy-com-br-conventions.yml
- type: ErrorCatalog
url: errors/assinafy-com-br-problem-types.yml
- type: Conformance
url: conformance/assinafy-com-br-conformance.yml
- type: LLMsTxt
url: llms/assinafy-com-br-llms.txt
- type: WellKnown
url: well-known/assinafy-com-br-well-known.yml
- type: Hosts
url: hosts/assinafy-com-br-hosts.yml
- type: Vendors
url: vendors/assinafy-com-br-vendors.yml
- type: SDKs
url: packages/assinafy-com-br-packages.yml
- type: Packages
url: packages/assinafy-com-br-packages.yml
- type: GitHubOrganization
url: https://github.com/assinafy
- type: OAuthScopes
url: scopes/assinafy-com-br-scopes.yml
- type: Authentication
url: authentication/assinafy-com-br-authentication.yml
- type: DomainSecurity
url: security/assinafy-com-br-domain-security.yml
- type: Website
url: https://assinafy.com.br/
- type: DeveloperPortal
url: https://www.assinafy.com.br/
- type: Documentation
url: https://www.assinafy.com.br/api
- type: APIReference
url: https://www.assinafy.com.br/api
- type: GettingStarted
url: https://www.assinafy.com.br/cadastro
- type: Support
url: https://www.assinafy.com.br/contato
- type: Blog
url: https://www.assinafy.com.br/blog
- type: Pricing
url: https://www.assinafy.com.br/planos
- type: TermsOfService
url: https://www.assinafy.com.br/termos-de-uso
- type: PrivacyPolicy
url: https://www.assinafy.com.br/politica-de-privacidade
- type: SignUp
url: https://www.assinafy.com.br/cadastro
apis:
- aid: assinafy-com-br:assinafy-com-br-accounts-api
name: Assinafy Accounts API
description: 'Workspace accounts: profile, logo and theme.'
humanURL: https://www.assinafy.com.br/api
baseURL: https://api.assinafy.com.br
tags:
- Account
tags_raw:
- Accounts
properties:
- type: OpenAPI
url: openapi/assinafy-com-br-accounts-api-openapi.yml
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-input-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-amendment-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-signer-identity-review-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-webhook-dispatch-schema.json
- aid: assinafy-com-br:assinafy-com-br-assignments-api
name: Assinafy Assignments API
description: Request signatures on a document and estimate their cost.
humanURL: https://www.assinafy.com.br/api
baseURL: https://api.assinafy.com.br
tags:
- Assignments
properties:
- type: OpenAPI
url: openapi/assinafy-com-br-assignments-api-openapi.yml
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-input-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-amendment-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-signer-identity-review-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-webhook-dispatch-schema.json
- aid: assinafy-com-br:assinafy-com-br-authentication-api
name: Assinafy Authentication API
description: 'Authentication can be done in three ways:
- API key in the `X-Api-Key` header: `X-Api-Key: {api-key}`
- Access token in the `Authorization` header: `Authorization: Bearer {access-token}`
- Access token as a URL parameter: `?access-token={access-token}`
The **recommended** method is an API key, which you create from the settings page in the Assinafy app. An access token
is obtained through login with email and password; it is a JWT that usually expires in one hour.
Building an application that **other people** connect to their own workspace? Don''t ask for their API key: use OAuth,
which gives your app a token limited to what the user approved. See **OAuth Integration Guide**.'
humanURL: https://www.assinafy.com.br/api
baseURL: https://api.assinafy.com.br
tags:
- Authentication
properties:
- type: OpenAPI
url: openapi/assinafy-com-br-authentication-api-openapi.yml
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-input-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-amendment-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-signer-identity-review-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-webhook-dispatch-schema.json
- aid: assinafy-com-br:assinafy-com-br-contracts-api
name: Assinafy Contracts API
description: 'Contract terms tracked on documents: counterparty, value, dates and renewal terms. A contract always belongs
to a document of the workspace, and tracking it never changes how that document is uploaded, sent or signed.
