Contract administration API

These endpoints extend the contract records and engagement records APIs. Every endpoint is scoped to the organization that owns the API key. See API conventions for shared behavior.

​

List cost centers

GET /v1/cost-centers returns the cost center codes your contracts can carry. Each item has id, code, description and is_archived.

​

List business units

GET /v1/business-units returns your business units in the order your organization set. It takes the same parameters as the cost center list. Each item has id, code, name, parent_id and is_archived.

​

List procurements

GET /v1/procurements returns procurement requests, newest first. Each item has id, title, description, vendor_id, status_id, status, priority, assignee_id, assignee_group_id, assessment_ids, contract_ids, intake_session_ids, is_archived, created_at and updated_at.

​

Get a procurement

GET /v1/procurements/{procurement_id} returns one procurement in the same shape. An unknown ID returns 404 with code procurement_not_found.

​

List a vendor’s purchase orders

GET /v1/vendors/{vendor_id}/purchase-orders returns the vendor’s purchase orders, newest first. total counts all of the vendor’s purchase orders.

​

Get a purchase order

GET /v1/purchase-orders/{purchase_order_id} returns one purchase order with its three-way match. Each entry in lines compares the PO amount with the first receipt line and the first invoice line that carry the same line number. A line is matched when all three amounts agree within one cent, open while a receipt or invoice amount is missing, and exception otherwise. match_status is exception when any line is, matched when every line is, and open otherwise. An unknown ID returns 404 with code purchase_order_not_found.

​

Create a purchase order

POST /v1/purchase-orders creates a draft purchase order and returns 201. Errors: 400 with code vendor_not_found, 409 with code po_number_taken, and 422 with code assessment_not_for_vendor when assessment_id is not an assessment of that vendor.

​

Issue a purchase order

POST /v1/purchase-orders/{purchase_order_id}/issue moves a draft to issued. Coverbase refuses the call with 409 while the vendor fails a blocking prequalification rule.

​

Read and file offboarding

The engagement lifecycle endpoints return 404 with code not_enabled when your organization does not have the engagement lifecycle, and 404 with code engagement_not_found for an unknown engagement. GET /v1/engagement-records/{engagement_id}/offboarding returns request, the latest offboarding request, or null. The request has id, status, reason_category, justification, requested_date, required_approval_roles, the approval times, and the start, completion and cancel times. To file an offboarding request, send POST /v1/engagement-records/{engagement_id}/offboarding. Coverbase notifies the approvers and returns 201 with the new state. A request the lifecycle refuses, for example a second open request, returns the refusal’s code and message.

​

Continuity plan

GET /v1/engagement-records/{engagement_id}/continuity-plan returns the plan. Before anyone saves one, every field except engagement_id is empty. To create or edit the plan, send PUT /v1/engagement-records/{engagement_id}/continuity-plan. Fields you leave out stay as they are. An explicit null for rto_hours clears it. To submit the plan for review, send POST /v1/engagement-records/{engagement_id}/continuity-plan/submit.

​

Clause sets

A clause set is the playbook a contract clause review compares against. Each reference clause carries up to five risk-tier variants. GET /v1/clause-sets lists your clause sets with their current reference clauses. It takes include_archived, limit (1 to 200, default 50) and offset. GET /v1/clause-sets/{clause_set_id} returns one set. An unknown ID returns 404 with code clause_set_not_found. To create a set, send POST /v1/clause-sets with name, and optionally description, is_active and library_template_id to copy a shipped template. To change a set, send PATCH /v1/clause-sets/{clause_set_id} with any of name, description, is_active and public_id_prefix (up to 16 characters). An explicit null clears description or public_id_prefix. A change to an archived set returns 409 with code clause_set_archived. To add a reference clause, send POST /v1/clause-sets/{clause_set_id}/reference-clauses. PATCH /v1/clause-sets/{clause_set_id}/reference-clauses/{reference_clause_id} saves a new version of the clause and returns it with its new id. Variants you send replace the current ones. To reorder, send POST /v1/clause-sets/{clause_set_id}/reference-clauses/reorder with reference_clause_ids listing every current clause once. Any other list returns 422 with code invalid_order. API keys cannot archive. DELETE on a clause set or a reference clause with an API key returns 403 with code api_key_not_allowed.

