> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coverbase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Contract administration API

> Manage reference lists, procurements, contract approvals, the Contracts Repository, e-signature, engagement records, obligation documents and data share.

For AI agents: a documentation index is available at [https://docs.coverbase.com/llms.txt](https://docs.coverbase.com/llms.txt). This page is also available in markdown by appending .md to the URL.

These endpoints extend the [contract records](/api-reference/contract-records.md) and [engagement records](/api-reference/engagement-records.md) APIs. Every endpoint is scoped to the organization that owns the API key. See [API conventions](/conventions.md) for shared behavior.

| Method | Path | Permission |
| - | - | - |
| `GET` | `/v1/cost-centers` | `contract:read:org` |
| `GET` | `/v1/business-units` | `contract:read:org` |
| `GET` | `/v1/procurements` | `vendor:read:org` |
| `GET` | `/v1/procurements/{procurement_id}` | `vendor:read:org` |
| `GET` | `/v1/vendors/{vendor_id}/purchase-orders` | `vendor:read:org` |
| `GET` | `/v1/purchase-orders/{purchase_order_id}` | `vendor:read:org` |
| `POST` | `/v1/purchase-orders` | `vendor:update:org` |
| `POST` | `/v1/purchase-orders/{purchase_order_id}/issue` | `vendor:update:org` |
| `GET` | `/v1/engagement-records/{engagement_id}/offboarding` | `vendor:read:org` |
| `POST` | `/v1/engagement-records/{engagement_id}/offboarding` | `vendor:update:org` |
| `GET` | `/v1/engagement-records/{engagement_id}/continuity-plan` | `vendor:read:org` |
| `PUT` | `/v1/engagement-records/{engagement_id}/continuity-plan` | `vendor:update:org` |
| `POST` | `/v1/engagement-records/{engagement_id}/continuity-plan/submit` | `vendor:update:org` |
| `GET` | `/v1/clause-sets` | `contract:read:org` |
| `GET` | `/v1/clause-sets/{clause_set_id}` | `contract:read:org` |
| `POST` | `/v1/clause-sets` | `contract:update:org` |
| `PATCH` | `/v1/clause-sets/{clause_set_id}` | `contract:update:org` |
| `DELETE` | `/v1/clause-sets/{clause_set_id}` | `contract:update:org`, signed-in user only |
| `POST` | `/v1/clause-sets/{clause_set_id}/reference-clauses` | `contract:update:org` |
| `PATCH` | `/v1/clause-sets/{clause_set_id}/reference-clauses/{reference_clause_id}` | `contract:update:org` |
| `DELETE` | `/v1/clause-sets/{clause_set_id}/reference-clauses/{reference_clause_id}` | `contract:update:org`, signed-in user only |
| `POST` | `/v1/clause-sets/{clause_set_id}/reference-clauses/reorder` | `contract:update:org` |
| `POST` | `/v1/contract-records/{contract_id}/clause-reviews` | `contract:update:org` |
| `GET` | `/v1/contract-records/{contract_id}/clause-reviews/{run_id}` | `contract:read:org` |
| `PATCH` | `/v1/clause-matches/{match_id}` | `contract:update:org`; accepting a risk needs a signed-in user |
| `POST` | `/v1/clause-matches/triage` | `contract:update:org`; accepting a risk needs a signed-in user |
| `POST` | `/v1/contract-records/{contract_id}/findings-from-clause-matches` | `finding:create:org` |
| `POST` | `/v1/clause-matches/{match_id}/finding-links` | `finding:update:org` |
| `POST` | `/v1/clause-match-finding-links/{association_id}/unlink` | `finding:update:org` |
| `POST` | `/v1/contract-records/{contract_id}/follow-up-drafts` | `contract:update:org` |
| `GET` | `/v1/contract-records/{contract_id}/follow-up-drafts/{draft_id}` | `contract:read:org` |
| `GET` | `/v1/contract-records/{contract_id}/clause-reviews/{run_id}/round-summary` | `contract:read:org` |
| `GET` | `/v1/clause-sets/{clause_set_id}/export` | `contract:export:org` |
| `POST` | `/v1/clause-sets/import` | `contract:update:org` |
| `GET` | `/v1/contract-records/{contract_id}/clause-reviews/{run_id}/redline` | `contract:export:org` |
| `POST` | `/v1/clause-set-baseline-extractions` | `contract:update:org` |
| `GET` | `/v1/clause-set-baseline-extractions/{run_id}` | `contract:read:org` |
| `GET` | `/v1/findings/{finding_id}/clause-match-links` | `finding:read:org` |
| `GET` | `/v1/clause-set-library` | `contract:read:org` |
| `GET` | `/v1/engagement-records/{engagement_id}/clause-pack` | `vendor:read:org` |
| `POST` | `/v1/engagement-records/{engagement_id}/clause-pack/generate` | `vendor:update:org` |
| `POST` | `/v1/engagement-records/{engagement_id}/clause-pack/items/{item_id}/redline` | `vendor:update:org` |
| `GET` | `/v1/clause-domain-rules` | `contract:read:org` |
| `POST` | `/v1/clause-domain-rules` | `contract:update:org` |
| `PATCH` | `/v1/clause-domain-rules/{rule_id}` | `contract:update:org` |
| `DELETE` | `/v1/clause-domain-rules/{rule_id}` | `contract:update:org`, signed-in user only |
| `GET` | `/v1/non-standard-clauses` | `contract:read:org` |
| `GET` | `/v1/non-standard-clauses/export` | `contract:export:org` |
| `GET` | `/v1/contract-records/{contract_id}/components` | `contract:read:org` |
| `POST` | `/v1/contract-records/{contract_id}/components/resync` | `contract:update:org` |
| `POST` | `/v1/contract-records/{contract_id}/components/{component_type}/pin` | `contract:update:org` |
| `POST` | `/v1/contract-records/{contract_id}/components/{component_type}/unpin` | `contract:update:org` |
| `POST` | `/v1/contract-records/{contract_id}/components/{component_type}/recheck-done` | `contract:update:org` |
| `GET` | `/v1/contract-value` | `contract:read:org` |
| `GET` | `/v1/contract-home-summary` | `contract:read:org` |
| `GET` | `/v1/contract-savings-report` | `contract:read:org` |
| `GET` | `/v1/contract-attention-queues` | `contract:read:org` |
| `GET` | `/v1/contract-records/{contract_id}/detail-context` | `contract:read:org` |
| `GET` | `/v1/contract-fx-rates` | `contract:read:org` |
| `PUT` | `/v1/contract-fx-rates` | `contract:update:org` |
| `GET` | `/v1/component-policies` | `contract:read:org` |
| `POST` | `/v1/component-policies` | `contract:create:org` |
| `PATCH` | `/v1/component-policies/{policy_id}` | `contract:update:org`; archiving needs a signed-in user |
| `GET` | `/v1/contract-records/{contract_id}/spend-lines` | `contract:read:org` |
| `POST` | `/v1/contract-records/{contract_id}/spend-lines` | `contract:update:org` |
| `PATCH` | `/v1/contract-records/{contract_id}/spend-lines/{line_id}` | `contract:update:org` |
| `DELETE` | `/v1/contract-records/{contract_id}/spend-lines/{line_id}` | `contract:update:org`, signed-in user only |
| `POST` | `/v1/contract-records/{contract_id}/component-analysis` | `contract:update:org` |
| `GET` | `/v1/contract-records/{contract_id}/document-intake` | `contract:read:org` |
| `POST` | `/v1/contract-records/{contract_id}/document-intake/confirm` | `contract:update:org` |
| `PUT` | `/v1/contract-records/{contract_id}/documents/{document_id}/components` | `contract:update:org` |
| `POST` | `/v1/contract-records/{contract_id}/clause-reviews/{run_id}/rounds` | `contract:update:org` |
| `POST` | `/v1/contract-records/{contract_id}/clause-reviews/{run_id}/ask-dispositions` | `contract:update:org` |
| `GET` | `/v1/contract-assembly-batches` | `contract:read:org` |
| `POST` | `/v1/contract-assembly-batches` | `contract:create:org` |
| `GET` | `/v1/contract-assembly-batches/{batch_id}` | `contract:read:org` |
| `GET` | `/v1/contract-assembly-batches/{batch_id}/status` | `contract:read:org` |
| `GET` | `/v1/contract-assembly-batches/{batch_id}/files/{file_id}/download` | `contract:read:org` |
| `POST` | `/v1/contract-assembly-manifest-check` | `contract:create:org` |
| `PUT` | `/v1/contract-assembly-batches/{batch_id}/manifest` | `contract:create:org` |
| `POST` | `/v1/contract-assembly-batches/{batch_id}/analyse` | `contract:update:org` |
| `POST` | `/v1/contract-assembly-batches/{batch_id}/ocr` | `contract:update:org` |
| `POST` | `/v1/contract-assembly-batches/{batch_id}/archive` | `contract:archive:org`, signed-in user only |
| `POST` | `/v1/contract-assembly-batches/{batch_id}/confirm` | `contract:create:org`; `contract:update:org` to attach |
| `POST` | `/v1/contract-assembly-batches/{batch_id}/bulk-confirm` | `contract:create:org` |
| `POST` | `/v1/contract-assembly-batches/{batch_id}/reject` | `contract:update:org` |
| `POST` | `/v1/contract-assembly-batches/{batch_id}/bulk-reject` | `contract:update:org` |
