# List signature requests (/docs/api-reference/signature-requests/list-sign-requests)

Signature requests of the API key's environment, newest first. Pass the last `id` as `after` to get the next page while `has_more` is true.

`GET https://api.coss.com/v1/sign/requests`

Authenticate with your API key as a bearer token (`Authorization: Bearer coss_test_…`). Responses are JSON with snake_case fields; errors are `{ error: { type, code, message, param?, issues?, request_id } }` (https://coss.com/docs/api-reference/errors.md).

## Query parameters

- `status` (string): Only requests in these statuses, comma-separated: `sent,draft`.
- `limit` (integer, 1-100): 1-100, default 20.
- `after` (string, at most 64 characters): Cursor: the `id` of the last item of the previous page.

## Example request

TypeScript (the `coss` package):

```ts
import { Coss } from "coss";

const coss = new Coss({
  apiKey: process.env.COSS_API_KEY,
  baseUrl: "https://api.coss.com",
});

const { data, error } = await coss.sign.requests.list();
```

HTTP:

```sh
curl -X GET "https://api.coss.com/v1/sign/requests" \
  -H "Authorization: Bearer $COSS_API_KEY"
```

## Response 200

A page of signature requests.

- `object` ("list", required)
- `data` (object[], required)
  - `object` ("sign_request", required)
  - `id` (string, required)
  - `status` ("draft" | "sent" | "completed" | "declined" | "canceled" | "expired", required): `draft` until sent, `sent` while signers sign, then `completed` (everyone signed), `declined` (a signer declined), `canceled` or `expired`.
  - `title` (string, required)
  - `message` (string | null, required)
  - `signing_order` ("parallel" | "sequential", required)
  - `documents` (object[], required)
    - `id` (string, required)
    - `filename` (string, required)
    - `sha256` (string, required)
    - `page_count` (integer, required)
  - `signers` (object[], required)
    - `object` ("sign_signer", required)
    - `id` (string, required)
    - `name` (string, required)
    - `email` (string, required)
    - `order` (integer, required)
    - `delivery` ("embedded" | "email", required)
    - `authentication` ("email_link" | "customer_asserted", required): How the signer is identified: `email_link` (they opened the link coss.com emailed) or `customer_asserted` (your app vouched for them).
    - `status` ("pending" | "notified" | "viewed" | "signed" | "declined", required)
    - `client_ref` (string | null, required)
    - `viewed_at` (string | null, required, date-time)
    - `signed_at` (string | null, required, date-time)
    - `declined_at` (string | null, required, date-time)
    - `decline_reason` (string | null, required)
  - `fields` (object[], required)
    - `object` ("sign_field", required)
    - `id` (string, required)
    - `signer_id` (string, required)
    - `document_id` (string, required)
    - `type` ("signature" | "initials" | "date_signed" | "name" | "email" | "text" | "checkbox", required)
    - `page` (integer, required)
    - `x` (number, required)
    - `y` (number, required)
    - `width` (number, required)
    - `height` (number, required)
    - `required` (boolean, required)
    - `label` (string | null, required)
    - `anchor` (string | null, required)
  - `metadata` (map of string, required)
  - `sandbox` (boolean, required)
  - `reminder_interval_days` (integer | null, required): Days between automatic reminders to email signers; `null`: none.
  - `expires_at` (string | null, required, date-time)
  - `expired_at` (string | null, required, date-time)
  - `sent_at` (string | null, required, date-time)
  - `completed_at` (string | null, required, date-time)
  - `canceled_at` (string | null, required, date-time)
  - `declined_at` (string | null, required, date-time)
  - `signed_document` (object | null, required): The completed document, sealed by coss.com: every document with the signatures and values filled in, and a certificate of completion. `null` until it is ready (shortly after `completed`, announced by the `sign_request.completed` webhook); download it from `GET /v1/sign/requests/{id}/signed_document`.
    - `sha256` (string, required): Hex SHA-256 of the sealed PDF.
    - `sealed_at` (string, required, date-time)
  - `created_at` (string, required, date-time)
- `has_more` (boolean, required)

Example:

```json
{
  "object": "list",
  "data": [],
  "has_more": false
}
```

## Errors

- `400`: The `Coss-Version` header names an unknown API version (`invalid_api_version`).
- `401`: The API key is missing, invalid, revoked or expired (`authentication_error`).
- `403`: The API key lacks the permission this endpoint needs (`permission_error`), or its organization is suspended (`organization_suspended`).
- `422`: A query parameter failed validation (`validation_error`, see `issues`).
- `429`: Too many requests with this API key (`rate_limited`), or too many requests with invalid keys from this address (`too_many_failed_authentications`). Retry after `Retry-After` seconds. Successful responses carry `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` (seconds until the limit is fully restored).
- `500`: Unexpected server error (`api_error` / `internal_error`).
- `503`: The API key could not be verified right now; retry (`service_unavailable`).