​

Clause reviews

A clause review compares a contract’s documents with clause sets and records a match for each reference clause. To start one, send POST /v1/contract-records/{contract_id}/clause-reviews with clause_set_ids and, optionally, document_ids. Coverbase returns 202 and runs the review in the background. Poll GET /v1/contract-records/{contract_id}/clause-reviews/{run_id} until status is completed or failed. Pass latest as run_id for the most recent run. If the contract already has an active run over the same clause sets, you get that run. An active run over different clause sets returns 409 with code active_run_exists. An unknown or inactive clause set returns 404 with code clause_set_not_found or 422 with code clause_set_not_usable. Each match has status, triage_decision, triage_notes, confidence, extracted_text, reasoning, source_document_id and page_num. To record a reviewer’s verdict, send PATCH /v1/clause-matches/{match_id} with either status (conforming, needs_review, non_conforming, missing, not_applicable or accepted_risk, plus accepted_risk_expires_at) or triage_decision (no_action, accepted_risk or false_positive, plus triage_notes). Accepting a risk is a sign-off, so an API key gets 403 with code api_key_not_allowed. To set one triage decision on up to 500 matches, send POST /v1/clause-matches/triage with match_ids, decision and optional notes. Each match is decided on its own: the response lists succeeded_match_ids and failures, each with a match_id and a message.

​

Findings from clause matches

To raise one finding from up to 200 of a contract’s clause matches, send POST /v1/contract-records/{contract_id}/findings-from-clause-matches with clause_match_ids and title, and optionally body, assigned_to_id, due_date, the severity, urgency and risk level IDs, and finding_status_id. Coverbase returns 201 with finding_id and sets each match’s triage to action_created. To link a match to an existing finding, send POST /v1/clause-matches/{match_id}/finding-links with finding_id. To remove a link, send POST /v1/clause-match-finding-links/{association_id}/unlink with next_triage: leave, clear, no_action, accepted_risk or false_positive. Setting accepted_risk with an API key returns 403 with code api_key_not_allowed.

​

Follow-up drafts

To have Coverbase AI draft a follow-up from clause matches, send POST /v1/contract-records/{contract_id}/follow-up-drafts with clause_match_ids (1 to 200), audience (vendor or procurement) and force. Coverbase returns 202 and writes the draft in the background. Poll GET /v1/contract-records/{contract_id}/follow-up-drafts/{draft_id} until status is completed or failed, then read draft_text. Coverbase sends nothing to anyone. A match from another contract returns 422 with code foreign_clause_match.

​

Review rounds

When the vendor returns a marked-up document, you start a new round that reads it against what the finished run asked for. To start one, send POST /v1/contract-records/{contract_id}/clause-reviews/{run_id}/rounds. Omit clause_set_ids or document_ids to keep the previous round’s. The previous run must be complete, or the call returns 422 with code round_not_ready. Coverbase returns 202 with the new run, which you poll like any clause review. GET /v1/contract-records/{contract_id}/clause-reviews/{run_id}/round-summary returns total, queued (clauses a person still has to look at), asks_sent, asks_answered, asks_outstanding, the counts by carry state in buckets, and pending_dispositions: vendor answers Coverbase would not settle on its own. To record those answers, send POST /v1/contract-records/{contract_id}/clause-reviews/{run_id}/ask-dispositions with up to 200 decisions, each with ask_id, status (accepted, rejected, countered or withdrawn) and response_text. An ask from another round returns 422 with code foreign_ask. The response is the updated round summary.

​

Export a clause set

GET /v1/clause-sets/{clause_set_id}/export returns download_url, file_name and expires_in_seconds (900). The URL downloads the set as an Excel workbook that the clause set importer can read back. It holds current, non-archived clauses only. Fetch it before it expires; the response is not cached.