| `POST` | `/v1/contract-assembly-batches/{batch_id}/split` | `contract:update:org` |
| `POST` | `/v1/contract-assembly-batches/{batch_id}/merge` | `contract:update:org` |
| `POST` | `/v1/contract-assembly-batches/{batch_id}/reassign` | `contract:update:org` |
| `POST` | `/v1/contract-assembly-batches/{batch_id}/document-role` | `contract:update:org` |
| `POST` | `/v1/contract-assembly-batches/{batch_id}/mark-incorporated` | `contract:update:org` |
| `POST` | `/v1/contract-assembly-batches/{batch_id}/resolve-decision` | `contract:update:org` |
| `GET` | `/v1/contract-records/{contract_id}/family` | `contract:read:org` |
| `POST` | `/v1/procurements` | `vendor:update:org` |
| `PATCH` | `/v1/procurements/{procurement_id}` | `vendor:update:org` |
| `POST` | `/v1/cost-centers/bulk` | `org_settings:update:org`, a key created by a person |
| `PATCH` | `/v1/cost-centers/{cost_center_id}` | `org_settings:update:org`, a key created by a person; archiving needs a signed-in user |
| `POST` | `/v1/business-units/bulk` | `org_settings:update:org`, a key created by a person |
| `POST` | `/v1/business-units/reorder` | `org_settings:update:org`, a key created by a person |
| `PATCH` | `/v1/business-units/{business_unit_id}` | `org_settings:update:org`, a key created by a person; archiving needs a signed-in user |
| `GET` | `/v1/contract-approver-roles` | `contract:read:org` |
| `POST` | `/v1/contract-approver-roles/bulk` | `org_settings:update:org`, a key created by a person |
| `GET` | `/v1/clause-sets/{clause_set_id}/reference-clauses/{reference_clause_id}/versions` | `contract:read:org` |
| `POST` | `/v1/contract-assembly-batches/{batch_id}/files` | `contract:create:org` |
| `POST` | `/v1/contract-assembly-archive-plans` | `contract:update:org` |
| `GET` | `/v1/contract-records/{contract_id}/suggested-renewals` | `contract:read:org` |
| `POST` | `/v1/contract-records/{contract_id}/documents/{document_id}/split` | `contract:create:org` and `contract:update:org` |
| `POST` | `/v1/contract-records/separate-agreements` | `contract:create:org` and `contract:update:org` |
| `GET` | `/v1/contract-records/{contract_id}/accounting-packet` | `contract:read:org` |
| `POST` | `/v1/contract-records/{contract_id}/accounting-packet/send` | `contract:update:org` |
| `GET` | `/v1/contract-records/{contract_id}/follow-up-rounds` | `contract:read:org` |
| `POST` | `/v1/contract-records/{contract_id}/follow-up-rounds` | `contract:update:org` |
| `POST` | `/v1/contract-follow-up-asks/{ask_id}/response` | `contract:update:org` |
| `POST` | `/v1/contract-tracker-imports` | `contract:update:org` |
| `POST` | `/v1/contract-bulk-imports` | `contract:create:org` |
| `GET` | `/v1/contract-import-jobs/{job_id}` | `contract:read:org` |
| `GET` | `/v1/contract-service-description-comparison` | `contract:update:org` |
| `POST` | `/v1/contract-records/{contract_id}/renewal-decision` | `contract:update:org` |
| `POST` | `/v1/contract-records/{contract_id}/release-hold` | `contract:update:org` |
| `POST` | `/v1/contract-records/{contract_id}/vendor-link` | `contract:update:org` |
| `POST` | `/v1/contract-records/{contract_id}/vendor-request` | `contract:update:org` |
| `GET` | `/v1/contract-records/{contract_id}/risk-profile` | `contract:read:org` |
| `PUT` | `/v1/contract-records/{contract_id}/risk-profile` | `contract:update:org` |
| `GET` | `/v1/contract-records/{contract_id}/legal-suggestions` | `contract:read:org` |
| `POST` | `/v1/contract-records/{contract_id}/summary` | `contract:update:org` |
| `GET` | `/v1/contract-records/{contract_id}/summary` | `contract:read:org` |
| `POST` | `/v1/contract-records/fill-details` | `contract:update:org` |
| `POST` | `/v1/contract-records/set-type` | `contract:update:org` |
| `GET` | `/v1/vendor-contract-summaries` | `contract:read:org` |
| `POST` | `/v1/contract-exports` | `contract:export:org` |
| `GET` | `/v1/contract-exports/{export_id}` | `contract:export:org` |
| `GET` | `/v1/contract-runway` | `contract:read:org` |
| `GET` | `/v1/contract-alert-settings` | `contract:read:org` |
| `PUT` | `/v1/contract-alert-settings` | `contract:update:org` |
| `GET` | `/v1/contract-alert-suppressions` | `contract:read:org` |
| `POST` | `/v1/contract-records/{contract_id}/alert-suppression` | `contract:read:org` |
| `DELETE` | `/v1/contract-records/{contract_id}/alert-suppression` | `contract:read:org` |
| `GET` | `/v1/contract-records/{contract_id}/notification-preview` | `contract:read:org` |
| `POST` | `/v1/contract-records/{contract_id}/notification-rule-preview` | `contract:read:org` |
| `POST` | `/v1/contract-reminder-presets` | `org_settings:update:org`, a key created by a person |
| `GET` | `/v1/contract-records/{contract_id}/approval` | `contract:read:org` |
| `POST` | `/v1/contract-records/{contract_id}/approval/validate-metadata` | `contract:update:org` |
| `POST` | `/v1/contract-records/{contract_id}/approval/submit` | `contract:update:org` |
| `GET` | `/v1/contract-records/{contract_id}/approval-plan` | `contract:read:org` |
| `PUT` | `/v1/contract-records/{contract_id}/approval-plan` | `contract:update:org` |
| `POST` | `/v1/contract-records/{contract_id}/approval-steps/{step_id}/reassign` | `contract:update:org`, contract administrator |
| `POST` | `/v1/contract-records/{contract_id}/approval-steps/{step_id}/resend-link` | `contract:update:org`, contract administrator |
| `GET` | `/v1/contract-records/{contract_id}/timeline` | `contract:read:org` |
| `GET` | `/v1/contract-approval-policies` | `org_settings:read:org`, a key created by a person |
| `POST` | `/v1/contract-approval-policies` | `org_settings:update:org`, a key created by a person |
| `PUT` | `/v1/contract-approval-policies/{policy_id}` | `org_settings:update:org`, a key created by a person |
| `DELETE` | `/v1/contract-approval-policies/{policy_id}` | `org_settings:update:org`, signed-in user only |
| `GET` | `/v1/change-requests` | `change_request:read:org` |
| `GET` | `/v1/change-requests/{change_request_id}` | `change_request:read:org` |
| `POST` | `/v1/change-requests` | The target's update permission |
| `POST` | `/v1/change-requests/{change_request_id}/withdraw` | `change_request:read:org`, the requester |
| `GET` | `/v1/repository-settings` | `contract:read:org` |
| `PATCH` | `/v1/repository-settings` | `contract:update:org` |
| `GET` | `/v1/repository-summary` | `contract:read:org` |
| `GET` | `/v1/repository-folders` | `contract:read:org` |
| `POST` | `/v1/repository-folders` | `contract:update:org` |
| `PATCH` | `/v1/repository-folders/{folder_id}` | `contract:update:org` |
| `DELETE` | `/v1/repository-folders/{folder_id}` | `contract:update:org`, signed-in user only |
| `GET` | `/v1/repository-folder-templates` | `contract:read:org` |
| `POST` | `/v1/repository-folder-templates/{template_key}/apply` | `contract:update:org` |
| `GET` | `/v1/repository-documents` | `contract:read:org` |
| `GET` | `/v1/repository-documents/{document_id}` | `contract:read:org` |
| `PATCH` | `/v1/repository-documents/{document_id}` | `contract:update:org` |
| `POST` | `/v1/repository-documents/move` | `contract:update:org` |
| `POST` | `/v1/repository-documents/{document_id}/archive` | `contract:update:org`, signed-in user only |
| `POST` | `/v1/repository-documents/{document_id}/restore` | `contract:update:org`, signed-in user only |
| `GET` | `/v1/repository-documents/{document_id}/download` | `contract:read:org` |
| `POST` | `/v1/repository-uploads` | `contract:update:org` |
| `GET` | `/v1/repository-inbound-emails` | `contract:read:org` |
| `GET` | `/v1/repository-inbound-emails/{inbound_email_id}` | `contract:read:org` |
| `POST` | `/v1/repository-inbound-emails/{inbound_email_id}/retry` | `contract:update:org` |
| `POST` | `/v1/engagement-records` | `vendor:update:org` |
| `POST` | `/v1/engagement-records/archive` | `vendor:update:org`, signed-in user only |
| `GET` | `/v1/engagement-records/{engagement_id}/lifecycle` | `vendor:read:org` |
| `GET` | `/v1/engagement-records/{engagement_id}/assessment-links` | `vendor:read:org` |
| `POST` | `/v1/engagement-records/{engagement_id}/assessment-links` | `vendor:update:org` |
| `DELETE` | `/v1/engagement-records/{engagement_id}/assessment-links/{link_id}` | `vendor:update:org`, signed-in user only |
