# Create a request from a template (/docs/api-reference/sign-templates/create-sign-request-from-template)

A signature request with the template's documents and fields: name one signer for each role, and give its merge fields' values. Like creating a request, it is sent at once unless `send` is `false`, and an `Idempotency-Key` makes retries safe.

`POST https://api.coss.com/v1/sign/templates/{id}/requests`

Authenticate with your API key as a bearer token (`Authorization: Bearer coss_test_…`). Responses are JSON with snake_case fields; errors are `{ error: { type, code, message, param?, issues?, request_id } }` (https://coss.com/docs/api-reference/errors.md).

## Path parameters

- `id` (string, required): The template's id.

## Headers

- `Idempotency-Key` (string, 1-256 characters): Makes retries safe: a repeated request with the same key and body returns the original request (in its current state) instead of creating another, for 24 hours. 1-256 characters.

## Request body

- `title` (string, 1-200 characters): Default: the template's title (else its name).
- `message` (string, at most 5000 characters)
- `signers` (object[], required, 1-20 items): One signer for each of the template's roles.
  - `role` (string, required): The role's key, e.g. `client`.
  - `name` (string, required, 1-200 characters)
  - `email` (string, required, email, at most 254 characters)
  - `delivery` ("embedded" | "email")
  - `order` (integer, 1-20)
  - `client_ref` (string, 1-255 characters)
- `merge_fields` (map of string): Values of the template's merge fields, by `merge_key`.
- `signing_order` ("parallel" | "sequential"): Default: the template's.
- `expires_at` (string, date-time)
- `metadata` (map of string): Your own key-value pairs, returned with the request and its webhooks.
- `reminder_interval_days` (integer | null, 1-30)
- `send` (boolean): Default `true`.

## Example request

TypeScript (the `coss` package):

```ts
import { Coss } from "coss";

const coss = new Coss({
  apiKey: process.env.COSS_API_KEY,
  baseUrl: "https://api.coss.com",
});

const { data, error } = await coss.sign.templates.createRequest("stpl_01k7c8m4q2f3e9v6t5r1n0p8yz", {
  signers: [
    {
      role: "client",
      name: "Ada Lovelace",
      email: "ada@example.com",
    },
    {
      role: "company",
      name: "Grace Hopper",
      email: "grace@acme.com",
      delivery: "embedded",
    },
  ],
  merge_fields: {
    client_company: "Analytical Engines Ltd",
  },
}, {
  idempotencyKey: "welcome-user-123",
});
```

HTTP:

```sh
curl -X POST "https://api.coss.com/v1/sign/templates/stpl_01k7c8m4q2f3e9v6t5r1n0p8yz/requests" \
  -H "Authorization: Bearer $COSS_API_KEY" \
  -H "Idempotency-Key: welcome-user-123" \
  -H "Content-Type: application/json" \
  -d '{
  "signers": [
    {
      "role": "client",
      "name": "Ada Lovelace",
      "email": "ada@example.com"
    },
    {
      "role": "company",
      "name": "Grace Hopper",
      "email": "grace@acme.com",
      "delivery": "embedded"
    }
  ],
  "merge_fields": {
    "client_company": "Analytical Engines Ltd"
  }
}'
```

## Response 201

The signature request.