​

Build a clause set from documents

To have Coverbase AI build a clause set from baseline contracts or a playbook, send POST /v1/clause-set-baseline-extractions with org_document_ids (1 to 10 distinct organization documents), and optionally clause_set_name, clause_set_description, public_id_prefix (up to 16 characters) and import_mode (auto, playbook or baseline). Coverbase creates an inactive clause set, returns 202 with the run, and extracts in the background. Poll GET /v1/clause-set-baseline-extractions/{run_id} until status is complete or failed. created_reference_clause_ids lists the clauses added so far. An unknown document returns 404 with code document_not_found.

​

Clause matches linked to a finding

GET /v1/findings/{finding_id}/clause-match-links returns items, one per Clause Review run, newest first. Each run lists its matches with clause_match_id, link_id, reference_clause_name, reference_clause_public_id and status. Pass link_id to POST /v1/clause-match-finding-links/{association_id}/unlink to remove a link. An unknown finding returns 404 with code finding_not_found.

​

Import clause sets

To create reference clauses from a Clause Set Upload Template workbook, send POST /v1/clause-sets/import with file_base64 (the .xlsx or .csv file, base64-encoded, up to 10 MB), filename and dry_run. The export above produces this format. Rows are grouped into clause sets by their Clause Set column, and Coverbase creates any set that does not exist yet. Send dry_run: true first: the response has a summary of rows to create, update and skip, the problems for each skipped row, and the clause_set_ids it touched. Coverbase keeps nothing on a dry run or when no row would import. A file that cannot be read returns 422 with code workbook_rejected, and invalid base64 returns 422 with code invalid_base64.

​

Download the redlined contract

GET /v1/contract-records/{contract_id}/clause-reviews/{run_id}/redline returns download_url, file_name and expires_in_seconds (900). The file is the contract’s source Word document with each clause that asks for a change applied as a tracked change and comment, ready to send to the vendor. A review with no Word source or no clause that asks for a change returns 422 with code nothing_to_redline.

​

Clause set library

GET /v1/clause-set-library returns items: the clause set templates Coverbase ships, each with id, slug, name, description, clause_count, tier_count, tier_labels, category, categories, industries and vendor_types. To start a set from one, pass its id as library_template_id to POST /v1/clause-sets.

​

Clause packs and clause domain rules

These endpoints need the engagement lifecycle. Without it they return 404 with code not_enabled. A clause domain rule requires a reference clause when a risk domain reaches a level, or has an open issue, on an engagement. GET /v1/clause-domain-rules lists them; filter with clause_set_id or reference_clause_perma_id. To create one, send POST /v1/clause-domain-rules with clause_set_id, reference_clause_perma_id, risk_domain_id, and optionally min_risk_level_id, require_on_open_issue and an obligation: obligation_text, obligation_route (evidence_request, scorecard or on_event) and obligation_interval_months (1 to 36; not for on_event). A second rule for the same clause and domain returns 409 with code clause_domain_rule_exists. PATCH /v1/clause-domain-rules/{rule_id} replaces the threshold and obligation. An API key cannot archive a rule. GET /v1/engagement-records/{engagement_id}/clause-pack returns the clauses the engagement’s contract must carry, with items, contract_count, reviewed_contract_count, rule_count and generated_at. To rebuild it from the current domain results, open issues and rules, send POST .../clause-pack/generate. To mark a clause as added to the redline sent to the vendor, send POST .../clause-pack/items/{item_id}/redline with marked.

​

Non-standard clauses report

GET /v1/non-standard-clauses lists every clause on a contract’s latest clause review that departs from the standard. Filter with search, vendor_ids, severities, statuses and risk_domain_ids; sort with sort (severity, contract, vendor or reviewed_at) and descending. GET /v1/non-standard-clauses/export takes the same filters and returns a short-lived download_url for the report as CSV.