| `GET` | `/v1/engagement-records/{engagement_id}/other-engagements` | `vendor:read:org` |
| `GET` | `/v1/engagement-records/{engagement_id}/risk-summary` | `vendor:read:org` |
| `GET` | `/v1/engagement-records/{engagement_id}/risk-domain-scores` | `vendor:read:org` |
| `GET` | `/v1/engagement-records/{engagement_id}/risk-domain-scores/{risk_domain_id}` | `vendor:read:org` |
| `POST` | `/v1/engagement-records/{engagement_id}/risk-domain-scores` | `vendor:update:org` |
| `GET` | `/v1/engagement-records/{engagement_id}/access-scope` | `vendor:read:org` |
| `PUT` | `/v1/engagement-records/{engagement_id}/access-scope` | `vendor:update:org` |
| `POST` | `/v1/engagement-records/{engagement_id}/access-scope/proposal` | `vendor:update:org` |
| `POST` | `/v1/engagement-records/{engagement_id}/offboarding/{request_id}/cancel` | `vendor:update:org` |
| `POST` | `/v1/engagement-records/{engagement_id}/offboarding/{request_id}/regenerate` | `vendor:update:org` |
| `POST` | `/v1/engagement-records/{engagement_id}/offboarding/{request_id}/remind` | `vendor:update:org` |
| `PATCH` | `/v1/engagement-records/{engagement_id}/offboarding/{request_id}/items/{item_id}` | `vendor:update:org` |
| `POST` | `/v1/engagement-records/{engagement_id}/offboarding/{request_id}/items/{item_id}/evidence` | `vendor:update:org` |
| `POST` | `/v1/engagement-records/{engagement_id}/offboarding/{request_id}/items/evidence` | `vendor:update:org` |
| `POST` | `/v1/engagement-records/{engagement_id}/offboarding/{request_id}/items/{item_id}/attestation` | `vendor:update:org` |
| `POST` | `/v1/engagement-records/{engagement_id}/offboarding/{request_id}/items/{item_id}/check-access` | `vendor:update:org` |
| `POST` | `/v1/engagement-records/{engagement_id}/continuity-plan/reopen` | `vendor:update:org` |
| `GET` | `/v1/engagement-records/{engagement_id}/contract-handoff` | `vendor:read:org` |
| `POST` | `/v1/engagement-records/{engagement_id}/contract-handoff` | `vendor:update:org` |
| `POST` | `/v1/engagement-records/{engagement_id}/contract-handoff/{handoff_id}/complete` | `vendor:update:org` |
| `GET` | `/v1/engagement-records/{engagement_id}/contract-context` | `vendor:read:org` |
| `POST` | `/v1/engagement-records/{engagement_id}/risk-summary/pdf-exports` | `vendor:read:org` |
| `GET` | `/v1/engagement-records/{engagement_id}/risk-summary/pdf-exports/{export_id}` | `vendor:read:org` |
| `GET` | `/v1/obligations/{obligation_id}/commitment` | `obligation:read:org` |
| `GET` | `/v1/obligations/{obligation_id}/documents` | `obligation:read:org` |
| `POST` | `/v1/obligations/{obligation_id}/documents` | `obligation:update:org` |
| `PATCH` | `/v1/obligations/{obligation_id}/documents/{document_id}` | `obligation:update:org` |
| `DELETE` | `/v1/obligations/{obligation_id}/documents/{document_id}` | `obligation:update:org`, signed-in user only |
| `GET` | `/v1/obligations/{obligation_id}/documents/{document_id}/download` | `obligation:read:org` |
| `GET` | `/v1/signature-envelopes` | `contract:read:org` |
| `GET` | `/v1/signature-envelopes/{envelope_id}` | `contract:read:org` |
| `POST` | `/v1/signature-envelopes/{envelope_id}/send` | `contract:update:org` |
| `POST` | `/v1/signature-envelopes/{envelope_id}/remind` | `contract:update:org` |
| `POST` | `/v1/signature-envelopes/{envelope_id}/void` | `contract:archive:org`, signed-in user only |
| `GET` | `/v1/signature-envelopes/{envelope_id}/audit` | `contract:read:org` |
| `GET` | `/v1/signature-envelopes/{envelope_id}/documents/{kind}` | `contract:export:org` |
| `GET` | `/v1/signature-templates` | `contract:read:org` |
| `GET` | `/v1/signature-templates/{template_id}` | `contract:read:org` |
| `GET` | `/v1/contract-records/{contract_id}/signature` | `contract:read:org` |
| `POST` | `/v1/contract-records/{contract_id}/send-for-signature` | `contract:update:org` |
| `POST` | `/v1/signature-envelopes` | `contract:create:org` |
| `POST` | `/v1/signature-envelopes/query` | `contract:read:org` |
| `PATCH` | `/v1/signature-envelopes/{envelope_id}` | `contract:update:org` |
| `PUT` | `/v1/signature-envelopes/{envelope_id}/recipients` | `contract:update:org` |
| `PUT` | `/v1/signature-envelopes/{envelope_id}/fields` | `contract:update:org` |
| `POST` | `/v1/signature-envelopes/{envelope_id}/correct` | `contract:update:org`, signed-in user only |
| `GET` | `/v1/signature-envelopes/{envelope_id}/verify` | `contract:read:org` |
| `POST` | `/v1/signature-templates` | `contract:create:org` |
| `PATCH` | `/v1/signature-templates/{template_id}` | `contract:update:org` |
| `PUT` | `/v1/signature-templates/{template_id}/layout` | `contract:update:org` |
| `POST` | `/v1/signature-templates/{template_id}/publish` | `contract:update:org`, signed-in user only |
| `POST` | `/v1/signature-templates/{template_id}/fork` | `contract:create:org` |
| `POST` | `/v1/signature-templates/{template_id}/archive` | `contract:archive:org`, signed-in user only |
| `GET` | `/v1/signature-templates/{template_id}/document` | `contract:read:org` |
| `GET` | `/v1/signature-sources/{source_id}/document` | `contract:read:org` |
| `GET` | `/v1/signature-contract-documents` | `contract:read:org` |
| `POST` | `/v1/signature-send-copy` | `contract:update:org` |
| `GET` | `/v1/signature-config` | `contract:read:org` |
| `PATCH` | `/v1/signature-config` | `org_settings:update:org`, a key created by a person |
| `POST` | `/v1/signature-config/email-preview` | `org_settings:update:org`, a key created by a person |
| `GET` | `/v1/signature-content-blocks` | `contract:read:org` |
| `GET` | `/v1/signature-content-blocks/library` | `contract:read:org` |
| `POST` | `/v1/signature-content-blocks/library/{slug}/adopt` | `contract:create:org` |
| `POST` | `/v1/signature-content-blocks` | `contract:create:org` |
| `PATCH` | `/v1/signature-content-blocks/{block_id}` | `contract:update:org`, signed-in user only to archive or restore |
| `GET` | `/v1/signature-authored-documents` | `contract:read:org` |
| `GET` | `/v1/signature-authored-documents/{document_id}` | `contract:read:org` |
| `POST` | `/v1/signature-authored-documents` | `contract:create:org` |
| `PUT` | `/v1/signature-authored-documents/{document_id}` | `contract:update:org` |
| `GET` | `/v1/signature-bulk-sends/preflight` | `contract:read:org` |
| `POST` | `/v1/signature-bulk-sends` | `contract:create:org` |
| `GET` | `/v1/signature-bulk-sends` | `contract:read:org` |
| `GET` | `/v1/signature-bulk-sends/{batch_id}` | `contract:read:org` |
| `POST` | `/v1/signature-bulk-sends/{batch_id}/cancel` | `contract:update:org` |
| `POST` | `/v1/signature-requests` | `contract:update:org` |
| `PUT` | `/v1/contract-records/{contract_id}/signature-plan` | `contract:update:org` |
| `POST` | `/v1/contract-records/{contract_id}/signature-envelopes/{envelope_id}/sync` | `contract:update:org` |
| `POST` | `/v1/contract-records/{contract_id}/signature-envelopes/{envelope_id}/abandon` | `contract:update:org`, signed-in user only |
| `GET` | `/v1/data-share/tables` | `org_settings:read:org`, a key created by a person |
| `GET` | `/v1/data-share/setup` | `org_settings:read:org`, a key created by a person |
| `GET` | `/v1/data-share/destinations` | `org_settings:read:org`, a key created by a person |
| `POST` | `/v1/data-share/destinations` | `org_settings:update:org`, a key created by a person |
| `PATCH` | `/v1/data-share/destinations/{destination_id}` | `org_settings:update:org`, a key created by a person |
| `DELETE` | `/v1/data-share/destinations/{destination_id}` | `org_settings:update:org`, signed-in user only |
| `GET` | `/v1/data-share/destinations/{destination_id}/runs` | `org_settings:read:org`, a key created by a person |
| `POST` | `/v1/data-share/destinations/{destination_id}/test` | `org_settings:update:org`, a key created by a person |
| `POST` | `/v1/data-share/destinations/{destination_id}/sync` | `org_settings:update:org`, a key created by a person |
| `GET` | `/v1/data-share/distribution` | `org_settings:read:org`, a key created by a person |
| List endpoints take `limit` and `offset` and return `items`, `total`, `limit` and `offset`. Errors return `detail` with a `code` and a `message`. | | |