### How the flow works
1. **Have the document first.** Upload it with `POST /v1/accounts/{accountId}/documents`, or pick one already in the workspace,
and keep its `id`. No call creates a document and its contract terms together.
2. **Set its terms.** `PUT /v1/accounts/{accountId}/documents/{documentId}/contract` with the terms. Any time: right after
the upload, while the document is out for signature, or long after it was signed. A contract that ended before it was
tracked is registered as it ended (`expired` with a past `end_date`, or `terminated`). A cancelled, declined or expired
document takes no new terms. If this call fails, the document stays uploaded and the terms can be sent again.
3. **Record a change with a signed instrument** (optional). Upload the amendment, renewal or termination document, then
`PUT` its own `.../contract` with `parent_document_id` (the contract''s document), `relation_type` and the terms it changes.
The change applies to the contract once that document is signed (at once if it already is), and `document_contract_amended`
is recorded.
4. **Let the hourly run keep it current.** Every active contract is walked by the Brasília calendar day: the renewal notice
when the notice period starts, warnings 45 and 30 days before the end date, and, the day after it, the next term for an
auto-renew contract or `expired` for the others. Each records its `document_contract_*` event and e-mails the contract''s
owner. The same run hands the contracts of an owner who left the workspace, however they left, to the first owner still
an active member.
5. **Or change it directly.** `PUT` edits the terms, `POST .../renew` starts the next term and `POST .../terminate` closes
the contract.
6. **Read it.** `GET /v1/accounts/{accountId}/contracts` lists the workspace''s contracts; `GET .../documents/{documentId}/contract`
reads one with its amendments; `GET /v1/documents/{documentId}` says whether a document has one (`has_contract`). Every
change is an event on the document''s activities and a webhook.
### Who can write
Writes need a plan with contract tracking; reads do not. Any active member of the workspace, owner or organizer, may set
terms, link amendments, renew and terminate; an OAuth app needs `documents:write` to write and `documents:read` to read.
### Errors and conflicts
A refused write lists every problem in `errors`, each with its `field` and a stable `code`; the codes and the rules behind
them are in the `400` response. A write that sends the `updated_at` it read is refused with `409` if the contract changed
meanwhile.
### When the plan lapses
While the workspace''s plan lacks contract tracking (its subscription expired or was cancelled; a payment past due inside
the grace period keeps it), the hourly run leaves its contracts as they are and signed amendments wait. The first run
after the plan returns catches up: a contract past its end date moves to the term running that day, on its own renewal
cycle, or expires; waiting amendments apply in signing order; alerts whose window passed meanwhile are not sent.'
humanURL: https://www.assinafy.com.br/api
baseURL: https://api.assinafy.com.br
tags:
- Contracts
properties:
- type: OpenAPI
url: openapi/assinafy-com-br-contracts-api-openapi.yml
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-input-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-amendment-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-signer-identity-review-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-webhook-dispatch-schema.json
- aid: assinafy-com-br:assinafy-com-br-documents-api
name: Assinafy Documents API
description: Create, list, download, tag and delete documents.
humanURL: https://www.assinafy.com.br/api
baseURL: https://api.assinafy.com.br
tags:
- Documents
properties:
- type: OpenAPI
url: openapi/assinafy-com-br-documents-api-openapi.yml
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-input-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-amendment-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-signer-identity-review-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-webhook-dispatch-schema.json
- aid: assinafy-com-br:assinafy-com-br-fields-api
name: Assinafy Fields API
description: Reusable field definitions used on templates and assignments.