​

Contract components, value and spend

These endpoints need Contracts v3. Without it they return 404 with code not_enabled. A contract carries component slots: MSA, DPA, SLA, order form and the others. GET /v1/contract-records/{contract_id}/components returns each slot’s component_type, the current_component_id that answers it, gap_state, pinned, resolution_reason and required_by_policy_id. To recompute every slot from the live components, send POST .../components/resync. To hold a decision against re-analysis, send POST .../components/{component_type}/pin with current_component_id and resolution_reason; unpin releases it, and recheck-done answers a re-check request. A component policy says which components a matching contract must carry. GET /v1/component-policies lists them. To create one, send POST /v1/component-policies with name, required_component_types, and optionally description, severity and predicate (contract_types, vendor_tiers, processes_customer_data, is_ai_subprocessor, min_annual_value, regulatory_flags). An empty predicate matches every contract. PATCH /v1/component-policies/{policy_id} changes any field; an API key cannot set is_archived. GET /v1/contract-fx-rates returns the pinned rate table: base_currency, as_of and rates (currency, rate_to_base). To replace it, send PUT /v1/contract-fx-rates with the whole table. GET /v1/contract-value returns what the portfolio, or one vendor with vendor_id, is committed to in the base currency, with currencies that have no rate listed in unconverted. GET /v1/contract-home-summary returns the contracts home figures: in_approval_count, approved_recently_count over approved_window_days, direct_savings, indirect_savings and cost_avoidance over savings_window_days, annual_spend, and vendors_over_budget_count for budget_year. Each money figure has the same shape as /v1/contract-value, and is_complete is false when a currency has no pinned rate. GET /v1/contract-savings-report lists the contracts behind the savings figures, grouped by group_by (vendor, business_unit or quarter), with totals per group and each contract’s savings_note. GET /v1/contract-attention-queues returns the attention cards in a fixed order: notice_due_soon, renewal_undecided, renewal_term_missing, reviews_needed, clauses_open, change_of_control and value_conflict. Each has a count, a detail line, a severity, and a filter rule group that lists its contracts in the contract filter syntax. GET /v1/contract-records/{contract_id}/detail-context returns what the contract page shows above the facts: conflicts where a recorded value disagrees with its document, derivations saying how each lifecycle date was worked out, vendor_context (other contracts, spend by currency, inherent risk and assessment dates), plain_terms, overlapping_spend in the same spend category, and the year-over-year spend_series. has_banner is true when a conflict blocks. GET /v1/contract-records/{contract_id}/spend-lines returns the live pricing lines, the superseded lines a later amendment re-priced, annual_total, one_time_total, currency and mixed_currencies. To add a line, send POST with description, amount, currency (ISO 4217), frequency (one_time, monthly, quarterly, annual or usage), and optionally effective_date, document_id, page_number and line_key. PATCH .../spend-lines/{line_id} corrects a line; DELETE archives it so re-extraction cannot bring it back, and an API key cannot do that. An unknown currency returns 422 with code invalid_currency.