## List cost centers

`GET /v1/cost-centers` returns the cost center codes your contracts can carry.

**include\_archived** `boolean` (default: false)

Include archived codes.

**limit** `integer` (default: 200)

Page size, 1 to 2000.

**offset** `integer` (default: 0)

Rows to skip.

Each item has `id`, `code`, `description` and `is_archived`.

## List business units

`GET /v1/business-units` returns your business units in the order your organization set. It takes the same parameters as the cost center list. Each item has `id`, `code`, `name`, `parent_id` and `is_archived`.

## List procurements

`GET /v1/procurements` returns procurement requests, newest first.

**vendor\_id** `string`

Only procurements for this vendor.

**status\_id** `string`

Only procurements in this workflow status.

**search** `string`

Text to match in the title.

**include\_archived** `boolean` (default: false)

Include archived procurements.

**limit** `integer` (default: 50)

Page size, 1 to 500.

Each item has `id`, `title`, `description`, `vendor_id`, `status_id`, `status`, `priority`, `assignee_id`, `assignee_group_id`, `assessment_ids`, `contract_ids`, `intake_session_ids`, `is_archived`, `created_at` and `updated_at`.

## Get a procurement

`GET /v1/procurements/{procurement_id}` returns one procurement in the same shape. An unknown ID returns `404` with code `procurement_not_found`.

## List a vendor's purchase orders

`GET /v1/vendors/{vendor_id}/purchase-orders` returns the vendor's purchase orders, newest first. `total` counts all of the vendor's purchase orders.

**limit** `integer` (default: 25)

Page size, 1 to 200.

## Get a purchase order

`GET /v1/purchase-orders/{purchase_order_id}` returns one purchase order with its three-way match. Each entry in `lines` compares the PO amount with the first receipt line and the first invoice line that carry the same line number. A line is `matched` when all three amounts agree within one cent, `open` while a receipt or invoice amount is missing, and `exception` otherwise. `match_status` is `exception` when any line is, `matched` when every line is, and `open` otherwise. An unknown ID returns `404` with code `purchase_order_not_found`.

## Create a purchase order

`POST /v1/purchase-orders` creates a draft purchase order and returns `201`.

**vendor\_id** `string` *required*

The vendor ID.

**po\_number** `string`

The PO number. It must be unique in your organization.

**assessment\_id** `string`

The assessment the purchase order follows from.

**total\_amount** `string`

The total as a decimal string, for example `"1200.00"`.

**currency** `string` (default: USD)

ISO currency code.

**line\_items** `object[]`

Each line has `description`, `quantity`, `unit_price` and `amount`.

**external\_system** `string`

The system of record that also holds the purchase order.

Errors: `400` with code `vendor_not_found`, `409` with code `po_number_taken`, and `422` with code `assessment_not_for_vendor` when `assessment_id` is not an assessment of that vendor.

## Issue a purchase order

`POST /v1/purchase-orders/{purchase_order_id}/issue` moves a draft to issued.

**po\_number\_format** `string`

The format for a generated PO number, for example `PO-{YEAR}-{SEQ}`.

Coverbase refuses the call with `409` while the vendor fails a blocking prequalification rule.

## Read and file offboarding

The engagement lifecycle endpoints return `404` with code `not_enabled` when your organization does not have the engagement lifecycle, and `404` with code `engagement_not_found` for an unknown engagement.

`GET /v1/engagement-records/{engagement_id}/offboarding` returns `request`, the latest offboarding request, or `null`. The request has `id`, `status`, `reason_category`, `justification`, `requested_date`, `required_approval_roles`, the approval times, and the start, completion and cancel times.

To file an offboarding request, send `POST /v1/engagement-records/{engagement_id}/offboarding`. Coverbase notifies the approvers and returns `201` with the new state.

**reason\_category** `string` *required*

One of `consolidation`, `contract_end`, `no_longer_needed`, `performance`, `risk`, `cost` or `other`.

**justification** `string` *required*

Why the engagement ends, up to 4000 characters.

**requested\_date** `integer`

When offboarding should happen, in Unix seconds.

A request the lifecycle refuses, for example a second open request, returns the refusal's `code` and `message`.

## Continuity plan

`GET /v1/engagement-records/{engagement_id}/continuity-plan` returns the plan. Before anyone saves one, every field except `engagement_id` is empty.

To create or edit the plan, send `PUT /v1/engagement-records/{engagement_id}/continuity-plan`. Fields you leave out stay as they are. An explicit `null` for `rto_hours` clears it.

**owner\_user\_id** `string`

The plan owner. The user must belong to your organization, or the call returns `400` with code `user_not_in_org`.

