---
title: "Create Envelope"
method: POST
path: "/envelopes"
tags: ["E-Signature"]
---

# Create Envelope

`POST /envelopes`

## Request

- Base URL: `https://be.graph8.com/api/v1`
- URL: `https://be.graph8.com/api/v1/envelopes`
- Auth: HTTP bearer

Create a DRAFT envelope. Nothing is emailed.

The documents are HTML the caller already holds - there is no upload step -
which is what makes the whole flow scriptable. `expires_in_days` counts
from creation, NOT from the moment it is sent, so a draft left sitting for
a month has already used its window.

## Headers

- `Authorization` string, nullable
- `X-Target-Org-Id` string, nullable

## Request body

- CreateEnvelopeRequest: Create a DRAFT envelope. Nothing is emailed until it is sent. Exactly one signer. The app's model carries one `signer_name` / `signer_email` pair rather than a list, so this does too - a mirror that invented a list would accept a second signer that is silently dropped.
  - `subject` string, required: Subject line the signer sees.
  - `message` string, nullable: Covering note in the signing email.
  - `signer_name` string, required
  - `signer_email` string, required
  - `signer_contact_id` integer, nullable: Link the envelope to a graph8 contact record.
  - `source_type` string, nullable: What produced this envelope, e.g. `quote`. Free-form, and filterable on list.
  - `source_id` string, nullable: The producing record's id.
  - `expires_in_days` integer: How long the signing link stays valid, counted from CREATION rather than from send.
  - `documents` EnvelopeDocument[], required: At least one document - an empty envelope has nothing to sign.
    - `title` string, required
    - `content_html` string, required: The document body as HTML. Rendered to the PDF the signer sees.

## Response `201`

Successful Response

- ApiResponseEnvelopePayload
  - `data` EnvelopePayload, required: An open envelope for the envelope detail. Open on purpose: the detail carries its documents and its whole audit trail, and the audit trail gains event kinds as the product does. Closing it would silently drop an event a caller was relying on to know what happened. Nothing secret rides in here: the signer and viewer tokens are the SIGNING LINK's credentials and the app's detail projection does not include them.
  - `pagination` PaginationMeta
    - `page` integer, required: Current page number (1-indexed)
    - `limit` integer, required: Items per page
    - `total` integer, required: Total number of items
    - `has_next` boolean, required: Whether there are more pages
    - `next_cursor` string, nullable: Opaque cursor for the next page; null when there are no more items. Pass it back as the `cursor` query param to fetch the following page without computing page numbers.
    - `total_available` integer, nullable: Search endpoints only: how many records really match, when known. Can be larger than `total`, which is capped at the 10,000 results that can be paged. For company search this is a distinct-company estimate. Null when unknown; absent outside search.
    - `total_is_lower_bound` boolean, nullable: Search endpoints only: true when more records match than `total` shows (the result set is larger than the 10,000 results that can be paged). Absent outside search.
    - `notes` string[], nullable: Search endpoints only: plain-language notes about the result, e.g. that more records match than can be paged, or that a reversed `between` range was put in order.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/graph8/apis/graph8-developer-api.md) · [All operations](https://skmtc.dev/graph8/apis/graph8-developer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/graph8/apis/graph8-developer-api/revisions/89fc11143b70?raw)