- `object` ("sign_request", required)
- `id` (string, required)
- `status` ("draft" | "sent" | "completed" | "declined" | "canceled" | "expired", required): `draft` until sent, `sent` while signers sign, then `completed` (everyone signed), `declined` (a signer declined), `canceled` or `expired`.
- `title` (string, required)
- `message` (string | null, required)
- `signing_order` ("parallel" | "sequential", required)
- `documents` (object[], required)
  - `id` (string, required)
  - `filename` (string, required)
  - `sha256` (string, required)
  - `page_count` (integer, required)
- `signers` (object[], required)
  - `object` ("sign_signer", required)
  - `id` (string, required)
  - `name` (string, required)
  - `email` (string, required)
  - `order` (integer, required)
  - `delivery` ("embedded" | "email", required)
  - `authentication` ("email_link" | "customer_asserted", required): How the signer is identified: `email_link` (they opened the link coss.com emailed) or `customer_asserted` (your app vouched for them).
  - `status` ("pending" | "notified" | "viewed" | "signed" | "declined", required)
  - `client_ref` (string | null, required)
  - `viewed_at` (string | null, required, date-time)
  - `signed_at` (string | null, required, date-time)
  - `declined_at` (string | null, required, date-time)
  - `decline_reason` (string | null, required)
- `fields` (object[], required)
  - `object` ("sign_field", required)
  - `id` (string, required)
  - `signer_id` (string, required)
  - `document_id` (string, required)
  - `type` ("signature" | "initials" | "date_signed" | "name" | "email" | "text" | "checkbox", required)
  - `page` (integer, required)
  - `x` (number, required)
  - `y` (number, required)
  - `width` (number, required)
  - `height` (number, required)
  - `required` (boolean, required)
  - `label` (string | null, required)
  - `anchor` (string | null, required)
- `metadata` (map of string, required)
- `sandbox` (boolean, required)
- `reminder_interval_days` (integer | null, required): Days between automatic reminders to email signers; `null`: none.
- `expires_at` (string | null, required, date-time)
- `expired_at` (string | null, required, date-time)
- `sent_at` (string | null, required, date-time)
- `completed_at` (string | null, required, date-time)
- `canceled_at` (string | null, required, date-time)
- `declined_at` (string | null, required, date-time)
- `signed_document` (object | null, required): The completed document, sealed by coss.com: every document with the signatures and values filled in, and a certificate of completion. `null` until it is ready (shortly after `completed`, announced by the `sign_request.completed` webhook); download it from `GET /v1/sign/requests/{id}/signed_document`.
  - `sha256` (string, required): Hex SHA-256 of the sealed PDF.
  - `sealed_at` (string, required, date-time)
- `created_at` (string, required, date-time)

Example:

```json
{
  "object": "sign_request",
  "id": "sreq_01k7c8m4q2f3e9v6t5r1n0p8yz",
  "status": "sent",
  "title": "Services agreement",
  "message": null,
  "signing_order": "parallel",
  "documents": [
    {
      "id": "sdoc_01k7c8m4q2f3e9v6t5r1n0p8yz",
      "filename": "agreement.pdf",
      "sha256": "9f2c6c0f0e1d4b7a8c5e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c",
      "page_count": 2
    }
  ],
  "signers": [
    {
      "object": "sign_signer",
      "id": "ssgn_01k7c8m4q2f3e9v6t5r1n0p8yz",
      "name": "Ada Lovelace",
      "email": "ada@example.com",
      "order": 1,
      "delivery": "email",
      "authentication": "email_link",
      "status": "pending",
      "client_ref": null,
      "viewed_at": null,
      "signed_at": null,
      "declined_at": null,
      "decline_reason": null
    }
  ],
  "fields": [
    {
      "object": "sign_field",
      "id": "sfld_01k7c8m4q2f3e9v6t5r1n0p8yz",
      "signer_id": "ssgn_01k7c8m4q2f3e9v6t5r1n0p8yz",
      "document_id": "sdoc_01k7c8m4q2f3e9v6t5r1n0p8yz",
      "type": "signature",
      "page": 2,
      "x": 72,
      "y": 640,
      "width": 140,
      "height": 12,
      "required": true,
      "label": null,
      "anchor": "{{signature:signer_1}}"
    }
  ],
  "metadata": {},
  "sandbox": false,
  "reminder_interval_days": 3,
  "expires_at": null,
  "expired_at": null,
  "sent_at": "2026-10-26T15:04:05.000Z",
  "completed_at": null,
  "canceled_at": null,
  "declined_at": null,
  "signed_document": null,
  "created_at": "2026-10-26T15:04:05.000Z"
}
```

## Errors

- `400`: The body is not valid JSON (`invalid_json`) or the `Idempotency-Key` header is invalid (`invalid_idempotency_key`). Also when the `Coss-Version` header names an unknown API version (`invalid_api_version`).
- `401`: The API key is missing, invalid, revoked or expired (`authentication_error`).
- `403`: The API key lacks the permission this endpoint needs (`permission_error`), or its organization is suspended (`organization_suspended`).
- `404`: No template with this id exists in the API key's environment (`not_found`).
- `409`: Requests with this `Idempotency-Key` are racing (`request_in_progress`).
- `422`: The template isn't ready (`template_incomplete`), a role has no signer or two (`invalid_signers`), a merge field doesn't exist (`invalid_fields`), `expires_at` is out of range (`invalid_expiry`), or the `Idempotency-Key` was used with a different body (`idempotency_key_reused`).
- `429`: Too many requests with this API key (`rate_limited`), or too many requests with invalid keys from this address (`too_many_failed_authentications`). Retry after `Retry-After` seconds. Successful responses carry `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` (seconds until the limit is fully restored).
- `500`: Unexpected server error (`api_error` / `internal_error`).
- `503`: Sign isn't available in this deployment yet (`sign_unavailable`).