**backup\_suppliers** `object[]`

Up to 20 entries, each with `name`, `vendor_id` and `notes`.

**exit\_strategy** `string`

How you would exit the vendor, up to 10000 characters.

**rto\_hours** `integer`

Recovery time objective in hours, 0 to 8760.

**resiliency\_notes** `string`

Free-form notes, up to 10000 characters.

**transition\_steps** `string[]`

Up to 50 ordered steps.

To submit the plan for review, send `POST /v1/engagement-records/{engagement_id}/continuity-plan/submit`.

## Clause sets

A clause set is the playbook a contract clause review compares against. Each reference clause carries up to five risk-tier variants.

`GET /v1/clause-sets` lists your clause sets with their current reference clauses. It takes `include_archived`, `limit` (1 to 200, default 50) and `offset`. `GET /v1/clause-sets/{clause_set_id}` returns one set. An unknown ID returns `404` with code `clause_set_not_found`.

To create a set, send `POST /v1/clause-sets` with `name`, and optionally `description`, `is_active` and `library_template_id` to copy a shipped template. To change a set, send `PATCH /v1/clause-sets/{clause_set_id}` with any of `name`, `description`, `is_active` and `public_id_prefix` (up to 16 characters). An explicit `null` clears `description` or `public_id_prefix`. A change to an archived set returns `409` with code `clause_set_archived`.

To add a reference clause, send `POST /v1/clause-sets/{clause_set_id}/reference-clauses`.

**public\_id** `string` *required*

The clause's ID in the playbook, for example `DPA-01`.

**name** `string` *required*

The clause name.

**category** `string` *required*

The clause category.

**severity** `string` *required*

`low`, `medium`, `high` or `critical`.

**variants** `object[]`

Each variant has `risk_tier` (1 to 5), `label`, `text` and `is_archived`. Active variants need distinct tiers, or the call returns `422` with code `duplicate_risk_tier`.

`PATCH /v1/clause-sets/{clause_set_id}/reference-clauses/{reference_clause_id}` saves a new version of the clause and returns it with its new `id`. Variants you send replace the current ones.

To reorder, send `POST /v1/clause-sets/{clause_set_id}/reference-clauses/reorder` with `reference_clause_ids` listing every current clause once. Any other list returns `422` with code `invalid_order`.

API keys cannot archive. `DELETE` on a clause set or a reference clause with an API key returns `403` with code `api_key_not_allowed`.

## Clause reviews

A clause review compares a contract's documents with clause sets and records a match for each reference clause.

To start one, send `POST /v1/contract-records/{contract_id}/clause-reviews` with `clause_set_ids` and, optionally, `document_ids`. Coverbase returns `202` and runs the review in the background. Poll `GET /v1/contract-records/{contract_id}/clause-reviews/{run_id}` until `status` is `completed` or `failed`. Pass `latest` as `run_id` for the most recent run. If the contract already has an active run over the same clause sets, you get that run. An active run over different clause sets returns `409` with code `active_run_exists`. An unknown or inactive clause set returns `404` with code `clause_set_not_found` or `422` with code `clause_set_not_usable`.

Each match has `status`, `triage_decision`, `triage_notes`, `confidence`, `extracted_text`, `reasoning`, `source_document_id` and `page_num`.

To record a reviewer's verdict, send `PATCH /v1/clause-matches/{match_id}` with either `status` (`conforming`, `needs_review`, `non_conforming`, `missing`, `not_applicable` or `accepted_risk`, plus `accepted_risk_expires_at`) or `triage_decision` (`no_action`, `accepted_risk` or `false_positive`, plus `triage_notes`). Accepting a risk is a sign-off, so an API key gets `403` with code `api_key_not_allowed`.

To set one triage decision on up to 500 matches, send `POST /v1/clause-matches/triage` with `match_ids`, `decision` and optional `notes`. Each match is decided on its own: the response lists `succeeded_match_ids` and `failures`, each with a `match_id` and a `message`.

## Findings from clause matches

To raise one finding from up to 200 of a contract's clause matches, send `POST /v1/contract-records/{contract_id}/findings-from-clause-matches` with `clause_match_ids` and `title`, and optionally `body`, `assigned_to_id`, `due_date`, the severity, urgency and risk level IDs, and `finding_status_id`. Coverbase returns `201` with `finding_id` and sets each match's triage to `action_created`.

To link a match to an existing finding, send `POST /v1/clause-matches/{match_id}/finding-links` with `finding_id`. To remove a link, send `POST /v1/clause-match-finding-links/{association_id}/unlink` with `next_triage`: `leave`, `clear`, `no_action`, `accepted_risk` or `false_positive`. Setting `accepted_risk` with an API key returns `403` with code `api_key_not_allowed`.

## Follow-up drafts

To have Coverbase AI draft a follow-up from clause matches, send `POST /v1/contract-records/{contract_id}/follow-up-drafts` with `clause_match_ids` (1 to 200), `audience` (`vendor` or `procurement`) and `force`. Coverbase returns `202` and writes the draft in the background. Poll `GET /v1/contract-records/{contract_id}/follow-up-drafts/{draft_id}` until `status` is `completed` or `failed`, then read `draft_text`. Coverbase sends nothing to anyone. A match from another contract returns `422` with code `foreign_clause_match`.

## Review rounds

When the vendor returns a marked-up document, you start a new round that reads it against what the finished run asked for. To start one, send `POST /v1/contract-records/{contract_id}/clause-reviews/{run_id}/rounds`. Omit `clause_set_ids` or `document_ids` to keep the previous round's. The previous run must be `complete`, or the call returns `422` with code `round_not_ready`. Coverbase returns `202` with the new run, which you poll like any clause review.

`GET /v1/contract-records/{contract_id}/clause-reviews/{run_id}/round-summary` returns `total`, `queued` (clauses a person still has to look at), `asks_sent`, `asks_answered`, `asks_outstanding`, the counts by carry state in `buckets`, and `pending_dispositions`: vendor answers Coverbase would not settle on its own.

To record those answers, send `POST /v1/contract-records/{contract_id}/clause-reviews/{run_id}/ask-dispositions` with up to 200 `decisions`, each with `ask_id`, `status` (`accepted`, `rejected`, `countered` or `withdrawn`) and `response_text`. An ask from another round returns `422` with code `foreign_ask`. The response is the updated round summary.

## Export a clause set

`GET /v1/clause-sets/{clause_set_id}/export` returns `download_url`, `file_name` and `expires_in_seconds` (900). The URL downloads the set as an Excel workbook that the clause set importer can read back. It holds current, non-archived clauses only. Fetch it before it expires; the response is not cached.

## Build a clause set from documents

To have Coverbase AI build a clause set from baseline contracts or a playbook, send `POST /v1/clause-set-baseline-extractions` with `org_document_ids` (1 to 10 distinct organization documents), and optionally `clause_set_name`, `clause_set_description`, `public_id_prefix` (up to 16 characters) and `import_mode` (`auto`, `playbook` or `baseline`). Coverbase creates an inactive clause set, returns `202` with the run, and extracts in the background. Poll `GET /v1/clause-set-baseline-extractions/{run_id}` until `status` is `complete` or `failed`. `created_reference_clause_ids` lists the clauses added so far. An unknown document returns `404` with code `document_not_found`.

## Clause matches linked to a finding

`GET /v1/findings/{finding_id}/clause-match-links` returns `items`, one per Clause Review run, newest first. Each run lists its `matches` with `clause_match_id`, `link_id`, `reference_clause_name`, `reference_clause_public_id` and `status`. Pass `link_id` to `POST /v1/clause-match-finding-links/{association_id}/unlink` to remove a link. An unknown finding returns `404` with code `finding_not_found`.

## Import clause sets

To create reference clauses from a Clause Set Upload Template workbook, send `POST /v1/clause-sets/import` with `file_base64` (the .xlsx or .csv file, base64-encoded, up to 10 MB), `filename` and `dry_run`. The export above produces this format. Rows are grouped into clause sets by their `Clause Set` column, and Coverbase creates any set that does not exist yet. Send `dry_run: true` first: the response has a `summary` of rows to create, update and skip, the `problems` for each skipped row, and the `clause_set_ids` it touched. Coverbase keeps nothing on a dry run or when no row would import. A file that cannot be read returns `422` with code `workbook_rejected`, and invalid base64 returns `422` with code `invalid_base64`.

