---
title: "Fetch evidence: envelope + per-signer receipts"
method: GET
path: "/api/receipts/{envelope_id}"
---

# Fetch evidence: envelope + per-signer receipts

`GET /api/receipts/{envelope_id}`

## Request

- Base URL: `https://free-sign.com`
- URL: `https://free-sign.com/api/receipts/{envelope_id}`
- Auth: none declared

Returns the envelope record (including final_pdf_sha256, final_signature_base64url, final_payload_json once /finalize completes), per-signer signing receipts, and OpenTimestamps anchors. This endpoint does not return the request fingerprint: the plaintext IP / user-agent fingerprint captured at /sign time lives in the audit chain — see `GET /api/envelopes/{envelope_id}/audit`, inside each event's `event_data_json` — and is also rendered onto the in-PDF Certificate of Signatures page that ships to every recipient. Capturing it is intentional and mirrors DocuSign / Adobe Sign Certificate-of-Completion industry practice (eIDAS Art. 26, ESIGN/UETA §7); FreeSign's privacy invariant is 'no PDF bytes server-side', not 'no IPs'.

## Path parameters

- `envelope_id` string, required

## Response `200`

Envelope and per-signer receipts.

- object
  - `envelope` object, nullable, required
    - `id` string
    - `document_sha256` string
    - `final_pdf_sha256` string, nullable
    - `final_signature_base64url` string, nullable
    - `final_payload_json` string, nullable
    - `audit_chain_head_hash` string, nullable: The audit-chain head (event_hash) the signer attested in the v2 final payload at finalize time. NULL until finalized (security audit G-01).
    - `status` 'draft' | 'otp_sent' | 'signed' | 'finalized' | 'expired'
    - `created_at` string, date-time
    - `updated_at` string, date-time
  - `receipts` object[], required
    - `id` string
    - `envelope_id` string
    - `signer_id` string
    - `payload_hash` string
    - `canonical_payload_json` string
    - `public_key_jwk_json` string
    - `signature_base64url` string
    - `consent_version` string
    - `created_at` string, date-time
    - `email_hmac` string
  - `ots_anchors` object[], required: OpenTimestamps anchors for this envelope. TWO per /seal call — one anchoring the signed document (kind=byterange), one anchoring SHA-256(CMS SignedAttributes) (kind=signed_attrs) — so a multi-signer envelope gets 2N anchors.
    - `id` string
    - `signer_id` string
    - `seal_cms_sha256` string
    - `kind` 'byterange' | 'signed_attrs'
    - `anchored_hash` string
    - `status` 'pending' | 'confirmed' | 'deferred'
    - `calendar_urls` string[]
    - `pending_submitted_at` string, date-time, nullable
    - `btc_block_height` integer, nullable
    - `btc_block_hash` string, nullable
    - `btc_anchored_at` string, date-time, nullable
    - `proof_download` string, nullable

---

[API](https://skmtc.dev/free-sign/apis/freesign-free-e-signature-api.md) · [All operations](https://skmtc.dev/free-sign/apis/freesign-free-e-signature-api/llms.txt) · [OpenAPI document](https://skmtc.dev/free-sign/apis/freesign-free-e-signature-api/revisions/5d8e9854ab85?raw)