humanURL: https://www.assinafy.com.br/api
baseURL: https://api.assinafy.com.br
tags:
- Fields
properties:
- type: OpenAPI
url: openapi/assinafy-com-br-fields-api-openapi.yml
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-input-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-amendment-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-signer-identity-review-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-webhook-dispatch-schema.json
- aid: assinafy-com-br:assinafy-com-br-oauth-api
name: Assinafy OAuth API
description: 'The token, revocation and userinfo endpoints an OAuth application calls, and this API''s protected-resource
metadata. New to OAuth with Assinafy? Read **OAuth Integration Guide** first. The authorization server''s own metadata
is served at `https://auth.assinafy.com.br/.well-known/oauth-authorization-server`, not on this API: read endpoint URLs
from it instead of hardcoding them.'
humanURL: https://www.assinafy.com.br/api
baseURL: https://api.assinafy.com.br
tags:
- OAuth
properties:
- type: OpenAPI
url: openapi/assinafy-com-br-oauth-api-openapi.yml
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-input-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-amendment-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-signer-identity-review-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-webhook-dispatch-schema.json
- aid: assinafy-com-br:assinafy-com-br-signers-api
name: Assinafy Signers API
description: Manage the signing parties of a workspace.
humanURL: https://www.assinafy.com.br/api
baseURL: https://api.assinafy.com.br
tags:
- Signers
properties:
- type: OpenAPI
url: openapi/assinafy-com-br-signers-api-openapi.yml
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-input-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-amendment-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-signer-identity-review-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-webhook-dispatch-schema.json
- aid: assinafy-com-br:assinafy-com-br-signing-api
name: Assinafy Signing API
description: 'Signer-facing endpoints: view, sign and decline documents using a signer access code.'
humanURL: https://www.assinafy.com.br/api
baseURL: https://api.assinafy.com.br
tags:
- Signing
properties:
- type: OpenAPI
url: openapi/assinafy-com-br-signing-api-openapi.yml
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-input-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-amendment-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-signer-identity-review-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-webhook-dispatch-schema.json
- aid: assinafy-com-br:assinafy-com-br-tags-api
name: Assinafy Tags API
description: Workspace-scoped labels attachable to documents and templates.
humanURL: https://www.assinafy.com.br/api
baseURL: https://api.assinafy.com.br
tags:
- Tags
properties:
- type: OpenAPI
url: openapi/assinafy-com-br-tags-api-openapi.yml
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-input-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-amendment-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-signer-identity-review-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-webhook-dispatch-schema.json
- aid: assinafy-com-br:assinafy-com-br-templates-api
name: Assinafy Templates API
description: Reusable document templates, their roles, fields and tags.
humanURL: https://www.assinafy.com.br/api
baseURL: https://api.assinafy.com.br
tags:
- Templates
properties:
- type: OpenAPI
url: openapi/assinafy-com-br-templates-api-openapi.yml
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-input-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-amendment-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-signer-identity-review-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-webhook-dispatch-schema.json
- aid: assinafy-com-br:assinafy-com-br-users-api
name: Assinafy Users API
description: User account endpoints.
humanURL: https://www.assinafy.com.br/api
baseURL: https://api.assinafy.com.br
tags:
- User
tags_raw:
- Users
properties:
- type: OpenAPI
url: openapi/assinafy-com-br-users-api-openapi.yml
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-input-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-amendment-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-signer-identity-review-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-webhook-dispatch-schema.json