​

Assemble contracts from documents

These endpoints need Contracts v3. Without it they return 404 with code not_enabled. An assembly batch groups vendor documents into proposed contract families. Nothing becomes a contract until a family is confirmed. To open a batch, send POST /v1/contract-assembly-batches with name, document_ids (vendor documents already uploaded), and optionally vendor_id and idempotency_key. Coverbase queues the analysis; poll GET /v1/contract-assembly-batches/{batch_id}/status until state is no longer analysing. GET /v1/contract-assembly-batches/{batch_id} returns the proposed families, each with confidence, blocking_decisions, vendor_match and predecessor, plus unmatched files and the reconciliation. GET .../files/{file_id}/download returns a link to one file that expires in 15 minutes. A manifest CSV names the agreement or vendor for each file. POST /v1/contract-assembly-manifest-check with csv says what it holds and stores nothing; PUT .../manifest attaches it, and every later analysis follows it. A manifest that cannot be used returns 422 with code manifest_rejected. POST .../analyse queues the batch to be grouped again, and POST .../ocr queues OCR for its scanned files; both return 202. ocr returns 409 with code nothing_to_ocr when no file is waiting. Before confirming, you can change the proposal: reject drops a family (family_key), bulk-reject drops several (family_keys), split moves document_ids into a new family, merge folds family_key into target_family_key, reassign moves a document_id to target_family_key, document-role sets a document’s document_role, relation and related_document_id, mark-incorporated folds amendments into into_document_id, and resolve-decision answers one blocking decision with kind and answer. A change the batch cannot make returns 400 with code invalid_family_change. To create a contract, send POST .../confirm with family_key, and one of vendor_id, new_vendor_name (creates that vendor), attach_to_contract_id (adds the documents to an existing contract) or no_vendor. Confirming a family twice returns the same contract with already_confirmed: true. POST .../bulk-confirm takes either family_keys or minimum_confidence, never both, with optional owner_id, vendor_id, new_vendor_name, create_proposed_vendors, no_vendor and attach_proposed. A family with an open blocking decision is listed in skipped with its reason. Coverbase reads each new contract’s components in the background. An API key cannot archive a batch. GET /v1/contract-records/{contract_id}/family lists the documents on a contract, with each one’s role, relation, is_root and a contributes line.

​

Analyze and classify contract documents

To have Coverbase AI read a contract’s documents for components and priced lines, send POST /v1/contract-records/{contract_id}/component-analysis. Coverbase returns 202 with document_count and runs the read in the background; poll the components and spend lines endpoints for the results. A contract with no documents returns 422 with code no_documents. GET /v1/contract-records/{contract_id}/document-intake proposes what each document is (role: root, amendment, restatement, sow, order_form, exhibit, evidence or redline_draft) and how it relates to another document, with confidence, rationale and needs_confirmation. Pass document_ids to read only those against the rest. It writes nothing. To record the answer, send POST .../document-intake/confirm with decisions, each with document_id, role, relation and related_document_id. Coverbase stores each decision at full confidence and rebuilds the component slots. A document that is not on the contract, or one that relates to itself, returns 422 with code invalid_decision. To correct which components a document carries, send PUT /v1/contract-records/{contract_id}/documents/{document_id}/components with the whole set in carries (component_type, effective_date). The response lists what was added, removed and redated, and reextraction_queued says whether Coverbase queued the document to be read again.

​

Procurements and reference lists

To open a procurement, send POST /v1/procurements; PATCH /v1/procurements/{procurement_id} changes one. Both take the fields the dashboard form takes, and a procurement Coverbase cannot save returns 422 with code invalid_procurement. Coverbase notifies anyone newly assigned. Cost centers, business units and contract approver roles are organization settings. POST /v1/cost-centers/bulk, POST /v1/business-units/bulk and POST /v1/contract-approver-roles/bulk add or update rows by name. PATCH changes one cost center or business unit, and POST /v1/business-units/reorder sets their order. These need org_settings:update:org, which API keys do not hold, so use a key created by a person whose role holds it. Setting is_archived needs a signed-in user. GET /v1/clause-sets/{clause_set_id}/reference-clauses/{reference_clause_id}/versions lists every saved version of a reference clause, newest first.

​

More on contract records

These endpoints need Contracts v3 where the dashboard does, and return 404 with code contract_not_found for an unknown contract.

