Guest Signature

View a guest signature session

Returns the information a guest signer needs to review and sign a lease, from a public token-based link (no login required).

Authentication

This endpoint is public: the only credential is the guest token carried in the URL path. The token is a UUID v4 that is sha256-hashed server-side and is single-use once the signature is applied.

Privacy

The returned projection is a strict allow-list. It never exposes the signer's phone number or email, nor any internal IDs. Only the OTP delivery channel (sms / email) is surfaced.

Anti-oracle behaviour

All responses (success and errors) are padded to a constant minimum latency, and an unknown token returns the same generic 404 as a token that did not match, so timing and messages cannot be used to probe for valid tokens.

Example

curl https://api.faireplace.com/api/public/guest-signature/3f8b1c2d-...-9a0e

Response:

{
  "lease_label": "Bail - 12 rue des Lilas, 75011 Paris",
  "document_url": "https://api.faireplace.com/api/public/guest-signature/3f8b.../pdf",
  "me": {
    "first_name": "Jean",
    "last_name": "Dupont",
    "role": "locataire",
    "acting_as": { "kind": "self_capacity" }
  },
  "other_signers": [
    { "display_name": "M. M.", "role": "bailleur" }
  ],
  "mandataire_disclosure": null,
  "expires_at": "2026-06-27T10:00:00Z",
  "otp_channel": "sms"
}
get/public/guest-signature/{token}

Request

  • Base URL: https://api.faireplace.com/api
  • URL: https://api.faireplace.com/api/public/guest-signature/{token}
  • Auth: none required

Path parameters

tokenstring required

Guest session token (clear UUID v4 from the email link).

Response

Guest signature session retrieved.

lease_labelstring required

Human-readable label of the lease being signed.

document_urlstring required

URL to stream the (unsigned/preview) PDF. Points to the /public/guest-signature/{token}/pdf proxy endpoint and carries the clear token in its path.

expires_atstring date-time required

Expiration date of the guest signature session.

otp_channel'sms' | 'email' required

Channel used to deliver the OTP code. Only the nature of the channel is exposed: never the phone number or email itself.

Example response

{
  "lease_label": "Bail - 12 rue des Lilas, 75011 Paris",
  "document_url": "https://api.faireplace.com/api/public/guest-signature/3f8b.../pdf",
  "me": {
    "first_name": "Jean",
    "last_name": "Dupont",
    "role": "locataire",
    "acting_as": {
      "kind": "self_capacity",
      "mandataire_display_name": "Cabinet Dupont"
    }
  },
  "other_signers": [
    {
      "display_name": "M. D.",
      "role": "locataire"
    }
  ],
  "mandataire_disclosure": {
    "display_name": "Cabinet Dupont",
    "mandate_reference": "Mandat du 11/03/2026 n°12345"
  },
  "expires_at": "2026-06-27T10:00:00Z",
  "otp_channel": "sms"
}

Changes

No recorded changes to this operation across all 1 revision of this API.