# Create a signature request (/docs/api-reference/signature-requests/create-sign-request) Asks one or more signers to sign one or more PDFs. Give documents by id (uploaded) or inline, and each signer's fields by position (`page`, `x`, `y`, `width`, `height` in PDF points from the page's top left) or by text anchor (`{{signature:signer_1}}`). Every signer needs a `signature` field. Sent at once unless `send` is `false` (a `draft`). Each signer signs by email (`delivery: "email"`, the default) or in your app (`"embedded"`). `POST https://api.coss.com/v1/sign/requests` Authenticate with your API key as a bearer token (`Authorization: Bearer coss_test_…`). Responses are JSON with snake_case fields; errors are `{ error: { type, code, message, param?, issues?, request_id } }` (https://coss.com/docs/api-reference/errors.md). ## Headers - `Idempotency-Key` (string, 1-256 characters): Makes retries safe: a repeated request with the same key and body returns the original request (in its current state) instead of creating another, for 24 hours. 1-256 characters. ## Request body - `title` (string, required, 1-200 characters): Shown to signers. - `message` (string, at most 2000 characters): A note to signers. - `documents` (object[], required, 1-10 items): Uploaded documents by id, or PDFs inline (base64). - One of (1): - `document_id` (string, required): An uploaded document. - One of (2): - `filename` (string, required, 1-255 characters): The file's name, ending in `.pdf`. - `content` (string, required, at least 1 character): The PDF's bytes, base64-encoded (at most 25 MB decoded). - `signers` (object[], required, 1-20 items) - `name` (string, required, 1-200 characters) - `email` (string, required, email, at most 254 characters) - `delivery` ("embedded" | "email"): `email` (default): coss.com emails the signer a link. `embedded`: your app shows the signing page (create a session) and vouches for who the signer is. - `order` (integer, 1-20): With `signing_order: "sequential"`, signers sign in increasing `order` (default: their position in `signers`). - `client_ref` (string, 1-255 characters): Your own id for the signer, recorded in the audit trail. - `fields` (object[], required, at most 500 items): What this signer fills. Every signer needs at least one `signature` field. - One of (1): - `type` ("signature" | "initials" | "date_signed" | "name" | "email" | "text" | "checkbox", required): `signature` and `initials` take the signer's adopted signature, `date_signed` is filled with the signing date, `name` and `email` with the signer's, `text` and `checkbox` by the signer. - `required` (boolean): Default `true`. A signer can't finish with a required field empty. - `label` (string, 1-100 characters): Shown to the signer. - `document` (integer, at least 0): Index of the document in `documents` (default 0). - `page` (integer, required, at least 1): 1-based page number. - `x` (number, required, at least 0): Left edge, in PDF points from the page's left. - `y` (number, required, at least 0): Top edge, in PDF points from the page's top. - `width` (number, required) - `height` (number, required) - One of (2): - `type` ("signature" | "initials" | "date_signed" | "name" | "email" | "text" | "checkbox", required): `signature` and `initials` take the signer's adopted signature, `date_signed` is filled with the signing date, `name` and `email` with the signer's, `text` and `checkbox` by the signer. - `required` (boolean): Default `true`. A signer can't finish with a required field empty. - `label` (string, 1-100 characters): Shown to the signer. - `anchor` (string, required): Place the field over every occurrence of this text in the documents (e.g. `{{signature:signer_1}}`). - `width` (number): Default: the anchor text's width. - `height` (number): Default: the anchor text's height. - `offset_x` (number): Points to move it right. - `offset_y` (number): Points to move it down. - `signing_order` ("parallel" | "sequential"): `parallel` (default): everyone at once. `sequential`: in each signer's `order`. - `expires_at` (string, date-time): When unsigned requests expire (at most 365 days ahead). - `metadata` (map of string): Your own key-value pairs, returned with the request and its webhooks. - `reminder_interval_days` (integer | null, 1-30): Email signers who haven't signed get a reminder every this many days (up to 3). Default: your Sign settings' `reminder_interval_days`; `null`: none. - `send` (boolean): Default `true`: send at once. `false` keeps a `draft` to send later. ## Example request TypeScript (the `coss` package): ```ts import { Coss } from "coss"; const coss = new Coss({ apiKey: process.env.COSS_API_KEY, baseUrl: "https://api.coss.com", }); const { data, error } = await coss.sign.requests.create({ title: "Services agreement", documents: [ { document_id: "sdoc_01k7c8m4q2f3e9v6t5r1n0p8yz", }, ], signers: [ { name: "Ada Lovelace", email: "ada@example.com", fields: [ { type: "signature", anchor: "{{signature:signer_1}}", }, { type: "date_signed", page: 2, x: 320, y: 640, width: 120, height: 18, }, ], }, ], }, { idempotencyKey: "welcome-user-123", }); ``` HTTP: ```sh curl -X POST "https://api.coss.com/v1/sign/requests" \ -H "Authorization: Bearer $COSS_API_KEY" \ -H "Idempotency-Key: welcome-user-123" \ -H "Content-Type: application/json" \ -d '{ "title": "Services agreement", "documents": [ { "document_id": "sdoc_01k7c8m4q2f3e9v6t5r1n0p8yz" } ], "signers": [ { "name": "Ada Lovelace", "email": "ada@example.com", "fields": [ { "type": "signature", "anchor": "{{signature:signer_1}}" }, { "type": "date_signed", "page": 2, "x": 320, "y": 640, "width": 120, "height": 18 } ] } ] }' ``` ## Response 201 The signature request (`sent`, or `draft`). A replay returns the original request in its current