• Staged uploads. POST /v1/contract-assembly-batches/{batch_id}/files takes up to 20 files as multipart files, with optional source_paths. A file Coverbase cannot read is listed in rejected. POST /v1/contract-assembly-archive-plans takes a zip listing and says what would be kept and skipped before you upload anything.
• Renewals and splits. GET .../suggested-renewals proposes earlier contracts this one renews. POST .../documents/{document_id}/split moves a document onto a new contract, and POST /v1/contract-records/separate-agreements does that for several.
• Accounting and follow-ups. GET .../accounting-packet shows what accounting receives, and POST .../accounting-packet/send emails it. POST .../follow-up-rounds opens a round of questions to the vendor and emails the vendor contact; POST /v1/contract-follow-up-asks/{ask_id}/response records an answer.
• Imports. POST /v1/contract-tracker-imports and POST /v1/contract-bulk-imports take a workbook as multipart file with dry_run, and return a job. Poll GET /v1/contract-import-jobs/{job_id}.
• Decisions and links. POST .../renewal-decision records renew, terminate, under_review or undecided with a note. POST .../release-hold releases an intake hold. POST .../vendor-link links a vendor, and POST .../vendor-request opens a vendor intake for a contract without one.
• Risk profile and AI. GET and PUT .../risk-profile read and set the legal risk profile. GET .../legal-suggestions returns suggested legal terms. POST .../summary queues an AI summary and returns 202; poll GET .../summary. POST /v1/contract-records/fill-details queues AI to fill empty fields from each contract’s documents, and POST /v1/contract-records/set-type retypes up to 500 contracts.
• Exports. POST /v1/contract-exports queues a spreadsheet and returns 202 with an export_id. Poll GET /v1/contract-exports/{export_id} until download_url is set. The link expires in 15 minutes and the response is never cached.
• Alerts. GET and PUT /v1/contract-alert-settings read and set contract notification rules. POST and DELETE .../alert-suppression pause and resume alerts on one contract. GET .../notification-preview and POST .../notification-rule-preview show what a rule would send. POST /v1/contract-reminder-presets applies a preset set of reminder rules and needs a key created by a person.

GET /v1/contract-runway returns upcoming renewals by month with each contract’s readiness, and GET /v1/vendor-contract-summaries returns contract counts and value per vendor.

​

Contract approval

GET /v1/contract-records/{contract_id}/approval returns the approval state and its steps. POST .../approval/validate-metadata lists required fields still empty. To submit, send POST .../approval/submit. Coverbase emails the first approvers. When no approval is needed and the policy sends automatically, the contract goes to DocuSign, which emails the signers. GET and PUT .../approval-plan read and change the planned approvers before the round opens. A contract administrator can reassign a step or resend-link to an outside approver; resending emails that approver. GET .../timeline lists every approval event. Deciding an approval stays in Coverbase with the approver. No API route approves or rejects. GET /v1/contract-approval-policies lists policies. POST creates one and PUT /v1/contract-approval-policies/{policy_id} replaces it. These need organization settings permission, so use a key created by a person whose role holds it. DELETE archives a policy and needs a signed-in user.

​

Change requests

These need rating override approval. Without it they return 404 with code not_enabled. GET /v1/change-requests lists change requests, newest first, filtered by status, target_type, target_id, vendor_id and assessment_id. GET /v1/change-requests/{change_request_id} returns one. API keys hold change_request:read:org, so a key reads them. To request a change, send POST /v1/change-requests with the target and the changes. You need update permission on the target. The requester can POST .../withdraw an open request. Approving or rejecting stays with the approver group in Coverbase.

​

Contracts Repository

These endpoints need the Contracts Repository. Without it they return 404 with code not_enabled. GET and PATCH /v1/repository-settings read and change the inbox address, filing scheme and accepted sender domains. An address another organization holds returns 409 with code local_part_taken. GET /v1/repository-summary returns document, review and inbox counts. GET /v1/repository-folders lists folders with their document counts. POST creates one, and PATCH /v1/repository-folders/{folder_id} renames, describes or moves it. DELETE archives a folder and its subfolders, moves their documents up, and needs a signed-in user. GET /v1/repository-folder-templates lists folder templates, and POST .../{template_key}/apply creates the folders a template adds. GET /v1/repository-documents lists filed documents. Filter with folder_id, include_subfolders, unfiled_only, search, document_types, categories, statuses, from_email, to_email and counterparty. GET .../{document_id} returns one with its versions and history, and PATCH renames, refiles or reclassifies it. POST /v1/repository-documents/move files several at once. archive and restore need a signed-in user. GET .../{document_id}/download returns a link that expires in 15 minutes; pass version for an earlier file. To file documents, send POST /v1/repository-uploads with up to 50 multipart files. Coverbase classifies and files them in the background and returns 202 with an inbox entry. GET /v1/repository-inbound-emails lists the inbox log, and POST .../{inbound_email_id}/retry files a message’s attachments again.