- aid: assinafy-com-br:assinafy-com-br-webhook-payloads-api
name: Assinafy Webhook Payloads API
description: "This section documents the HTTP request your endpoint receives whenever a subscribed event is triggered, and\
\ the shape of the JSON body sent for each event type.\n\n### Delivery contract\n\nWhen an event occurs, we send an HTTP\
\ `POST` request to every active webhook endpoint subscribed to that event. Each endpoint is delivered to independently:\
\ a slow or failing endpoint does not delay the others, and each has its own failure count.\n\n| Property | Value |\n\
|----------|-------|\n| Method | `POST` |\n| Content-Type | `application/json` |\n| Connection header | `close` |\n| `webhook-id`\
\ header | Message ID, identical on every attempt of the same event to the same endpoint. Use it to deduplicate. |\n|\
\ `webhook-timestamp` header | Unix timestamp (seconds) of the attempt. |\n| `webhook-signature` header | Only when signing\
\ is enabled on the endpoint. See **Verifying signatures**. |\n| Success criteria | Any `2xx` response |\n| `User-Agent`\
\ header | `Assinafy-Webhooks/1.0` |\n| Attempts | Up to 6 per event, about 10 minutes apart. A connection error, a timeout,\
\ a `408`, a `429` or a `5xx` is retried; any other status is final. |\n| Pause | After 10 failed deliveries in a row\
\ the endpoint is paused (`is_held` on the endpoint): nothing is sent to it, and we probe it with the oldest event it\
\ missed after 3 minutes, then 15, then 60, then every 6 hours. The probe that gets through lifts the pause and the events\
\ it missed are delivered oldest first. Editing the endpoint's URL, or sending `is_active: true`, lifts the pause too.\
\ |\n| Retry endpoint | **Retry webhook delivery** sends one delivery now, even while the endpoint is paused; a delivery\
\ that gets through lifts the pause. |\n| Response capture | We store the first 2000 characters of your response body\
\ for debugging (see **List webhook deliveries**). Delivery entries are kept for 7 days. |\n\nYour endpoint must respond\
\ within a reasonable time and return a `2xx` status. Non-`2xx` responses, connection errors and timeouts are all failed\
\ deliveries and count toward the pause; each delivery entry says whether another attempt follows (`will_retry`).\n\n\
### Verifying signatures\n\nEnable signing on an endpoint (`signing_enabled: true`) and every delivery carries a signature\
\ that proves it came from us and was not altered or replayed. Signatures follow the [Standard Webhooks](https://www.standardwebhooks.com)\
\ specification, so any Standard Webhooks library can verify them; the secret is returned once, as `secret`, in the **Create\
\ webhook endpoint** response, and can be read again with **Get webhook endpoint signing secret**. OAuth applications\
\ cannot call that endpoint: store the secret from the create response, and if it is lost, get a new one with **Rotate\
\ webhook endpoint signing secret**. Turning signing on with **Update webhook endpoint** also returns the new secret once.\n\
\nTo verify by hand:\n\n1. Take the **raw** request body, exactly as received (do not re-serialize the parsed JSON).\n\
2. Build the signed content `{webhook-id}.{webhook-timestamp}.{body}`.\n3. Base64-decode the part of the secret after\
\ the `whsec_` prefix and compute the HMAC-SHA256 of the signed content with it. Base64-encode the result.\n4. `webhook-signature`\
\ holds one or more space-separated `v1,<signature>` entries; accept the request if any of them equals your value (use\
\ a constant-time comparison).\n5. Reject requests whose `webhook-timestamp` is more than a few minutes away from your\
\ clock, to prevent replays.\n\n```php\n$secret = base64_decode(substr($endpointSecret, strlen('whsec_')));\n$signedContent\
\ = $headers['webhook-id'] . '.' . $headers['webhook-timestamp'] . '.' . $rawBody;\n$expected = 'v1,' . base64_encode(hash_hmac('sha256',\
\ $signedContent, $secret, true));\n\n$valid = false;\nforeach (explode(' ', $headers['webhook-signature']) as $signature)\
\ {\n $valid = $valid || hash_equals($expected, $signature);\n}\n$fresh = abs(time() - (int) $headers['webhook-timestamp'])\
\ <= 300;\n```\n\nRotating the secret (**Rotate webhook endpoint signing secret**) takes effect immediately: deliveries\
\ sent after the rotation are signed only with the new secret.\n\n### Common envelope\n\nEvery webhook body shares the\
