> ## Documentation Index > Fetch the complete documentation index at: https://docs.clemta.com/llms.txt > Use this file to discover all available pages before exploring further. # List requirements > Everything currently (or previously) needed from you, newest first. Filter by company and/or status. Poll `status=open` to see what is outstanding. ## OpenAPI ````yaml /partner/openapi.yaml get /requirements openapi: 3.1.0 info: title: Clemta Partner API description: | The Clemta partner surface. Authenticate with your API key as a bearer token (`Authorization: Bearer clmt_live_` or `clmt_test_`). Keys with the `clmt_test_` prefix operate in sandbox mode (`livemode: false`): test data never reaches fulfillment or billing. Versioning is date-based: pass `Clemta-Version` to pin a version, omit it to run on your account's pinned default. The effective version is echoed back on every response. version: '2026-08-13' servers: - url: https://api.clemta.com/v1 description: > Single host for both modes: `clmt_test_` keys operate in sandbox mode, `clmt_live_` keys in live mode. security: - apiKey: [] tags: - name: Identity description: Identify the calling API key. - name: Accounts description: >- Create and read customer accounts - the incorporators companies are created under. - name: Companies description: Create and read client companies. - name: Service orders description: Order services against a company and follow their fulfilment. - name: Products description: The catalog you can offer, at your wholesale prices. - name: Tax filings description: >- Federal and state tax filings on your companies, opened by your client against the company's entitlements and worked by Clemta. Read-only. Follow them with the tax_filing.* events. - name: Files description: >- Documents Clemta publishes on your companies - formation deliverables, filed forms, letters. Read-only. Client KYC uploads are write-only and never listed. - name: Requirements description: >- Everything needed from you or your client - identity documents, service-order forms, Clemta's asks - as one resolvable resource. Fulfill over the API or hand your client a hosted link. - name: Status tracking description: >- End-customer status links - keyless, read-only access to a company's live status. - name: Events description: Poll the partner event stream. - name: Webhooks description: >- Events we deliver to your endpoint, and how to verify them. Each webhook below is a request WE send to you. Respond 2xx to acknowledge. Deliveries are signed and retried with exponential backoff over multiple days until acknowledged. Answer `410 Gone` to have the endpoint disabled and deliveries stopped. A `Retry-After` header on a `429` or `503` pushes the next attempt back. An endpoint that fails continuously for days is disabled automatically and the workspace owner is emailed - no events are lost, the stream stays available on `GET /v1/events`. ## Verifying a delivery Deliveries are signed per the [Standard Webhooks](https://www.standardwebhooks.com) specification, carrying BOTH schemes in one header: a symmetric `v1` HMAC (verify with your endpoint secret and any standardwebhooks library) and an asymmetric `v1a` ed25519 signature (verify with the endpoint's public key, no shared secret held). Use whichever suits your setup. Every endpoint has its OWN signing secret (`whsec_...`), shown once when you create the endpoint. Each delivery carries three headers: - `Clemta-Webhook-Id` - the event id. Stable across retries: use it as an idempotency key so a redelivered event is processed once. - `Clemta-Webhook-Timestamp` - unix seconds of THIS attempt (a retry carries a fresh one). - `Clemta-Webhook-Signature` - a space-delimited list of `v1,` signatures. More than one while a secret rotation's overlap window is open, one per active secret. Each is also sent under its bare Standard Webhooks name (`webhook-id`, `webhook-timestamp`, `webhook-signature`) with the same value, which is what off-the-shelf standardwebhooks libraries look up. To verify by hand: 1. Build the signed content by joining the id, the timestamp, and the raw request body with literal `.` separators: `{id}.{timestamp}.{body}`. Use the body exactly as received - do not re-serialize the JSON. 2. Base64-decode your endpoint secret after the `whsec_` prefix. That is the HMAC key. 3. Compute HMAC-SHA256 over the signed content, base64 encode it, and compare it against each `v1,` entry in constant time. Accept if any matches, otherwise reject. 4. Check the timestamp is within 5 minutes of now, to reject replays. Because the secret is unique to your endpoint, a signature can only be verified by you - a delivery meant for another endpoint cannot be made to verify here. Keep the secret confidential. If it leaks, roll the endpoint's secret from the Webhooks page of your partner dashboard. - name: Sandbox description: >- Test-key-only endpoints for rehearsing event flows. Trigger a lifecycle transition on a test company and receive the matching webhook, without waiting for a real formation to progress. paths: /requirements: get: tags: - Requirements summary: List requirements description: >- Everything currently (or previously) needed from you, newest first. Filter by company and/or status. Poll `status=open` to see what is outstanding. operationId: listRequirements parameters: - name: company in: query required: false description: Only this company's requirements. schema: type: string pattern: ^cmp_[0-9A-Za-z]{22}$ - name: status in: query required: false schema: type: string enum: - open - resolved - canceled responses: '200': description: The requirements, newest first (at most 100). content: application/json: schema: $ref: '#/components/schemas/RequirementList' components: schemas: RequirementList: type: object description: Your requirements, newest first. required: - object - items properties: object: type: string enum: - list items: type: array items: $ref: '#/components/schemas/Requirement' Requirement: type: object description: >- One thing needed from you or your client: an owner's identity document, a service-order form, or something Clemta asked for (a company-name change, extra information). Fulfill it over the API, or mint a hosted link and hand fulfillment to your client. required: - object - id - company - type - status - requested_by - livemode - created_at properties: object: type: string enum: - requirement description: Entity name. id: type: string pattern: ^rqmt_[0-9A-Za-z]{22}$ example: rqmt_0346sFPEvSkJvY8vt14NNw company: type: string pattern: ^cmp_[0-9A-Za-z]{22}$ description: The company this requirement is on. service_order: type: string pattern: ^so_[0-9A-Za-z]{22}$ description: >- The service order this requirement belongs to - a form requirement's own order, or the order a Clemta-opened information or document ask was scoped to. shareholder: type: string pattern: ^sh_[0-9A-Za-z]{22}$ description: The owner a document requirement is about. purpose: type: string enum: - identity_document - formation_document - additional_document description: >- On a `document` requirement: the file-policy purpose it collects under, which decides the accepted size, content types, page count and link lifetime (see the file upload guide's policy table). type: type: string enum: - document - form - name_change - information - signature description: >- What fulfills it. `document` - an identity document file. `form` - the current fulfilment step's answers. `name_change` - a new company name (a `name` value). `information` - free-form answers. status: type: string enum: - open - resolved - canceled requested_by: type: string enum: - system - operations description: Who opened it - the platform itself, or Clemta. document_name: type: string description: >- For a signature requirement - the name of the document awaiting signature. signers: type: array items: $ref: '#/components/schemas/RequirementSigner' description: >- For a signature requirement - every party that must sign, with each one's progress. The requirement resolves only when they have all signed. message: type: string description: Why it was opened, in words you can show your client. cancel_reason: type: string description: >- On a canceled requirement - why it closed without being fulfilled: a signer's decline reason, or Clemta withdrawing the ask. Safe to show your client. form: $ref: '#/components/schemas/ServiceOrderForm' description: >- For an OPEN `form` requirement: the fields to collect, read live from the fulfilment workflow. response: type: array items: $ref: '#/components/schemas/ServiceFormField' description: What fulfilled it (absent for documents). attachments: type: array items: $ref: '#/components/schemas/RequirementAttachment' description: >- A form requirement's file-field uploads collected so far. Forwarded together with the values when the form is fulfilled. livemode: type: boolean created_at: type: string format: date-time resolved_at: type: string format: date-time RequirementSigner: type: object description: >- One party on a signature requirement. A document may need several signatures. Each signer gets their own hosted signing session and signs independently, and the requirement resolves only once the last of them completes. required: - ref - status properties: ref: type: string pattern: ^sgr_[0-9A-Za-z]{22}$ description: >- The signer's stable handle. Supply a deferred (name-only) signer's email by this ref on POST /v1/companies/{id}/signature-signers. email: type: string description: >- The signer's email. Absent while status is `pending_email` - a name-only signer whose email you still owe. name: type: string description: The signer's display name. status: type: string enum: - pending_email - pending - viewed - signed - declined description: >- Where this signer is: `pending_email` (no email yet - supply it), `pending` (email set, not opened), `viewed` (opened or started), `signed` (completed their part), `declined` (refused - which cancels the whole requirement). viewed_at: type: string format: date-time description: When this signer first opened the document. started_at: type: string format: date-time description: When this signer began filling the document. signed_at: type: string format: date-time description: When this signer completed their part. declined_at: type: string format: date-time description: When this signer declined. ServiceOrderForm: type: object description: The form the order's current fulfilment step is waiting on. required: - fields properties: title: type: string warning: type: string description: A caution to show above the form. fields: type: array items: $ref: '#/components/schemas/ServiceFormFieldDef' ServiceFormField: type: object description: One answer to a service order's current form step. required: - value properties: key: type: string description: The field key from the form schema, when it has one. field_name: type: string description: The field's label from the form schema. value: description: >- The answer - a string, number, or boolean. A file field's value is a pre-uploaded file id (POST /v1/files, purpose additional_document). RequirementAttachment: type: object description: One file-field upload collected on a form requirement. required: - filename properties: field: type: string description: The form field key this file answers. field_name: type: string filename: type: string content_type: type: string size: type: integer format: int64 ServiceFormFieldDef: type: object description: >- One field of a form. It carries every attribute you need to render the field in your own UI, and the server validates answers against the same definition. required: - field_name - field_type properties: key: type: string description: Stable field key - pass it back as the answer's `key`. field_name: type: string description: The field's label. field_type: type: string enum: - text - textarea - number - date - boolean - select - multi_select - file - email - phone - address description: >- What kind of answer the field takes. `select` takes one of `options`, `multi_select` a list of them, `date` an ISO date (YYYY-MM-DD), `file` a pre-uploaded file id (POST /v1/files, purpose additional_document). required: type: boolean options: type: array items: type: string description: Allowed values for select / multi_select. guidance: type: string description: Longer explanation of what is being asked. help: type: string description: Short helper text under the input. note: type: string description: A caution shown near the field. placeholder: type: string info_points: type: array items: type: string conditional: $ref: '#/components/schemas/FieldConditional' validation: $ref: '#/components/schemas/FieldValidation' file: $ref: '#/components/schemas/FieldFileRule' FieldConditional: type: object description: >- This field applies only while another field holds one of the listed values. required: - field - values properties: field: type: string description: Key of the controlling field. values: type: array items: type: string description: Any of these values on the controlling field switches this one on. FieldValidation: type: object description: >- Constraints an answer must satisfy beyond its type. The server enforces these. A violation answers `invalid_request` with the field named in `errors[]`. properties: pattern: type: string description: Regular expression a text answer must match. min_length: type: integer max_length: type: integer min: type: number description: Lower bound for a number. max: type: number FieldFileRule: type: object description: Constraints on a file field's upload. properties: accepted_types: type: array items: type: string description: >- Media types or extensions accepted (e.g. `application/pdf`, `jpg`). Absent means PDF, JPEG and PNG. max_size_bytes: type: integer format: int64 securitySchemes: apiKey: type: http scheme: bearer description: > Your API key, e.g. `Authorization: Bearer clmt_test_`. Live keys use the `clmt_live_` prefix. ````