## Download the redlined contract

`GET /v1/contract-records/{contract_id}/clause-reviews/{run_id}/redline` returns `download_url`, `file_name` and `expires_in_seconds` (900). The file is the contract's source Word document with each clause that asks for a change applied as a tracked change and comment, ready to send to the vendor. A review with no Word source or no clause that asks for a change returns `422` with code `nothing_to_redline`.

## Clause set library

`GET /v1/clause-set-library` returns `items`: the clause set templates Coverbase ships, each with `id`, `slug`, `name`, `description`, `clause_count`, `tier_count`, `tier_labels`, `category`, `categories`, `industries` and `vendor_types`. To start a set from one, pass its `id` as `library_template_id` to `POST /v1/clause-sets`.

## Clause packs and clause domain rules

These endpoints need the engagement lifecycle. Without it they return `404` with code `not_enabled`.

A clause domain rule requires a reference clause when a risk domain reaches a level, or has an open issue, on an engagement. `GET /v1/clause-domain-rules` lists them; filter with `clause_set_id` or `reference_clause_perma_id`. To create one, send `POST /v1/clause-domain-rules` with `clause_set_id`, `reference_clause_perma_id`, `risk_domain_id`, and optionally `min_risk_level_id`, `require_on_open_issue` and an obligation: `obligation_text`, `obligation_route` (`evidence_request`, `scorecard` or `on_event`) and `obligation_interval_months` (1 to 36; not for `on_event`). A second rule for the same clause and domain returns `409` with code `clause_domain_rule_exists`. `PATCH /v1/clause-domain-rules/{rule_id}` replaces the threshold and obligation. An API key cannot archive a rule.

`GET /v1/engagement-records/{engagement_id}/clause-pack` returns the clauses the engagement's contract must carry, with `items`, `contract_count`, `reviewed_contract_count`, `rule_count` and `generated_at`. To rebuild it from the current domain results, open issues and rules, send `POST .../clause-pack/generate`. To mark a clause as added to the redline sent to the vendor, send `POST .../clause-pack/items/{item_id}/redline` with `marked`.

## Non-standard clauses report

`GET /v1/non-standard-clauses` lists every clause on a contract's latest clause review that departs from the standard. Filter with `search`, `vendor_ids`, `severities`, `statuses` and `risk_domain_ids`; sort with `sort` (`severity`, `contract`, `vendor` or `reviewed_at`) and `descending`. `GET /v1/non-standard-clauses/export` takes the same filters and returns a short-lived `download_url` for the report as CSV.

## Contract components, value and spend

These endpoints need Contracts v3. Without it they return `404` with code `not_enabled`.

A contract carries component slots: MSA, DPA, SLA, order form and the others. `GET /v1/contract-records/{contract_id}/components` returns each slot's `component_type`, the `current_component_id` that answers it, `gap_state`, `pinned`, `resolution_reason` and `required_by_policy_id`. To recompute every slot from the live components, send `POST .../components/resync`. To hold a decision against re-analysis, send `POST .../components/{component_type}/pin` with `current_component_id` and `resolution_reason`; `unpin` releases it, and `recheck-done` answers a re-check request.

A component policy says which components a matching contract must carry. `GET /v1/component-policies` lists them. To create one, send `POST /v1/component-policies` with `name`, `required_component_types`, and optionally `description`, `severity` and `predicate` (`contract_types`, `vendor_tiers`, `processes_customer_data`, `is_ai_subprocessor`, `min_annual_value`, `regulatory_flags`). An empty predicate matches every contract. `PATCH /v1/component-policies/{policy_id}` changes any field; an API key cannot set `is_archived`.

`GET /v1/contract-fx-rates` returns the pinned rate table: `base_currency`, `as_of` and `rates` (`currency`, `rate_to_base`). To replace it, send `PUT /v1/contract-fx-rates` with the whole table. `GET /v1/contract-value` returns what the portfolio, or one vendor with `vendor_id`, is committed to in the base currency, with currencies that have no rate listed in `unconverted`.

`GET /v1/contract-home-summary` returns the contracts home figures: `in_approval_count`, `approved_recently_count` over `approved_window_days`, `direct_savings`, `indirect_savings` and `cost_avoidance` over `savings_window_days`, `annual_spend`, and `vendors_over_budget_count` for `budget_year`. Each money figure has the same shape as `/v1/contract-value`, and `is_complete` is false when a currency has no pinned rate. `GET /v1/contract-savings-report` lists the contracts behind the savings figures, grouped by `group_by` (`vendor`, `business_unit` or `quarter`), with totals per group and each contract's `savings_note`.

`GET /v1/contract-attention-queues` returns the attention cards in a fixed order: `notice_due_soon`, `renewal_undecided`, `renewal_term_missing`, `reviews_needed`, `clauses_open`, `change_of_control` and `value_conflict`. Each has a `count`, a `detail` line, a `severity`, and a `filter` rule group that lists its contracts in the contract filter syntax.

`GET /v1/contract-records/{contract_id}/detail-context` returns what the contract page shows above the facts: `conflicts` where a recorded value disagrees with its document, `derivations` saying how each lifecycle date was worked out, `vendor_context` (other contracts, spend by currency, inherent risk and assessment dates), `plain_terms`, `overlapping_spend` in the same spend category, and the year-over-year `spend_series`. `has_banner` is true when a conflict blocks.

`GET /v1/contract-records/{contract_id}/spend-lines` returns the live pricing lines, the `superseded` lines a later amendment re-priced, `annual_total`, `one_time_total`, `currency` and `mixed_currencies`. To add a line, send `POST` with `description`, `amount`, `currency` (ISO 4217), `frequency` (`one_time`, `monthly`, `quarterly`, `annual` or `usage`), and optionally `effective_date`, `document_id`, `page_number` and `line_key`. `PATCH .../spend-lines/{line_id}` corrects a line; `DELETE` archives it so re-extraction cannot bring it back, and an API key cannot do that. An unknown currency returns `422` with code `invalid_currency`.

## Assemble contracts from documents

These endpoints need Contracts v3. Without it they return `404` with code `not_enabled`.

An assembly batch groups vendor documents into proposed contract families. Nothing becomes a contract until a family is confirmed. To open a batch, send `POST /v1/contract-assembly-batches` with `name`, `document_ids` (vendor documents already uploaded), and optionally `vendor_id` and `idempotency_key`. Coverbase queues the analysis; poll `GET /v1/contract-assembly-batches/{batch_id}/status` until `state` is no longer `analysing`. `GET /v1/contract-assembly-batches/{batch_id}` returns the proposed `families`, each with `confidence`, `blocking_decisions`, `vendor_match` and `predecessor`, plus `unmatched` files and the `reconciliation`. `GET .../files/{file_id}/download` returns a link to one file that expires in 15 minutes.

A manifest CSV names the agreement or vendor for each file. `POST /v1/contract-assembly-manifest-check` with `csv` says what it holds and stores nothing; `PUT .../manifest` attaches it, and every later analysis follows it. A manifest that cannot be used returns `422` with code `manifest_rejected`. `POST .../analyse` queues the batch to be grouped again, and `POST .../ocr` queues OCR for its scanned files; both return `202`. `ocr` returns `409` with code `nothing_to_ocr` when no file is waiting.

Before confirming, you can change the proposal: `reject` drops a family (`family_key`), `bulk-reject` drops several (`family_keys`), `split` moves `document_ids` into a new family, `merge` folds `family_key` into `target_family_key`, `reassign` moves a `document_id` to `target_family_key`, `document-role` sets a document's `document_role`, `relation` and `related_document_id`, `mark-incorporated` folds amendments into `into_document_id`, and `resolve-decision` answers one blocking decision with `kind` and `answer`. A change the batch cannot make returns `400` with code `invalid_family_change`.