\ same top-level structure:\n\n| Field | Type | Description |\n|-------|------|-------------|\n| `id` | integer | Internal\
\ activity ID that produced this event. To deduplicate retries, prefer the `webhook-id` header, which also tells deliveries\
\ of the same event to different endpoints apart. |\n| `event` | string | Event type identifier. See the catalog below\
\ and the **List webhook event types** endpoint. |\n| `message` | string \\\\| null | Human-readable message describing\
\ the event. May contain token placeholders. Can be `null`. |\n| `payload` | object \\\\| null | Event-specific parameters.\
\ Keys vary per event — see the catalog. Can be `null`. |\n| `origin` | object \\\\| null | Where the action was triggered\
\ from, when available: `{ ip, user-agent }`. |\n| `created_at` | integer | Unix timestamp (seconds) when the event was\
\ recorded. |\n| `subject` | object | The entity that performed the action. Polymorphic — see below. |\n| `object` | object\
\ | The entity the action was performed on. Polymorphic — see below. |\n| `account_id` | string | The ID of the account\
\ that owns this event. Always present. |\n\n### About `subject` and `object`\n\nBoth are **polymorphic**: their shape\
\ depends on which entity they represent. We always add a `type` property with the entity class name, one of `User`, `Signer`,\
\ `Account`, `Document`, or `Template`. The remaining properties match the same fields the REST API returns for that resource.\
\ The `object` is serialized with its extra relationships expanded (e.g. a `Document` includes `assignment` and `pages`);\
\ the `subject` carries its base fields only. Whenever `subject` or `object` is an `Account`, the `integration` property\
\ (which includes dispatch history) is removed before sending.\n\nFor `document_ready`, `document_processing_failed` and\
\ `template_processing_failed`, the `subject` is the `Account` itself — these events are emitted by the system when processing\
\ finishes, not by a particular user.\n\n### Event catalog\n\nEach event also has its own entry under **Webhooks** with\
\ a complete example body.\n\n| Event | Subject | Object | `payload` keys | Description |\n|-------|---------|--------|----------------|-------------|\n\
| `document_uploaded` | User | Document | — | The user uploaded a new document. |\n| `document_metadata_ready` | User\
\ | Document | — | The document was normalized to PDF and its pages are available. |\n| `document_prepared` | User | Document\
\ | — | The user prepared a document (fields assigned to signers). |\n| `assignment_created` | User | Document | `user_name`,\
\ `user_email`, `user_telephone` | The user created an assignment for the document. Includes a snapshot of the creator\
\ profile. |\n| `document_ready` | Account | Document | — | The document was certificated after every signer signed (and,\
\ when a signer's identity was under review, after the account approved it). |\n| `document_processing_failed` | Account\
\ | Document | `error_message` | The document could not be processed. |\n| `signature_requested` | User | Document | `signer_full_name`,\
\ `signer_email`, `signer_whatsapp_phone_number`, `notification_method` | The user requested a signer to sign the document.\
\ |\n| `signer_created` | User | Signer | `signer_full_name` | The user created a new signer. |\n| `signer_email_verified`\
\ | Signer | Document | `signer_full_name`, `signer_email` | The signer's email was verified through a code linked to\
\ the document. |\n| `signer_whatsapp_verified` | Signer | Document | `signer_full_name`, `signer_whatsapp_phone_number`\
\ | The signer's WhatsApp number was verified through a code linked to the document. |\n| `signer_data_confirmed` | Signer\
\ | Document | `signer_full_name`, `signer_email`, `signer_whatsapp_phone_number`, `verification_method` | The signer\
\ confirmed their data before signing. |\n| `signer_viewed_document` | Signer | Document | `signer_full_name` | The signer\
\ opened the document for the first time. |\n| `signer_identity_verified` | Signer | Document | `signer_full_name`, `evidence`\
\ (when available) | The signer passed identity-document verification, directly or after the account's review. |\n| `signer_identity_verification_failed`\
\ | Signer | Document | `signer_full_name`, `reason` | The identity-document verification ended without approval. |\n\
| `signer_identity_review_required` | Signer | Document | `signer_full_name`, `reason_codes` | The verification awaits\
