EaserixDocs
DevelopersAPI referenceSignVerification

Confirm a signing request is genuine

EAS-122. Resolves a verification code — printed in every signature-request email, independent of and never derivable from the recipient's actual signing token — to the minimal facts needed to recognize the request: who really sent it, which document, when, and its current status. Never returns document contents, field values, a file URL, or any recipient's email address. This confirms the request RECORD is genuine; it does not and cannot vouch that the sender is trustworthy or that their account hasn't been compromised. Unauthenticated, IP rate-limited tighter than the rest of the public surface (resolving a short code by exact match is the one public route here where guessing is realistic). An unknown code and a malformed one return the identical 404 — there is no way to distinguish "never issued" from "garbage input".

View as Markdown
GET
/public/verify/{code}

Path Parameters

code*string

The human-shareable code from a signature-request email, e.g. K7QX-2M9B

Response Body

application/json

application/json

application/json

curl -X GET "https://example.com/public/verify/string"
{  "found": true,  "senderName": "string",  "senderDomain": "string",  "documentName": "string",  "sentAt": "2019-08-24T14:15:22Z",  "status": "in progress"}

Upload a file to a file-upload field (EAS-110)

One active upload per field — a second upload to the same field replaces the first. Requires the same signing state PublicComplete does: pending document, before the deadline, this recipient's turn (sequential mode), not yet signed or declined. The field must be assigned to the caller's recipient/group slot and be of type "file". Content is validated by its actual bytes, never the multipart Content-Type or filename — narrower per-field allowedTypes/maxSizeBytes (DocumentField.config) can restrict this further than the system default (PDF, JPEG, PNG; 25 MB).

Check a public link's availability

Never creates anything. One generic 404 for every pre-verification failure — bad token, paused, expired, or never existed — so there is no oracle for probing which case it is. Unauthenticated, IP rate-limited.