To create a contract, send `POST .../confirm` with `family_key`, and one of `vendor_id`, `new_vendor_name` (creates that vendor), `attach_to_contract_id` (adds the documents to an existing contract) or `no_vendor`. Confirming a family twice returns the same contract with `already_confirmed: true`. `POST .../bulk-confirm` takes either `family_keys` or `minimum_confidence`, never both, with optional `owner_id`, `vendor_id`, `new_vendor_name`, `create_proposed_vendors`, `no_vendor` and `attach_proposed`. A family with an open blocking decision is listed in `skipped` with its `reason`. Coverbase reads each new contract's components in the background. An API key cannot archive a batch.

`GET /v1/contract-records/{contract_id}/family` lists the documents on a contract, with each one's role, relation, `is_root` and a `contributes` line.

## Analyze and classify contract documents

To have Coverbase AI read a contract's documents for components and priced lines, send `POST /v1/contract-records/{contract_id}/component-analysis`. Coverbase returns `202` with `document_count` and runs the read in the background; poll the components and spend lines endpoints for the results. A contract with no documents returns `422` with code `no_documents`.

`GET /v1/contract-records/{contract_id}/document-intake` proposes what each document is (`role`: `root`, `amendment`, `restatement`, `sow`, `order_form`, `exhibit`, `evidence` or `redline_draft`) and how it relates to another document, with `confidence`, `rationale` and `needs_confirmation`. Pass `document_ids` to read only those against the rest. It writes nothing. To record the answer, send `POST .../document-intake/confirm` with `decisions`, each with `document_id`, `role`, `relation` and `related_document_id`. Coverbase stores each decision at full confidence and rebuilds the component slots. A document that is not on the contract, or one that relates to itself, returns `422` with code `invalid_decision`.

To correct which components a document carries, send `PUT /v1/contract-records/{contract_id}/documents/{document_id}/components` with the whole set in `carries` (`component_type`, `effective_date`). The response lists what was `added`, `removed` and `redated`, and `reextraction_queued` says whether Coverbase queued the document to be read again.

## Procurements and reference lists

To open a procurement, send `POST /v1/procurements`; `PATCH /v1/procurements/{procurement_id}` changes one. Both take the fields the dashboard form takes, and a procurement Coverbase cannot save returns `422` with code `invalid_procurement`. Coverbase notifies anyone newly assigned.

Cost centers, business units and contract approver roles are organization settings. `POST /v1/cost-centers/bulk`, `POST /v1/business-units/bulk` and `POST /v1/contract-approver-roles/bulk` add or update rows by name. `PATCH` changes one cost center or business unit, and `POST /v1/business-units/reorder` sets their order. These need `org_settings:update:org`, which API keys do not hold, so use a key created by a person whose role holds it. Setting `is_archived` needs a signed-in user.

`GET /v1/clause-sets/{clause_set_id}/reference-clauses/{reference_clause_id}/versions` lists every saved version of a reference clause, newest first.

## More on contract records

These endpoints need Contracts v3 where the dashboard does, and return `404` with code `contract_not_found` for an unknown contract.

* **Staged uploads.** `POST /v1/contract-assembly-batches/{batch_id}/files` takes up to 20 files as multipart `files`, with optional `source_paths`. A file Coverbase cannot read is listed in `rejected`. `POST /v1/contract-assembly-archive-plans` takes a zip listing and says what would be kept and skipped before you upload anything.
* **Renewals and splits.** `GET .../suggested-renewals` proposes earlier contracts this one renews. `POST .../documents/{document_id}/split` moves a document onto a new contract, and `POST /v1/contract-records/separate-agreements` does that for several.
* **Accounting and follow-ups.** `GET .../accounting-packet` shows what accounting receives, and `POST .../accounting-packet/send` emails it. `POST .../follow-up-rounds` opens a round of questions to the vendor and emails the vendor contact; `POST /v1/contract-follow-up-asks/{ask_id}/response` records an answer.
* **Imports.** `POST /v1/contract-tracker-imports` and `POST /v1/contract-bulk-imports` take a workbook as multipart `file` with `dry_run`, and return a job. Poll `GET /v1/contract-import-jobs/{job_id}`.
* **Decisions and links.** `POST .../renewal-decision` records `renew`, `terminate`, `under_review` or `undecided` with a `note`. `POST .../release-hold` releases an intake hold. `POST .../vendor-link` links a vendor, and `POST .../vendor-request` opens a vendor intake for a contract without one.
* **Risk profile and AI.** `GET` and `PUT .../risk-profile` read and set the legal risk profile. `GET .../legal-suggestions` returns suggested legal terms. `POST .../summary` queues an AI summary and returns `202`; poll `GET .../summary`. `POST /v1/contract-records/fill-details` queues AI to fill empty fields from each contract's documents, and `POST /v1/contract-records/set-type` retypes up to 500 contracts.
* **Exports.** `POST /v1/contract-exports` queues a spreadsheet and returns `202` with an `export_id`. Poll `GET /v1/contract-exports/{export_id}` until `download_url` is set. The link expires in 15 minutes and the response is never cached.
* **Alerts.** `GET` and `PUT /v1/contract-alert-settings` read and set contract notification rules. `POST` and `DELETE .../alert-suppression` pause and resume alerts on one contract. `GET .../notification-preview` and `POST .../notification-rule-preview` show what a rule would send. `POST /v1/contract-reminder-presets` applies a preset set of reminder rules and needs a key created by a person.

`GET /v1/contract-runway` returns upcoming renewals by month with each contract's readiness, and `GET /v1/vendor-contract-summaries` returns contract counts and value per vendor.

## Contract approval

`GET /v1/contract-records/{contract_id}/approval` returns the approval state and its steps. `POST .../approval/validate-metadata` lists required fields still empty. To submit, send `POST .../approval/submit`. Coverbase emails the first approvers. When no approval is needed and the policy sends automatically, the contract goes to DocuSign, which emails the signers.

`GET` and `PUT .../approval-plan` read and change the planned approvers before the round opens. A contract administrator can `reassign` a step or `resend-link` to an outside approver; resending emails that approver. `GET .../timeline` lists every approval event.

Deciding an approval stays in Coverbase with the approver. No API route approves or rejects.

`GET /v1/contract-approval-policies` lists policies. `POST` creates one and `PUT /v1/contract-approval-policies/{policy_id}` replaces it. These need organization settings permission, so use a key created by a person whose role holds it. `DELETE` archives a policy and needs a signed-in user.

## Change requests

These need rating override approval. Without it they return `404` with code `not_enabled`.

`GET /v1/change-requests` lists change requests, newest first, filtered by `status`, `target_type`, `target_id`, `vendor_id` and `assessment_id`. `GET /v1/change-requests/{change_request_id}` returns one. API keys hold `change_request:read:org`, so a key reads them.

To request a change, send `POST /v1/change-requests` with the target and the changes. You need update permission on the target. The requester can `POST .../withdraw` an open request. Approving or rejecting stays with the approver group in Coverbase.

## Contracts Repository

These endpoints need the Contracts Repository. Without it they return `404` with code `not_enabled`.

`GET` and `PATCH /v1/repository-settings` read and change the inbox address, filing scheme and accepted sender domains. An address another organization holds returns `409` with code `local_part_taken`. `GET /v1/repository-summary` returns document, review and inbox counts.

`GET /v1/repository-folders` lists folders with their document counts. `POST` creates one, and `PATCH /v1/repository-folders/{folder_id}` renames, describes or moves it. `DELETE` archives a folder and its subfolders, moves their documents up, and needs a signed-in user. `GET /v1/repository-folder-templates` lists folder templates, and `POST .../{template_key}/apply` creates the folders a template adds.

`GET /v1/repository-documents` lists filed documents. Filter with `folder_id`, `include_subfolders`, `unfiled_only`, `search`, `document_types`, `categories`, `statuses`, `from_email`, `to_email` and `counterparty`. `GET .../{document_id}` returns one with its versions and history, and `PATCH` renames, refiles or reclassifies it. `POST /v1/repository-documents/move` files several at once. `archive` and `restore` need a signed-in user. `GET .../{document_id}/download` returns a link that expires in 15 minutes; pass `version` for an earlier file.

To file documents, send `POST /v1/repository-uploads` with up to 50 multipart `files`. Coverbase classifies and files them in the background and returns `202` with an inbox entry. `GET /v1/repository-inbound-emails` lists the inbox log, and `POST .../{inbound_email_id}/retry` files a message's attachments again.

