Build with BuiltSign

curl -X POST https://builtsign.com/api/v1/documents/upload \
  -H "X-API-Key: bsk_live_xxxxxxxxxxxxxxxxxxxx" \
  -F "file=@contract.pdf"

curl -X POST https://builtsign.com/api/v1/signing-requests \
  -H "X-API-Key: bsk_live_xxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "document_id": "doc_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "signers": [
      { "name": "Jan de Vries", "email": "jan@example.com" }
    ],
    "message": "Graag de offerte ondertekenen.",
    "expires_in_days": 7,
    "auto_send": false
  }'

curl -X POST https://builtsign.com/api/v1/signing-requests/{request_id}/fields \
  -H "X-API-Key: bsk_live_xxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "fields": [
      {
        "signer_id": "sgn_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
        "field_type": "signature",
        "page_number": 1,
        "x_percent": 60.0,
        "y_percent": 82.0,
        "width_percent": 30.0,
        "height_percent": 8.0
      }
    ]
  }'

{
  "event": "signer.signed",
  "timestamp": "2026-05-02T10:30:00Z",
  "webhook_id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "data": {
    "signer_id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "signing_request_id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  }
}

import crypto from "crypto";

// Express middleware example
app.post("/webhook", express.raw({ type: "application/json" }), (req, res) => {
  const signature = req.headers["x-webhook-signature"];
  const secret    = process.env.BUILTSIGN_WEBHOOK_SECRET;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(req.body) // raw Buffer, not parsed JSON
    .digest("hex");

  if (expected !== signature) {
    return res.status(401).send("Invalid signature");
  }

  const event = JSON.parse(req.body);
  // TODO: handle event (e.g. event.event === "document.signed")
  res.sendStatus(200);
});