state. - `object` ("sign_request", required) - `id` (string, required) - `status` ("draft" | "sent" | "completed" | "declined" | "canceled" | "expired", required): `draft` until sent, `sent` while signers sign, then `completed` (everyone signed), `declined` (a signer declined), `canceled` or `expired`. - `title` (string, required) - `message` (string | null, required) - `signing_order` ("parallel" | "sequential", required) - `documents` (object[], required) - `id` (string, required) - `filename` (string, required) - `sha256` (string, required) - `page_count` (integer, required) - `signers` (object[], required) - `object` ("sign_signer", required) - `id` (string, required) - `name` (string, required) - `email` (string, required) - `order` (integer, required) - `delivery` ("embedded" | "email", required) - `authentication` ("email_link" | "customer_asserted", required): How the signer is identified: `email_link` (they opened the link coss.com emailed) or `customer_asserted` (your app vouched for them). - `status` ("pending" | "notified" | "viewed" | "signed" | "declined", required) - `client_ref` (string | null, required) - `viewed_at` (string | null, required, date-time) - `signed_at` (string | null, required, date-time) - `declined_at` (string | null, required, date-time) - `decline_reason` (string | null, required) - `fields` (object[], required) - `object` ("sign_field", required) - `id` (string, required) - `signer_id` (string, required) - `document_id` (string, required) - `type` ("signature" | "initials" | "date_signed" | "name" | "email" | "text" | "checkbox", required) - `page` (integer, required) - `x` (number, required) - `y` (number, required) - `width` (number, required) - `height` (number, required) - `required` (boolean, required) - `label` (string | null, required) - `anchor` (string | null, required) - `metadata` (map of string, required) - `sandbox` (boolean, required) - `reminder_interval_days` (integer | null, required): Days between automatic reminders to email signers; `null`: none. - `expires_at` (string | null, required, date-time) - `expired_at` (string | null, required, date-time) - `sent_at` (string | null, required, date-time) - `completed_at` (string | null, required, date-time) - `canceled_at` (string | null, required, date-time) - `declined_at` (string | null, required, date-time) - `signed_document` (object | null, required): The completed document, sealed by coss.com: every document with the signatures and values filled in, and a certificate of completion. `null` until it is ready (shortly after `completed`, announced by the `sign_request.completed` webhook); download it from `GET /v1/sign/requests/{id}/signed_document`. - `sha256` (string, required): Hex SHA-256 of the sealed PDF. - `sealed_at` (string, required, date-time) - `created_at` (string, required, date-time) Example: ```json { "object": "sign_request", "id": "sreq_01k7c8m4q2f3e9v6t5r1n0p8yz", "status": "sent", "title": "Services agreement", "message": null, "signing_order": "parallel", "documents": [ { "id": "sdoc_01k7c8m4q2f3e9v6t5r1n0p8yz", "filename": "agreement.pdf", "sha256": "9f2c6c0f0e1d4b7a8c5e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c", "page_count": 2 } ], "signers": [ { "object": "sign_signer", "id": "ssgn_01k7c8m4q2f3e9v6t5r1n0p8yz", "name": "Ada Lovelace", "email": "ada@example.com", "order": 1, "delivery": "email", "authentication": "email_link", "status": "pending", "client_ref": null, "viewed_at": null, "signed_at": null, "declined_at": null, "decline_reason": null } ], "fields": [ { "object": "sign_field", "id": "sfld_01k7c8m4q2f3e9v6t5r1n0p8yz", "signer_id": "ssgn_01k7c8m4q2f3e9v6t5r1n0p8yz", "document_id": "sdoc_01k7c8m4q2f3e9v6t5r1n0p8yz", "type": "signature", "page": 2, "x": 72, "y": 640, "width": 140, "height": 12, "required": true, "label": null, "anchor": "{{signature:signer_1}}" } ], "metadata": {}, "sandbox": false, "reminder_interval_days": 3, "expires_at": null, "expired_at": null, "sent_at": "2026-10-26T15:04:05.000Z", "completed_at": null, "canceled_at": null, "declined_at": null, "signed_document": null, "created_at": "2026-10-26T15:04:05.000Z" } ``` ## Errors - `400`: The body is not valid JSON (`invalid_json`) or the `Idempotency-Key` header is invalid (`invalid_idempotency_key`). Also when the `Coss-Version` header names an unknown API version (`invalid_api_version`). - `401`: The API key is missing, invalid, revoked or expired (`authentication_error`). - `403`: The API key lacks the permission this endpoint needs (`permission_error`), or its organization is suspended (`organization_suspended`). - `409`: Requests with this `Idempotency-Key` are racing for an expired key (`request_in_progress`). - `413`: The request body is larger than 40 MB (`payload_too_large`). - `415`: The body is not sent as `application/json` (`unsupported_media_type`). - `422`: The body failed validation (`validation_error`, see `issues`), a document isn't a PDF coss.com can read (`invalid_document`) or isn't in the environment (`not_found`), a field doesn't fit on its page or names an anchor no document has (`invalid_fields`), a signer is listed twice (`invalid_signers`), `expires_at` is out of range (`invalid_expiry`), or the `Idempotency-Key` was already used with a different body (`idempotency_key_reused`). - `429`: Too many requests with this API key (`rate_limited`), or too many requests with invalid keys from this address (`too_many_failed_authentications`). Retry after `Retry-After` seconds. Successful responses carry `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` (seconds until the limit is fully restored). - `500`: Unexpected server error (`api_error` / `internal_error`). - `503`: Sign isn't available in this deployment yet (`sign_unavailable`).