Simplifi Platform API

Two ways to plug in

One API, two principals. Pick the one that fits each call, or combine them in the same integration.

Send for signature User automation

Send for signature

You send the document. The recipient signs it with their own account.

The simplest path. Your software uploads a PDF, adds the signers and sends. Each counterparty signs on the Simplifi platform with their own account and their own qualified certificate. You collect the executed PDF. No enrollment, no certificate management on your side. Find it in the API reference under Send for signature (its product name is Sign with Simplifi).

Acts as your company (service account)
Auth client_credentials access token
Signer needs a Simplifi account (full, guest or sponsored)
Signing happens on the Simplifi platform (redirect)
Best for contracts, HR packs, anything countersigned

Create the document POST /publicapi/v1/documents with your PDF
Add signers and boxes Place signature annotations where ink should land
Send Redirect each signer to the returned signing_url
They sign on Simplifi Their account, their qualified certificate
Download the signed PDF Track progress via webhooks or polling

User automation

Your software acts as one of your own users, with their consent.

Back-office automation on a real user's account. A person at your company who already has a Simplifi account and a qualified certificate authorizes your application once via OAuth. Your software then holds an offline token for them and drives their normal document workflows machine-to-machine, including signing with the user's own certificate by supplying their current authenticator (TOTP) code.

Acts as an individual user
Auth OAuth offline token (device grant or PKCE)
Signer needs their own qualified certificate
Signing happens in your software (user's TOTP code)
Best for bulk sending, archiving, in-house tooling

User consents once OAuth device grant or browser flow with PKCE
Store the offline token Exchange it for short-lived access tokens
Automate their workflows Documents, groups, retention: the user's normal API
Sign with their certificate Supply the user's current TOTP code per signature

Your first call

From zero to an authenticated request in three steps. No sandbox sign-up, no approval queue.

Create your API client
A company admin opens API Settings in the Simplifi app and creates the client. You get your oauth_client_id and client_secret on the spot.

Get an access token

Standard OAuth2 client_credentials against our identity server.

curl -X POST https://auth.simplifi.ro/realms/Simplifi/protocol/openid-connect/token \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_SECRET"

Create your first document

Upload a PDF and get back its uuid. From here: add signers, place the signature boxes and send. The reference covers each step.

curl -X POST https://api.simplifi.ro/publicapi/v1/documents \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "First contract",
    "signature_level": "QUALIFIED",
    "pdf_base64": "'"$(base64 -w0 contract.pdf)"'"
  }'

Already on Simplifi? The developer portal in the app has a personalized Postman environment, code samples and the full dev pack.

Webhooks that tell you everything

For company (send-for-signature) integrations: configure endpoints in API Settings and Simplifi calls you back. Every delivery is signed, so you can verify it came from us.

Document lifecycle

Fired for every document your company integration creates through the API, as each signer acts and the document completes or gets rejected.

document.signer.signed document.completed document.rejected

Balance alerts and delivery checks

Know before credits run dry, and test your endpoint wiring with one API call. Every payload carries an X-Simplifi-Signature: sha256={hmac} header (HMAC-SHA256 of the raw body with your endpoint's signing secret).

allowance.low allowance.exhausted webhook.test

Verify deliveries with ready-made code: PHP · Node.js · Python

Good to know

The operational fine print, stated upfront.

Rate limits

Budgets are per API identity, never per IP address, so shared office NAT or cloud egress does not throttle you. Every authenticated response reports your current budget in headers, and going over returns 429 with a Retry-After. Pace yourself off RateLimit-Remaining and you will never see one. Integration tokens get 1800 requests a minute, end-user tokens 600, and a heavy integrator's ceiling can be raised per client on request.

RateLimit-Limit RateLimit-Remaining RateLimit-Reset

Versioning

The API is path-versioned: everything documented here lives under /publicapi/v1. Changes within v1 are additive: new endpoints, new optional fields, new webhook event types. Build clients that ignore unknown fields and they will not break. Anything incompatible ships as a new version path with a migration window, and deprecations are announced in the API reference before they take effect.

/publicapi/v1

Need more?

Embedded Signing: the whole flow, inside your product.

Identity verification, qualified certificate issuance and PDF signing entirely within your own product. Your signers never need a Simplifi account. A deeper partner integration, available on application.

Talk to us

Qualified e-signatures,from your code.