> ## Documentation Index > Fetch the complete documentation index at: https://docs.clemta.com/llms.txt > Use this file to discover all available pages before exploring further. # Supply a signer's email > Provides the email for a deferred signer - one Clemta opened with a name but no email (status `pending_email`). Once every signer on the document has an email, the signing round opens for all of them and you can mint their sessions. Live mode only. The email is not required to be one of the company's owners. A deferred signer is an outside party by design. ## OpenAPI ````yaml /partner/openapi.yaml post /companies/{companyID}/signature-signers openapi: 3.1.0 info: title: Clemta Partner API description: | The Clemta partner surface. Authenticate with your API key as a bearer token (`Authorization: Bearer clmt_live_` or `clmt_test_`). Keys with the `clmt_test_` prefix operate in sandbox mode (`livemode: false`): test data never reaches fulfillment or billing. Versioning is date-based: pass `Clemta-Version` to pin a version, omit it to run on your account's pinned default. The effective version is echoed back on every response. version: '2026-08-13' servers: - url: https://api.clemta.com/v1 description: > Single host for both modes: `clmt_test_` keys operate in sandbox mode, `clmt_live_` keys in live mode. security: - apiKey: [] tags: - name: Identity description: Identify the calling API key. - name: Accounts description: >- Create and read customer accounts - the incorporators companies are created under. - name: Companies description: Create and read client companies. - name: Service orders description: Order services against a company and follow their fulfilment. - name: Products description: The catalog you can offer, at your wholesale prices. - name: Tax filings description: >- Federal and state tax filings on your companies, opened by your client against the company's entitlements and worked by Clemta. Read-only. Follow them with the tax_filing.* events. - name: Files description: >- Documents Clemta publishes on your companies - formation deliverables, filed forms, letters. Read-only. Client KYC uploads are write-only and never listed. - name: Requirements description: >- Everything needed from you or your client - identity documents, service-order forms, Clemta's asks - as one resolvable resource. Fulfill over the API or hand your client a hosted link. - name: Status tracking description: >- End-customer status links - keyless, read-only access to a company's live status. - name: Events description: Poll the partner event stream. - name: Webhooks description: >- Events we deliver to your endpoint, and how to verify them. Each webhook below is a request WE send to you. Respond 2xx to acknowledge. Deliveries are signed and retried with exponential backoff over multiple days until acknowledged. Answer `410 Gone` to have the endpoint disabled and deliveries stopped. A `Retry-After` header on a `429` or `503` pushes the next attempt back. An endpoint that fails continuously for days is disabled automatically and the workspace owner is emailed - no events are lost, the stream stays available on `GET /v1/events`. ## Verifying a delivery Deliveries are signed per the [Standard Webhooks](https://www.standardwebhooks.com) specification, carrying BOTH schemes in one header: a symmetric `v1` HMAC (verify with your endpoint secret and any standardwebhooks library) and an asymmetric `v1a` ed25519 signature (verify with the endpoint's public key, no shared secret held). Use whichever suits your setup. Every endpoint has its OWN signing secret (`whsec_...`), shown once when you create the endpoint. Each delivery carries three headers: - `Clemta-Webhook-Id` - the event id. Stable across retries: use it as an idempotency key so a redelivered event is processed once. - `Clemta-Webhook-Timestamp` - unix seconds of THIS attempt (a retry carries a fresh one). - `Clemta-Webhook-Signature` - a space-delimited list of `v1,` signatures. More than one while a secret rotation's overlap window is open, one per active secret. Each is also sent under its bare Standard Webhooks name (`webhook-id`, `webhook-timestamp`, `webhook-signature`) with the same value, which is what off-the-shelf standardwebhooks libraries look up. To verify by hand: 1. Build the signed content by joining the id, the timestamp, and the raw request body with literal `.` separators: `{id}.{timestamp}.{body}`. Use the body exactly as received - do not re-serialize the JSON. 2. Base64-decode your endpoint secret after the `whsec_` prefix. That is the HMAC key. 3. Compute HMAC-SHA256 over the signed content, base64 encode it, and compare it against each `v1,` entry in constant time. Accept if any matches, otherwise reject. 4. Check the timestamp is within 5 minutes of now, to reject replays. Because the secret is unique to your endpoint, a signature can only be verified by you - a delivery meant for another endpoint cannot be made to verify here. Keep the secret confidential. If it leaks, roll the endpoint's secret from the Webhooks page of your partner dashboard. - name: Sandbox description: >- Test-key-only endpoints for rehearsing event flows. Trigger a lifecycle transition on a test company and receive the matching webhook, without waiting for a real formation to progress. paths: /companies/{companyID}/signature-signers: post: tags: - Requirements summary: Supply a signer's email description: >- Provides the email for a deferred signer - one Clemta opened with a name but no email (status `pending_email`). Once every signer on the document has an email, the signing round opens for all of them and you can mint their sessions. Live