\ the account's review. The signer can still sign; the document is certificated only after the account approves (status\
\ `pending_identity_review` once every signer has signed). |\n| `signer_identity_review_approved` | Signer | Document\
\ | `signer_full_name`, `reviewer_id`, `reviewer_name`, `reason_codes` | A user of the account approved the signer's identity\
\ after review. |\n| `signer_identity_review_rejected` | Signer | Document | `signer_full_name`, `reviewer_id`, `reviewer_name`,\
\ `note` | A user of the account rejected the signer's identity after review. The document is cancelled; `user_rejected_document`\
\ follows. |\n| `signer_signed_document` | Signer | Document | `signer_full_name` | The signer signed the document. |\n\
| `signer_rejected_document` | Signer | Document | `signer_full_name` | The signer refused to sign the document. |\n|\
\ `user_rejected_document` | User | Document | `user_name` | The document was cancelled by a user of the account. |\n\
| `template_created` | User | Template | — | The user created a new template. |\n| `template_processed` | User | Template\
\ | — | A template's metadata was processed and is ready for use. |\n| `template_processing_failed` | Account | Template\
\ | `error_message` | A template could not be processed. |\n\n`assignment_created` and `document_metadata_ready` have\
\ no guaranteed ordering: under the virtual pre-metadata flow, `assignment_created` may fire before `document_metadata_ready`.\
\ Treat any unknown field as a forward-compatible addition."
humanURL: https://www.assinafy.com.br/api
baseURL: https://api.assinafy.com.br
tags:
- Webhook Payloads
properties:
- type: OpenAPI
url: openapi/assinafy-com-br-webhook-payloads-api-openapi.yml
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-input-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-amendment-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-signer-identity-review-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-webhook-dispatch-schema.json
- aid: assinafy-com-br:assinafy-com-br-webhooks-api
name: Assinafy Webhooks API
description: 'Outbound webhook endpoints and delivery history.
An account can register **1 webhook endpoint**, or **up to 3** on paid plans. Each endpoint has its own URL, event list
and signing setting, and every active endpoint subscribed to an event receives it. Manage them with the **webhook endpoint**
operations; the older `/webhooks/subscriptions` operations still work and act on the account''s oldest endpoint.'
humanURL: https://www.assinafy.com.br/api
baseURL: https://api.assinafy.com.br
tags:
- Webhook
tags_raw:
- Webhooks
properties:
- type: OpenAPI
url: openapi/assinafy-com-br-webhooks-api-openapi.yml
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-input-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-amendment-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-signer-identity-review-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-document-contract-schema.json
- type: JSONSchema
url: json-schema/assinafy-com-br-webhook-dispatch-schema.json
x-enrichment:
date: '2026-11-01'
status: enriched
artifacts_added: 37
pass: modular-v1
engine: identity=oss,contract=oss,surfaces=oss,docs=oss,regulatory=oss
Assinafy API — frequently asked questions
Does Assinafy have an API?
Yes. APIs.io lists 14 APIs from Assinafy, including Assinafy Accounts API, Assinafy Assignments API and Assinafy Authentication API, and 11 more.
Is there an OpenAPI specification for the Assinafy API?
Yes. APIs.io indexes 14 OpenAPI specifications for Assinafy, each linked for download from this page.
How do I authenticate with the Assinafy API?
Assinafy documents its authentication (apiKey/http/oauth2 · 4 schemes). The details are profiled on APIs.io as Assinafy Com Br Authentication.
How much does the Assinafy API cost?
APIs.io lists 4 pricing plans for Assinafy, with each plan's price, limits and inclusions under Pricing Plans on this page.
Is the Assinafy API ready for AI agents?
Assinafy has a Kin Score of 64.1 out of 100 (strong) and an Agent Readiness score of 46.5 (agent-ready), scored by API Evangelist on 2026-11-02.
Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we
store it to create your key and to recognise you if you sign in with another
provider. See our Privacy Policy and
Terms.
Kin Score
How this is scored →
It updates itself when the score changes. Paste this where you link to your API docs: