Simplifi Developers
Platform API

E-signatures,
from your code.

One call sends a document and returns a signing link per signer. How each of them signs is your choice per signer: a simple signature, a one-shot eIDAS qualified certificate, or their own certificate. Create a key and make your first call in minutes.

Open the API reference Download the OpenAPI 3.1 spec

OAuth2 authentication. JSON in, JSON out. OpenAPI 3.1 spec.

0 € API fee

No platform fee, no subscription, no sales call. The API is on for every Simplifi company account, and it stays free.

Full self-service

A company admin creates the API client in API Settings and gets the credentials on the spot. Nothing to apply for, nobody to wait on.

Same cost as the app

API usage draws from the same credits as your regular account, at the same prices: envelopes, signature packs, one-sided documents. No API premium, no surprise invoice; if a balance runs out you get a stable insufficient_*_balance error.

One call to send. Two decisions.

You make one API call. Everything else is two decisions you take per request: who runs the signing process, and how each signer signs.

The one call

Send a document

POST /publicapi/v1/send-document uploads the PDF, names the signers, places the signature boxes and sends. The response carries the document and a signing_url per signer. Status, download and the Certificate of Completion come from GET /documents/{uuid} and the document.* webhooks; nothing else is required.

  • Acts as your company (service account)
  • Auth client_credentials access token
  • Decision 1 send_email, per request
  • Decision 2 kind, per signer; mix freely on one document
POST /publicapi/v1/send-document
{
  "send_email": 0,
  "return_url": "https://your.app/signed",
  "signers": [
    { "email": "ana@example.com", "name": "Ana Popescu", "kind": "simple" },
    { "email": "dan@example.com", "name": "Dan Ionescu", "kind": "qualified" }
  ],
  "documents": [ { "name": "Contract", "pdf_base64": "JVBERi0x..." } ]
}

200 { "data": { "document_uuid": "…",
  "signers": [ { "email": "ana@…", "signing_url": "https://app.simplifi.ro/signing-guest/…" },
               { "email": "dan@…", "signing_url": "https://app.simplifi.ro/signing-guest/…" } ] } }

1 Who runs the signing process

send_email: 1

Simplifi takes over

Simplifi emails each signer the invitation, hosts the signing and sends the completion notice. Your part ends with the call: wait for the document.completed webhook (or poll), then download the signed PDF and the Certificate of Completion.

  • Invitation Simplifi emails the link, and the completion notice
  • Channel proof the email link itself
  • After signing Simplifi's completion page, or your return_url
  • Fits you want to be done after one call

send_email: 0 (default)

You include signing in your own product

No email leaves Simplifi. The response gives you a signing_url per signer; show it as a button in your web or mobile app, send it in your own email or SMS. The signer signs on the Simplifi-hosted page and comes back to your return_url with a signed outcome, on the screen they left. No Simplifi emails, no create-an-account prompts.

  • Invitation yours: app screen, email, SMS, push, deep link
  • Channel proof an SMS code on the page (pass phone)
  • After signing your return_url, with a signed outcome
  • Fits the signer should never leave your product's flow

2 How each signer signs

A kind per signer; mix them on one document. Three signer types, not stages: pick the one that fits each person.

kind: simple

Simple signature

Anyone, no account. The signer opens the link, accepts the terms, confirms a one-time code and signs. Simplifi applies its qualified seal in the signer's name. For consents, acknowledgements, everyday agreements.

  • Signer needs nothing
  • On the page terms, verification code, signature
  • You get eIDAS simple signature (SES); evidence sealed in the Certificate of Completion
  • You pay one simple-signature envelope per pack, at completion

kind: qualified

Qualified signature, one-shot certificate

Anyone, no account. Same page, plus identity verification: ID document and a liveness selfie. A qualified certificate issued for this signing only signs the document. For contracts with someone you will not necessarily see again.

  • Signer needs an ID document
  • On the page terms, code, identity verification, signature
  • You get eIDAS qualified signature (QES), handwritten-equivalent; identity data stays with Simplifi
  • You pay one prepaid envelope per signer, at send

kind: account

Qualified signature, long-term certificate: your users' own

People you onboarded once (partner onboarding) hold a qualified certificate on their own Simplifi account. Two ways to sign: they open the link and log in, confirming with their authenticator app; or, once they have authorized your application (OAuth on your API client), your software performs the signing step through the API, authorized by their authenticator code. The same consent lets your software act for them: documents, inbox, retention.

  • Signer needs their Simplifi account and certificate
  • Identity check once, at onboarding; never repeated
  • You get eIDAS qualified signature (QES) with the person's own certificate
  • You pay one sponsored signing invitation per document, at send

The API reference follows this order: send a document, the three signature types, then track, collect, cancel.

Your first call

From zero to an authenticated request in three steps. No sandbox sign-up, no approval queue.

  1. Create your API client

    A company admin opens API Settings in the Simplifi app and creates the client. You get your oauth_client_id and client_secret on the spot.

  2. Get an access token

    Standard OAuth2 client_credentials against our identity server.

    curl -X POST https://auth.simplifi.ro/realms/Simplifi/protocol/openid-connect/token \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_SECRET"
  3. Send your first document

    One call uploads the PDF and returns a signing_url for the signer. Open it, verify the code, sign. The reference covers every option.

    curl -X POST https://api.simplifi.ro/publicapi/v1/send-document \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "signers": [ { "email": "ana@example.com", "name": "Ana Popescu" } ],
    "documents": [ { "name": "First contract",
                     "pdf_base64": "'"$(base64 -w0 contract.pdf)"'" } ]
  }'

Already on Simplifi? The developer portal in the app has a personalized Postman environment, code samples and the full dev pack.

Webhooks that tell you everything

Configure endpoints in API Settings and Simplifi calls you back, whatever the signer kind. Every delivery is signed, so you can verify it came from us.

Document lifecycle

Fired for every document your company integration creates through the API, as each signer acts and the document completes or gets rejected.

document.signer.signed document.completed document.rejected

Balance alerts and delivery checks

Know before credits run dry, and test your endpoint wiring with one API call. Every payload carries an X-Simplifi-Signature: sha256={hmac} header (HMAC-SHA256 of the raw body with your endpoint's signing secret).

allowance.low allowance.exhausted webhook.test

Verify deliveries with ready-made code: PHP · Node.js · Python

Good to know

The operational fine print, stated upfront.

Rate limits

Budgets are per API identity, never per IP address, so shared office NAT or cloud egress does not throttle you. Every authenticated response reports your current budget in headers, and going over returns 429 with a Retry-After. Pace yourself off RateLimit-Remaining and you will never see one. Integration tokens get 1800 requests a minute, end-user tokens 600, and a heavy integrator's ceiling can be raised per client on request.

RateLimit-Limit RateLimit-Remaining RateLimit-Reset

Versioning

The API is path-versioned: everything documented here lives under /publicapi/v1. Changes within v1 are additive: new endpoints, new optional fields, new webhook event types. Build clients that ignore unknown fields and they will not break. Anything incompatible ships as a new version path with a migration window, and deprecations are announced in the API reference before they take effect.

/publicapi/v1