> ## Documentation Index > Fetch the complete documentation index at: https://docs.clemta.com/llms.txt > Use this file to discover all available pages before exploring further. # Read a hosted link's context > What the hosted page renders: what is asked and of whom, plus your hosted-page branding. Authenticated by the token itself - no API key. ## OpenAPI ````yaml /partner/openapi.yaml get /requirement-links/{token} openapi: 3.1.0 info: title: Clemta Partner API description: | The Clemta partner surface. Authenticate with your API key as a bearer token (`Authorization: Bearer clmt_live_` or `clmt_test_`). Keys with the `clmt_test_` prefix operate in sandbox mode (`livemode: false`): test data never reaches fulfillment or billing. Versioning is date-based: pass `Clemta-Version` to pin a version, omit it to run on your account's pinned default. The effective version is echoed back on every response. version: '2026-08-13' servers: - url: https://api.clemta.com/v1 description: > Single host for both modes: `clmt_test_` keys operate in sandbox mode, `clmt_live_` keys in live mode. security: - apiKey: [] tags: - name: Identity description: Identify the calling API key. - name: Accounts description: >- Create and read customer accounts - the incorporators companies are created under. - name: Companies description: Create and read client companies. - name: Service orders description: Order services against a company and follow their fulfilment. - name: Products description: The catalog you can offer, at your wholesale prices. - name: Tax filings description: >- Federal and state tax filings on your companies, opened by your client against the company's entitlements and worked by Clemta. Read-only. Follow them with the tax_filing.* events. - name: Files description: >- Documents Clemta publishes on your companies - formation deliverables, filed forms, letters. Read-only. Client KYC uploads are write-only and never listed. - name: Requirements description: >- Everything needed from you or your client - identity documents, service-order forms, Clemta's asks - as one resolvable resource. Fulfill over the API or hand your client a hosted link. - name: Status tracking description: >- End-customer status links - keyless, read-only access to a company's live status. - name: Events description: Poll the partner event stream. - name: Webhooks description: >- Events we deliver to your endpoint, and how to verify them. Each webhook below is a request WE send to you. Respond 2xx to acknowledge. Deliveries are signed and retried with exponential backoff over multiple days until acknowledged. Answer `410 Gone` to have the endpoint disabled and deliveries stopped. A `Retry-After` header on a `429` or `503` pushes the next attempt back. An endpoint that fails continuously for days is disabled automatically and the workspace owner is emailed - no events are lost, the stream stays available on `GET /v1/events`. ## Verifying a delivery Deliveries are signed per the [Standard Webhooks](https://www.standardwebhooks.com) specification, carrying BOTH schemes in one header: a symmetric `v1` HMAC (verify with your endpoint secret and any standardwebhooks library) and an asymmetric `v1a` ed25519 signature (verify with the endpoint's public key, no shared secret held). Use whichever suits your setup. Every endpoint has its OWN signing secret (`whsec_...`), shown once when you create the endpoint. Each delivery carries three headers: - `Clemta-Webhook-Id` - the event id. Stable across retries: use it as an idempotency key so a redelivered event is processed once. - `Clemta-Webhook-Timestamp` - unix seconds of THIS attempt (a retry carries a fresh one). - `Clemta-Webhook-Signature` - a space-delimited list of `v1,` signatures. More than one while a secret rotation's overlap window is open, one per active secret. Each is also sent under its bare Standard Webhooks name (`webhook-id`, `webhook-timestamp`, `webhook-signature`) with the same value, which is what off-the-shelf standardwebhooks libraries look up. To verify by hand: 1. Build the signed content by joining the id, the timestamp, and the raw request body with literal `.` separators: `{id}.{timestamp}.{body}`. Use the body exactly as received - do not re-serialize the JSON. 2. Base64-decode your endpoint secret after the `whsec_` prefix. That is the HMAC key. 3. Compute HMAC-SHA256 over the signed content, base64 encode it, and compare it against each `v1,` entry in constant time. Accept if any matches, otherwise reject. 4. Check the timestamp is within 5 minutes of now, to reject replays. Because the secret is unique to your endpoint, a signature can only be verified by you - a delivery meant for another endpoint cannot be made to verify here. Keep the secret confidential. If it leaks, roll the endpoint's secret from the Webhooks page of your partner dashboard. - name: Sandbox description: >- Test-key-only endpoints for rehearsing event flows. Trigger a lifecycle transition on a test company and receive the matching webhook, without waiting for a real formation to progress. paths: /requirement-links/{token}: get: tags: - Requirements summary: Read a hosted link's context description: >- What the hosted page renders: what is asked and of whom, plus your hosted-page branding. Authenticated by the token itself - no API key. operationId: getRequirementLinkContext parameters: - $ref: '#/components/parameters/RequirementToken' responses: '200': description: The context. content: application/json: schema: $ref: '#/components/schemas/RequirementContext' '404': $ref: '#/components/responses/NotFound' security: [] components: parameters: RequirementToken: name: token in: path required: true description: The hosted token from a document link. schema: type: string pattern: ^rql_[0-9a-f]{48}$ schemas: RequirementContext: type: object description: >- What a hosted page shows, read through the link's own token - names only, no identifiers, since the holder is your client rather than you. required: - object - type - status properties: object: type: string enum: - requirement_context description: Entity name. type: type: string enum: - document - form - name_change - information - signature status: type: string enum: - open - resolved - canceled partner_name: type: string description: >- The partner name a hosted page brands itself with, resolved from the link token. company_name: type: string owner_name: type: string page: allOf: - $ref: '#/components/schemas/HostedPageInfo' description: The partner's hosted-page configuration - brand and legal footer. message: type: string form: $ref: '#/components/schemas/ServiceOrderForm' embed_origin: type: string description: >- The one origin allowed to frame this page, when the session was minted for embedding. The hosted page treats this as the authority and refuses to run framed anywhere else. Absent on ordinary sessions. HostedPageInfo: type: object description: >- The partner's hosted-page configuration: what a hosted page (identity upload, document signing) renders as its brand and legal footer. Absent fields fall back to partner_name and no links. properties: display_name: type: string support_email: type: string privacy_policy_url: type: string terms_url: type: string logo_url: type: string description: A servable URL for the partner's logo, when one is configured. icon_url: type: string description: >- A servable URL for the partner's square icon (favicon), when one is configured. accent_color: type: string ServiceOrderForm: type: object description: The form the order's current fulfilment step is waiting on. required: - fields properties: title: type: string warning: type: string description: A caution to show above the form. fields: type: array items: $ref: '#/components/schemas/ServiceFormFieldDef' Error: type: object description: >- Error response: a stable machine-readable `code`, human-readable `title`/`detail`, and for validation failures an `errors` array naming every violating field. required: - type - title - status - code additionalProperties: false properties: type: type: string description: Link to the error reference entry for this code. example: https://docs.clemta.com/partner/errors#resource_already_exists title: type: string description: Short human summary of the error class. status: type: integer format: int32 minimum: 100 maximum: 599 description: HTTP status code, also included in the body. code: type: string enum: - api_key_invalid - api_key_expired - insufficient_scope - ip_address_not_allowed - invalid_request - invalid_api_version - resource_missing - method_not_allowed - test_mode_only - resource_already_exists - idempotency_key_mismatch - idempotency_key_in_use - request_too_large - billing_account_inactive - entitlement_required - rate_limit - api_error description: Stable machine-readable code - branch on this, never on `detail`. detail: type: string description: Human-readable specifics of this occurrence, wording may change. request_id: type: string description: >- Identifier of this request. Quote it in a support request so we can trace the failure. errors: type: array description: 'Present on validation failures: one entry per violating field.' items: type: object required: - reason additionalProperties: false properties: reason: type: string location: type: string description: JSONPath of the failing field, e.g. `$.name`. validation_type: type: string description: Schema keyword that failed. how_to_fix: type: string ServiceFormFieldDef: type: object description: >- One field of a form. It carries every attribute you need to render the field in your own UI, and the server validates answers against the same definition. required: - field_name - field_type properties: key: type: string description: Stable field key - pass it back as the answer's `key`. field_name: type: string description: The field's label. field_type: type: string enum: - text - textarea - number - date - boolean - select - multi_select - file - email - phone - address description: >- What kind of answer the field takes. `select` takes one of `options`, `multi_select` a list of them, `date` an ISO date (YYYY-MM-DD), `file` a pre-uploaded file id (POST /v1/files, purpose additional_document). required: type: boolean options: type: array items: type: string description: Allowed values for select / multi_select. guidance: type: string description: Longer explanation of what is being asked. help: type: string description: Short helper text under the input. note: type: string description: A caution shown near the field. placeholder: type: string info_points: type: array items: type: string conditional: $ref: '#/components/schemas/FieldConditional' validation: $ref: '#/components/schemas/FieldValidation' file: $ref: '#/components/schemas/FieldFileRule' FieldConditional: type: object description: >- This field applies only while another field holds one of the listed values. required: - field - values properties: field: type: string description: Key of the controlling field. values: type: array items: type: string description: Any of these values on the controlling field switches this one on. FieldValidation: type: object description: >- Constraints an answer must satisfy beyond its type. The server enforces these. A violation answers `invalid_request` with the field named in `errors[]`. properties: pattern: type: string description: Regular expression a text answer must match. min_length: type: integer max_length: type: integer min: type: number description: Lower bound for a number. max: type: number FieldFileRule: type: object description: Constraints on a file field's upload. properties: accepted_types: type: array items: type: string description: >- Media types or extensions accepted (e.g. `application/pdf`, `jpg`). Absent means PDF, JPEG and PNG. max_size_bytes: type: integer format: int64 responses: NotFound: description: The requested resource does not exist, or is not yours. content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: apiKey: type: http scheme: bearer description: > Your API key, e.g. `Authorization: Bearer clmt_test_`. Live keys use the `clmt_live_` prefix. ````