​

Engagement records

To create an engagement, send POST /v1/engagement-records with vendor_id, status_id, name, and the other fields the dashboard form takes. Coverbase returns 201 with the engagement. POST /v1/engagement-records/archive archives up to 100 engagements and needs a signed-in user. GET .../risk-domain-scores lists the engagement’s score per risk domain, and POST sets one. A manual score that changes a value needs a note, or the call returns 422 with the override rule’s code. These need the engagement lifecycle, and return 404 with code not_enabled without it:

• GET .../lifecycle says where the engagement is and who each risk domain is with.
• GET .../assessment-links lists assessments counted toward due diligence. POST links one, and Coverbase notifies the people who run a performed assessment. DELETE .../assessment-links/{link_id} removes a link and needs a signed-in user.
• GET .../other-engagements lists the vendor’s other live engagements with their latest assessment and Risk Summary outcome.
• GET .../risk-summary returns the Risk Summary.
• GET .../access-scope compares the approved application access with what Okta and Entra assign. PUT approves a scope, replacing the last one. POST .../access-scope/proposal drafts a scope from the inherent risk answers and saves nothing. Access scopes also need Inspect.

The offboarding request routes cancel, regenerate and remind act on a filed request; remind emails the people who own open exit steps. The exit step routes set owners, attach evidence, request a vendor attestation, which emails the vendor contact, and check-access counts the vendor’s remaining Okta and Entra access again. POST .../continuity-plan/reopen reopens a submitted plan. GET and POST .../contract-handoff read and open the contract handoff, and .../complete finishes it with a file. GET .../contract-context returns the engagement’s contracts as the CLM sees them. POST .../risk-summary/pdf-exports queues the Risk Summary PDF; poll the export until its download_url is set.

​

Obligation documents

GET /v1/obligations/{obligation_id}/commitment returns the obligation’s active commitment, or 404 with code commitment_not_found. GET /v1/obligations/{obligation_id}/documents lists its documents. To attach one, send POST with the file as multipart file and an optional note. PATCH .../documents/{document_id} replaces the note. GET .../download returns a link that expires in 15 minutes. DELETE removes a document and needs a signed-in user.

​

E-signature

These endpoints need e-signature. Without it they return 404 with code not_enabled. GET /v1/signature-envelopes lists envelopes. Filter with contract_id, vendor_id, status and search. POST /v1/signature-envelopes/query takes the dashboard’s filter language: filter, sort, search, limit and offset. GET /v1/signature-envelopes/{envelope_id} returns one with its recipients and their progress. GET .../audit returns every event and whether the hash chain verifies. GET .../verify checks the chain and the seal against the stored executed copy now, and records the result. GET .../documents/{kind} returns a link to the source, executed or certificate PDF; it needs contract:export:org and expires in 15 minutes. POST .../send sends a draft envelope. Coverbase emails the first routing step its signing links, and each later step when its turn comes. POST .../remind emails the people the current step waits on. No response returns a signing link. POST .../void closes every link on a sent envelope and needs a signed-in user. Signing or applying a signature for someone else is not possible through the API.