mode only. The email is not required to be one of the company's owners. A deferred signer is an outside party by design. operationId: supplySignerEmail parameters: - $ref: '#/components/parameters/CompanyId' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/SupplySignerEmailBody' responses: '200': description: The signature requirement with the signer's email set. content: application/json: schema: $ref: '#/components/schemas/Requirement' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '404': $ref: '#/components/responses/NotFound' components: parameters: CompanyId: name: companyID in: path required: true description: ID of the company. schema: type: string pattern: ^cmp_[0-9A-Za-z]{22}$ example: cmp_0346sFPEvSkJvY8vt14NNw schemas: SupplySignerEmailBody: type: object required: - requirement - signer - email additionalProperties: false properties: requirement: type: string pattern: ^rqmt_[0-9A-Za-z]{22}$ description: The open signature requirement the signer belongs to. signer: type: string pattern: ^sgr_[0-9A-Za-z]{22}$ description: The deferred signer's ref (from the requirement's `signers`). email: type: string format: email maxLength: 254 description: The signer's email. Screened for disposable domains. Requirement: type: object description: >- One thing needed from you or your client: an owner's identity document, a service-order form, or something Clemta asked for (a company-name change, extra information). Fulfill it over the API, or mint a hosted link and hand fulfillment to your client. required: - object - id - company - type - status - requested_by - livemode - created_at properties: object: type: string enum: - requirement description: Entity name. id: type: string pattern: ^rqmt_[0-9A-Za-z]{22}$ example: rqmt_0346sFPEvSkJvY8vt14NNw company: type: string pattern: ^cmp_[0-9A-Za-z]{22}$ description: The company this requirement is on. service_order: type: string pattern: ^so_[0-9A-Za-z]{22}$ description: >- The service order this requirement belongs to - a form requirement's own order, or the order a Clemta-opened information or document ask was scoped to. shareholder: type: string pattern: ^sh_[0-9A-Za-z]{22}$ description: The owner a document requirement is about. purpose: type: string enum: - identity_document - formation_document - additional_document description: >- On a `document` requirement: the file-policy purpose it collects under, which decides the accepted size, content types, page count and link lifetime (see the file upload guide's policy table). type: type: string enum: - document - form - name_change - information - signature description: >- What fulfills it. `document` - an identity document file. `form` - the current fulfilment step's answers. `name_change` - a new company name (a `name` value). `information` - free-form answers. status: type: string enum: - open - resolved - canceled requested_by: type: string enum: - system - operations description: Who opened it - the platform itself, or Clemta. document_name: type: string description: >- For a signature requirement - the name of the document awaiting signature. signers: type: array items: $ref: '#/components/schemas/RequirementSigner' description: >- For a signature requirement - every party that must sign, with each one's progress. The requirement resolves only when they have all signed. message: type: string description: Why it was opened, in words you can show your client. cancel_reason: type: string description: >- On a canceled requirement - why it closed without being fulfilled: a signer's decline reason, or Clemta withdrawing the ask. Safe to show your client. form: $ref: '#/components/schemas/ServiceOrderForm' description: >- For an OPEN `form` requirement: the fields to collect, read live from the fulfilment workflow. response: type: array items: $ref: '#/components/schemas/ServiceFormField' description: What fulfilled it (absent for documents). attachments: type: array items: $ref: '#/components/schemas/RequirementAttachment' description: >- A form requirement's file-field uploads collected so far. Forwarded together with the values when the form is fulfilled. livemode: type: boolean created_at: type: string format: date-time resolved_at: type: string format: date-time RequirementSigner: type: object description: >- One party on a signature requirement. A document may need several signatures. Each signer gets their own hosted signing session and signs independently, and the requirement resolves only once the last of them completes. required: - ref - status properties: ref: type: string pattern: ^sgr_[0-9A-Za-z]{22}$ description: >- The signer's stable handle. Supply a deferred (name-only) signer's email by this ref on POST /v1/companies/{id}/signature-signers. email: type: string description: >- The signer's email. Absent while status is `pending_email` - a name-only signer whose email you still owe. name: type: string description: The signer's display name. status: type: string enum: - pending_email - pending - viewed - signed - declined description: >- Where this signer is: `pending_email` (no email yet - supply it), `pending` (email set, not opened), `viewed` (opened or started), `signed` (completed their part), `declined` (refused - which cancels the whole requirement). viewed_at: type: string format: date-time description: When this signer first opened the document. started_at: type: string format: date-time description: When this signer began filling the document. signed_at: type: string format: date-time description: When this signer completed their part. declined_at: type: string format: date-time description: When this signer declined. ServiceOrderForm: type: object description: The form the order's current fulfilment step is waiting on. required: - fields properties: title: type: string warning: type: string description: A caution to show above the form. fields: type: array items: $ref: '#/components/schemas/ServiceFormFieldDef' ServiceFormField: type: object description: One answer to a service order's current form step. required: - value properties: key: type: string description: The field key from the form schema, when it has one. field_name: type: string description: The field's label from the form schema. value: description: >- The answer - a string, number, or boolean. A file field's value is a pre-uploaded file id (POST /v1/files, purpose additional_document). RequirementAttachment: type: object description: One file-field upload collected on a form requirement. required: - filename properties: field: type: string description: The form field key this file answers. field_name: type: string filename: type: string content_type: type: string size: type: integer format: int64 Error: type: object description: >- Error response: a stable machine-readable `code`, human-readable `title`/`detail`, and for validation failures an `errors` array naming every violating field. required: - type - title - status - code additionalProperties: false properties: type: type: string description: Link to the error reference entry for this code. example: https://docs.clemta.com/partner/errors#resource_already_exists title: type: string description: Short human summary of the error class. status: type: integer format: int32 minimum: 100 maximum: 599 description: HTTP status code, also included in the body. code: type: string enum: - api_key_invalid - api_key_expired - insufficient_scope - ip_address_not_allowed - invalid_request - invalid_api_version - resource_missing - method_not_allowed - test_mode_only - resource_already_exists - idempotency_key_mismatch - idempotency_key_in_use - request_too_large - billing_account_inactive - entitlement_required - rate_limit - api_error description: Stable machine-readable code - branch on this, never on `detail`. detail: type: string description: Human-readable specifics of this occurrence, wording may change. request_id: type: string description: >- Identifier of this request. Quote it in a support request so we can trace the failure. errors: type: array description: 'Present on validation failures: one entry per violating field.' items: type: object required: - reason additionalProperties: false properties: reason: type: string location: type: string description: JSONPath of the failing field, e.g. `$.name`. validation_type: type: string description: Schema keyword that failed. how_to_fix: type: string ServiceFormFieldDef: type: object description: >- One field of a form. It carries every attribute you need to render the field in your own UI, and the server validates answers against the same definition. required: - field_name - field_type properties: key: type: string description: Stable field key - pass it back as the answer's `key`. field_name: type: string description: The field's label. field_type: type: string enum: - text - textarea - number - date - boolean - select - multi_select - file - email - phone - address description: >- What kind of answer the field takes. `select` takes one of `options`, `multi_select` a list of them, `date` an ISO date (YYYY-MM-DD), `file` a pre-uploaded file id (POST /v1/files, purpose additional_document). required: type: boolean options: type: array items: type: string description: Allowed values for select / multi_select. guidance: type: string description: Longer explanation of what is being asked. help: type: string description: Short helper text under the input. note: type: string description: A caution shown near the field. placeholder: type: string info_points: type: array items: type: string conditional: $ref: '#/components/schemas/FieldConditional' validation: $ref: '#/components/schemas/FieldValidation' file: $ref: '#/components/schemas/FieldFileRule' FieldConditional: type: object description: >- This field applies only while another field holds one of the listed values. required: - field - values properties: field: type: string description: Key of the controlling field. values: type: array items: type: string description: Any of these values on the controlling field switches this one on. FieldValidation: type: object description: >- Constraints an answer must satisfy beyond its type. The server enforces these. A violation answers `invalid_request` with the field named in `errors[]`. properties: pattern: type: string description: Regular expression a text answer must match. min_length: type: integer max_length: type: integer min: type: number description: Lower bound for a number. max: type: number FieldFileRule: type: object description: Constraints on a file field's upload. properties: accepted_types: type: array items: type: string description: >- Media types or extensions accepted (e.g. `application/pdf`, `jpg`). Absent means PDF, JPEG and PNG. max_size_bytes: type: integer format: int64 responses: BadRequest: description: Malformed request (e.g. unknown `Clemta-Version`). content: application/json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: Missing, invalid, revoked, or grace-expired API key. content: application/json: schema: $ref: '#/components/schemas/Error' NotFound: description: The requested resource does not exist, or is not yours. content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: apiKey: type: http scheme: bearer description: > Your API key, e.g. `Authorization: Bearer clmt_test_`. Live keys use the `clmt_live_` prefix. ````