Limits and paging

What the API will take, and how to walk a long list.

Rate limits

Each key may make 300 requests a minute. Every answer to a request made with a key says where it stands:

Past the limit the answer is 429 rate_limited with Retry-After in seconds. Wait that long rather than guessing: three quick retries land in the same window, fail the same way, and spend the next window's budget as well. Some actions have smaller budgets of their own, named in the refusal: a fresh signing link is ten a minute per document, and three hundred one-time codes by text an hour across a business's signers. The routes a signing link opens have theirs below.

A signer's own one-time code is paced rather than budgeted, and refused with 422 invalid, not 429: one a minute and five an hour for each signer, and none after fifteen wrong guesses in a day; six an hour and twenty a day to one email address or number, whichever signer and business asks; and none to an address after fifteen wrong guesses in a day at one form's documents, however many were started. The answer to asking for one says when the next may be asked for, as resend_after (Your own signing page).

Reminders

A reminder is refused with 422, naming why and leaving the signer's link as it was, inside an hour of the last one to that signer, past three to one signer in a day, or past twenty-five for one document in a day. The dashboard's Remind button, the API and the automatic reminders all count.

One by text. A signer is texted at most one reminder over the life of their link, because that is what the words they agreed to before we texted them say. The dashboard's, the API's, the automatic one and a party's link sent again by the person who booked all count toward it. After that one, a reminder goes by email alone, and by in the answer says email; for a signer with no email address we may use, it is refused with 422, saying they have had the one reminder by text they agreed to, and their link is left as it was.

Photos on a signing link

Photos are read one at a time, with a few waiting, and one business holds at most two of the places to wait. A photo that arrives while the places are full, or while another photo from the same link is still being read, is refused with 429 busy and Retry-After (thirty seconds): nothing was kept, so send the same photo again after that long.

How many people a business sends to

The people a business sends signing links to are counted across every send, workflow, form and party, by email and text alike (an address and a number for one signer are two; reminders are not counted), against a ceiling an hour and a day that grows with how far the business is trusted so far:

A send that would cross the line is refused whole with 429 rate_limited and Retry-After, so nobody on it was sent anything. Reports from people who did not expect the mail, bounces and complaints can hold a business below the standing the table gives it for a while, and we can set one by hand; ask us from Help if your business needs more. A test key's sandbox sends nothing and counts nothing.

While a business is New or Normal, Send and Bulk send in the dashboard say how many more people it can send to and when the hour and the day turn over, in the business's timezone; the day turns at midnight UTC. A list longer than that is said before it goes: each row is its own send, so the rows that fit go and the rest are refused and listed with their line numbers.

Screening

Every message a business sends to somebody outside it — the link, a reminder, a party's link, the completed copy, a code — is read before it leaves. Most go at once. Some are held for a person to look at, usually for a few hours, and a few are not sent, with the reason on the document's page in the dashboard. The API's answer does not change either way: a send's 200 says the links were made and the messages queued, not that they arrived, and nothing in the API says a message is held yet.

Keys and endpoints

A business holds ten live API keys until it is paying, and fifty from then; past that, issuing one is refused until one is revoked. A tablet's credential, a partner's access token and a connected booking system's key are not counted. It has at most twenty webhook endpoints.

Paging

GET /v1/documents pages with limit (1 to 200, 50 when absent) and offset, newest first, and answers beside the page:

{ "documents": [ … ], "total": 312, "has_more": true, "limit": 50, "offset": 0 }

Ask for the next page with offset plus limit until has_more is false. A document made while you walk appears at the front and moves everything after it along by one, so an integration that must see every document once should also find them by what it knows: its own reference (?external_ref=), or the webhook that told it about them.

The other lists are short enough to answer whole: templates (every version), workflows, webhook endpoints, tablets. An endpoint's deliveries are its last fifty.

Sizes

• A request body is at most a megabyte; larger is 413 too_large.
• A document has at most fifty signers; a template at most fifty questions.
• external_ref is up to 200 characters; metadata up to twenty names of up to 40 characters, each with text of up to 500.
• An idempotency key is 8 to 255 characters and is remembered for 24 hours.

Limits on signing links and public forms

The routes that take no key — a signing link, a certificate check, a public form, a party link — have budgets of their own. Most are counted against the thing being used rather than against whoever is using it. A signing link's budget is the link's: the signer's browser and your own server share it, and asking from another address does not start a fresh one.

A mobile number typed on a public form or a party link with texts ticked is confirmed before anything else is texted to it: it is sent a six-digit code, and only when the code is typed back on the page is the consent recorded and, on a form, the link texted. A code works for ten minutes and five tries. To one number, across every business, we text a code a minute, five an hour and ten a day, and none after fifteen wrong tries in a day.

A code a signer types on their own signing page, by email or by text, is limited for the link (one a minute, five an hour, none after fifteen wrong tries in a day) and for the address it goes to, across every link and every business: six an hour and twenty a day, and none after fifteen wrong tries in a day at one form's documents. They are refused in words on the page rather than counted here.

An inbox is counted however it is typed: case, a +tag and Gmail's dots make no difference. Windows are fixed rather than rolling: a minute starts on the minute, an hour on the hour, and a day at midnight UTC.

Over a limit, the API's keyless routes (/v1/sign/{token} and the routes under it, and /v1/verify/{code}) answer 429 rate_limited. The message names the limit and its budget (rate limit reached for signing.token_lookup: 20 per 60 seconds), the hint says when to try again, and Retry-After says the same in seconds. There are no X-RateLimit-* headers on these routes: those describe a key's budget, and there is no key. The public form and the party page are pages, not API routes: a start or a place refused there is drawn again with the reason in words, and nothing is made.

This page as Markdown Ask an AI about it: ChatGPT · Claude · Perplexity · Google AI · Grok