​

Build templates and envelopes

POST /v1/signature-templates creates a draft on a vendor document (source_document_id) or an uploaded file (source_file_id), with its roles. Coverbase converts the document to a PDF in the background. GET .../document returns a link to that PDF, with is_ready false until the conversion lands. PUT .../layout replaces the roles and fields in one write. Each field names its role by role_key, and positions run from 0 to 1 across the page. PATCH changes the details. Once an envelope is sent from a version, that version is fixed and returns 409 with code template_locked, so POST .../fork copies it into a new draft. POST .../publish makes a draft available to senders and retires the version it came from. Publishing and POST .../archive need a signed-in user. POST /v1/signature-envelopes opens a draft, seeded from a published template when you pass template_id. It emails nobody. PUT .../recipients and PUT .../fields replace the draft’s parties and fields, and PATCH changes its details. A recipient’s access_code is hashed and never returned. After a send, only name and vendor_id can change. To fix a sent envelope, POST .../correct voids it, then create a draft with corrected_from_id and send that. Correcting needs a signed-in user. GET /v1/signature-sources/{source_id}/document returns a link to a vendor document or uploaded file as a PDF, or is_ready false while it converts. GET /v1/signature-contract-documents?contract_ids=... lists the documents filed against up to 25 contracts. POST /v1/signature-send-copy suggests a subject, an opening line and a signing meaning, and saves nothing.

​

Signing policy

GET /v1/signature-config returns the org’s signing policy and the seal level it can produce now. PATCH changes it, and changing the consent disclosure starts a new version. POST .../email-preview renders one signing email against sample values and sends nothing. Changing the policy and previewing need organization settings permission, which API keys do not hold, so use a key created by a person whose role holds it.

​

Content library and written documents

GET /v1/signature-content-blocks lists your reusable passages, and POST adds one. GET .../library lists the starter passages Coverbase ships, and POST .../library/{slug}/adopt copies one into your library. PATCH .../{block_id} changes a passage. Setting is_archived needs a signed-in user. POST /v1/signature-authored-documents writes a document in Markdown and renders it to a PDF. Use its rendered_file_id as a template’s source_file_id or an envelope’s file_ids. PUT .../{document_id} saves a new version, and the earlier PDF stays for envelopes that use it.

​

Bulk send

GET /v1/signature-bulk-sends/preflight?template_id=... returns the roles each row must name, the labels a row may prefill, and how many envelopes your plan still allows. POST /v1/signature-bulk-sends sends one envelope per row from a published template and emails every recipient their own signing link. It checks the whole list first and refuses it with 422 and code rows_not_sendable if any row cannot be sent. Send dry_run: true to run that check without writing or sending anything. GET /v1/signature-bulk-sends/{batch_id} shows each row’s progress, and POST .../cancel stops the rows not yet sent. No response returns a signing link or an access code.

​

DocuSign

GET /v1/contract-records/{contract_id}/signature lists a contract’s envelopes. POST .../send-for-signature sends an approved contract through DocuSign, which emails each recipient. It sends as the DocuSign account connected by the user the key acts as, and returns 409 with code docusign_not_connected when there is none. PUT .../signature-plan names who signs before approval, for a policy that sends without asking once the last approver signs off. The send leaves as the DocuSign account of the user the key acts as. Send an empty recipients list to turn the automatic send off. POST .../signature-envelopes/{envelope_id}/sync pulls a DocuSign envelope’s state now and files the executed copy once everyone signs. POST .../abandon frees a contract whose send never reached DocuSign. Check DocuSign first. Abandoning needs a signed-in user. POST /v1/signature-requests sends a vendor document through DocuSign, with one signer per signature anchor in the document. DocuSign emails each signer.

​

Data share

These endpoints need the engagement lifecycle. Without it they return 404 with code not_enabled. They need organization settings permission, which API keys do not hold, so use a key created by a person whose role holds it. GET /v1/data-share/tables lists the tables every destination receives, and GET /v1/data-share/setup returns the role your S3 share role must trust. GET /v1/data-share/destinations lists destinations with their health. POST adds a Snowflake, S3 or BigQuery destination, and PATCH .../{destination_id} changes it. A credential you send goes to secret storage. No response returns it, only has_credential and credential_hint. DELETE archives a destination, deletes its credential, and needs a signed-in user. GET .../runs lists a destination’s syncs. POST .../test writes a probe with the stored credential. POST .../sync queues a sync and returns 202 with queued: false when one is already running. GET /v1/data-share/distribution lists everywhere your data goes out: destinations, the board pack and scheduled reports.