EsignCenter has a REST API, outgoing webhooks, embedded signing and an MCP tool set. They are paid-plan features: on the free plan the pages are visible but the doors are closed, and an API call answers This feature requires a paid plan. The full endpoint-by-endpoint reference is at the API reference.
Getting a token
- Go to Settings → API.
- Copy your token. Send it on every request as the
X-Auth-Tokenheader. - The base URL is your EsignCenter address followed by
/api— for examplehttps://esigncenter.com/api.
A token belongs to a user and carries that user's access. Keep it on your own server: it must never appear in browser code, a mobile app or a public repository.
Legacy integration identities are for document API work on their own account; they cannot manage users, billing or company settings. Ask a human account administrator to issue a normal API token and retire the legacy identity.
What the API does
The usual shape is: create a template (or reuse one you built in the builder), create a submission naming the people who sign, then wait to be told it is finished and fetch the documents. You can also list and read templates, submissions and signers, pre-fill values, and download the completed PDFs and the audit trail.
Embedded signing and signing sessions put the signing page inside your own application, framed only by the origin you name. MCP exposes the same actions to an AI assistant.
Webhooks
Add an endpoint under Settings → Webhooks and pick the events you want:
form.viewed,form.started,form.completed,form.declined— one signer's progress.submission.created,submission.completed,submission.expired,submission.archived— the whole document.template.created,template.updated.
A delivery we cannot make (any 4xx or 5xx answer) is retried a number of times, with the gap growing after each attempt, before we give up. Your endpoint should answer quickly and do its real work afterwards.
Two things worth knowing
Marking a signer complete is your responsibility. If your
integration creates a signer with completed: true, no human sat
at our signing page, so no electronic-signature consent is collected or
claimed. The audit trail records that completion as made through the API, and
obtaining that person's consent is your application's job. Signers who go
through our pages always see the consent step described in
Signing a document.
A suspended or read-only account closes the machine doors. An unpaid card or a scheduled deletion makes API tokens, webhooks and embedded sessions answer that the account is not active, while people can still sign in and download. See Billing and your free trial.
Stuck on something the reference does not answer? Write to us.