## Engagement records

To create an engagement, send `POST /v1/engagement-records` with `vendor_id`, `status_id`, `name`, and the other fields the dashboard form takes. Coverbase returns `201` with the engagement. `POST /v1/engagement-records/archive` archives up to 100 engagements and needs a signed-in user.

`GET .../risk-domain-scores` lists the engagement's score per risk domain, and `POST` sets one. A `manual` score that changes a value needs a `note`, or the call returns `422` with the override rule's code.

These need the engagement lifecycle, and return `404` with code `not_enabled` without it:

* `GET .../lifecycle` says where the engagement is and who each risk domain is with.
* `GET .../assessment-links` lists assessments counted toward due diligence. `POST` links one, and Coverbase notifies the people who run a performed assessment. `DELETE .../assessment-links/{link_id}` removes a link and needs a signed-in user.
* `GET .../other-engagements` lists the vendor's other live engagements with their latest assessment and Risk Summary outcome.
* `GET .../risk-summary` returns the Risk Summary.
* `GET .../access-scope` compares the approved application access with what Okta and Entra assign. `PUT` approves a scope, replacing the last one. `POST .../access-scope/proposal` drafts a scope from the inherent risk answers and saves nothing. Access scopes also need Inspect.

The offboarding request routes `cancel`, `regenerate` and `remind` act on a filed request; `remind` emails the people who own open exit steps. The exit step routes set owners, attach evidence, request a vendor attestation, which emails the vendor contact, and `check-access` counts the vendor's remaining Okta and Entra access again. `POST .../continuity-plan/reopen` reopens a submitted plan. `GET` and `POST .../contract-handoff` read and open the contract handoff, and `.../complete` finishes it with a file. `GET .../contract-context` returns the engagement's contracts as the CLM sees them. `POST .../risk-summary/pdf-exports` queues the Risk Summary PDF; poll the export until its `download_url` is set.

## Obligation documents

`GET /v1/obligations/{obligation_id}/commitment` returns the obligation's active commitment, or `404` with code `commitment_not_found`. `GET /v1/obligations/{obligation_id}/documents` lists its documents. To attach one, send `POST` with the file as multipart `file` and an optional `note`. `PATCH .../documents/{document_id}` replaces the note. `GET .../download` returns a link that expires in 15 minutes. `DELETE` removes a document and needs a signed-in user.

## E-signature

These endpoints need e-signature. Without it they return `404` with code `not_enabled`.

`GET /v1/signature-envelopes` lists envelopes. Filter with `contract_id`, `vendor_id`, `status` and `search`. `POST /v1/signature-envelopes/query` takes the dashboard's filter language: `filter`, `sort`, `search`, `limit` and `offset`. `GET /v1/signature-envelopes/{envelope_id}` returns one with its recipients and their progress. `GET .../audit` returns every event and whether the hash chain verifies. `GET .../verify` checks the chain and the seal against the stored executed copy now, and records the result. `GET .../documents/{kind}` returns a link to the `source`, `executed` or `certificate` PDF; it needs `contract:export:org` and expires in 15 minutes.

`POST .../send` sends a draft envelope. Coverbase emails the first routing step its signing links, and each later step when its turn comes. `POST .../remind` emails the people the current step waits on. No response returns a signing link. `POST .../void` closes every link on a sent envelope and needs a signed-in user. Signing or applying a signature for someone else is not possible through the API.

### Build templates and envelopes

`POST /v1/signature-templates` creates a draft on a vendor document (`source_document_id`) or an uploaded file (`source_file_id`), with its `roles`. Coverbase converts the document to a PDF in the background. `GET .../document` returns a link to that PDF, with `is_ready` false until the conversion lands. `PUT .../layout` replaces the roles and fields in one write. Each field names its role by `role_key`, and positions run from 0 to 1 across the page. `PATCH` changes the details. Once an envelope is sent from a version, that version is fixed and returns `409` with code `template_locked`, so `POST .../fork` copies it into a new draft. `POST .../publish` makes a draft available to senders and retires the version it came from. Publishing and `POST .../archive` need a signed-in user.

`POST /v1/signature-envelopes` opens a draft, seeded from a published template when you pass `template_id`. It emails nobody. `PUT .../recipients` and `PUT .../fields` replace the draft's parties and fields, and `PATCH` changes its details. A recipient's `access_code` is hashed and never returned. After a send, only `name` and `vendor_id` can change. To fix a sent envelope, `POST .../correct` voids it, then create a draft with `corrected_from_id` and send that. Correcting needs a signed-in user.

`GET /v1/signature-sources/{source_id}/document` returns a link to a vendor document or uploaded file as a PDF, or `is_ready` false while it converts. `GET /v1/signature-contract-documents?contract_ids=...` lists the documents filed against up to 25 contracts. `POST /v1/signature-send-copy` suggests a subject, an opening line and a signing meaning, and saves nothing.

### Signing policy

`GET /v1/signature-config` returns the org's signing policy and the seal level it can produce now. `PATCH` changes it, and changing the consent disclosure starts a new version. `POST .../email-preview` renders one signing email against sample values and sends nothing. Changing the policy and previewing need organization settings permission, which API keys do not hold, so use a key created by a person whose role holds it.

### Content library and written documents

`GET /v1/signature-content-blocks` lists your reusable passages, and `POST` adds one. `GET .../library` lists the starter passages Coverbase ships, and `POST .../library/{slug}/adopt` copies one into your library. `PATCH .../{block_id}` changes a passage. Setting `is_archived` needs a signed-in user.

`POST /v1/signature-authored-documents` writes a document in Markdown and renders it to a PDF. Use its `rendered_file_id` as a template's `source_file_id` or an envelope's `file_ids`. `PUT .../{document_id}` saves a new version, and the earlier PDF stays for envelopes that use it.

### Bulk send

`GET /v1/signature-bulk-sends/preflight?template_id=...` returns the roles each row must name, the labels a row may prefill, and how many envelopes your plan still allows. `POST /v1/signature-bulk-sends` sends one envelope per row from a published template and emails every recipient their own signing link. It checks the whole list first and refuses it with `422` and code `rows_not_sendable` if any row cannot be sent. Send `dry_run: true` to run that check without writing or sending anything. `GET /v1/signature-bulk-sends/{batch_id}` shows each row's progress, and `POST .../cancel` stops the rows not yet sent. No response returns a signing link or an access code.

### DocuSign

`GET /v1/contract-records/{contract_id}/signature` lists a contract's envelopes. `POST .../send-for-signature` sends an approved contract through DocuSign, which emails each recipient. It sends as the DocuSign account connected by the user the key acts as, and returns `409` with code `docusign_not_connected` when there is none.

`PUT .../signature-plan` names who signs before approval, for a policy that sends without asking once the last approver signs off. The send leaves as the DocuSign account of the user the key acts as. Send an empty `recipients` list to turn the automatic send off. `POST .../signature-envelopes/{envelope_id}/sync` pulls a DocuSign envelope's state now and files the executed copy once everyone signs. `POST .../abandon` frees a contract whose send never reached DocuSign. Check DocuSign first. Abandoning needs a signed-in user.

`POST /v1/signature-requests` sends a vendor document through DocuSign, with one signer per signature anchor in the document. DocuSign emails each signer.

## Data share

These endpoints need the engagement lifecycle. Without it they return `404` with code `not_enabled`. They need organization settings permission, which API keys do not hold, so use a key created by a person whose role holds it.

`GET /v1/data-share/tables` lists the tables every destination receives, and `GET /v1/data-share/setup` returns the role your S3 share role must trust. `GET /v1/data-share/destinations` lists destinations with their `health`. `POST` adds a Snowflake, S3 or BigQuery destination, and `PATCH .../{destination_id}` changes it. A `credential` you send goes to secret storage. No response returns it, only `has_credential` and `credential_hint`. `DELETE` archives a destination, deletes its credential, and needs a signed-in user.

`GET .../runs` lists a destination's syncs. `POST .../test` writes a probe with the stored credential. `POST .../sync` queues a sync and returns `202` with `queued: false` when one is already running. `GET /v1/data-share/distribution` lists everywhere your data goes out: destinations, the board pack and scheduled reports.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.