api v1 · REST + webhooks

Build contracts
into your stack.

Create contracts, read their status and signatures, and react to events the moment they happen — over a small, predictable REST API.

Get your API key Explore endpoints
bash — coventract api live
$
Authentication

Every request carries your secret key as a bearer token. Generate one in your account’s API settings — treat it like a password.

authorization
Authorization: Bearer cc_live_your_key_here

Rate limited by design

Requests are throttled per IP and return X-RateLimit-* headers on 429.

Endpoints — try each one
GET/v1/me— Who the API key belongs to. Use it as the connection test.
request
curl https://api.coventract.com/v1/me \
  -H "Authorization: Bearer cc_live_…"
response · 200
{
  300">"data": {
    300">"id": 300">"u_9fK2…",
    300">"name": 300">"Layla Haddad",
    300">"email": 300">"layla@studio.co",
    300">"type": 300">"freelancer"
  }
}
Webhooks

Subscribe a URL to get events the moment they happen:

contract.createdcontract.signedlawyer.approvedcontract.expiring

Each delivery is a POST with an X-Coventract-Signature header. Verify it before trusting the payload.

Every contract event carries the same core fields, so you can map them once and reuse the mapping across events:

{
  300">"event": 300">"contract.signed",
  300">"createdAt": 300">"2026-01-14T09:12:04.881Z",
  300">"data": {
    300">"contractId": 300">"8fK2…",
    300">"title": 300">"Website Redesign",
    300">"status": 300">"Signed",
    300">"clientName": 300">"Acme LLC",
    300">"amount": 4500,
    300">"signedBy": 300">"client",
    300">"signerName": 300">"Jane Roe",
    300">"fullySigned": 300">true
  }
}
verify.js
const expected = crypto
  .createHmac("sha256", SECRET)
  .update(rawBody)
  .digest("hex");

// constant-time compare:
if (expected === header) trust(payload);
No-code & connectors

Zapier & Make

Connection test via /me, instant triggers via webhook subscribe/unsubscribe, polling via /contracts, and create actions.

Any REST client

Plain JSON over HTTPS with bearer auth — Postman, cURL, or your own backend, no SDK required.

Google Drive

Signed contracts save straight to a signer’s Drive with the narrow drive.file scope — nothing else is touched.

Connect your tools — no code required

You don’t need a developer to wire Coventract into the apps you already use. With Zapier or Make you can turn any Coventract event into an action — for example, the moment a client signs, auto-create an invoice, notify your team, or file the PDF. Five steps:

  1. 1

    Get a catch URL from Zapier or Make

    Create a new Zap → choose “Webhooks by Zapier → Catch Hook”. Zapier gives you a unique URL. Copy it. Note that Catch Hook is one of Zapier’s premium built-ins, so it needs a paid Zapier plan — Make’s “Custom webhook” module does the same job on their free tier, and pointing a webhook at your own server needs neither.

  2. 2

    Generate your API key

    Open Dashboard → Developer API and click Generate API key. Keep it secret — it authenticates your account. This is a Business-plan feature.

  3. 3

    Register the webhook in Coventract

    In the same Developer API page, click Add endpoint, paste the Zapier URL, tick the events you care about (e.g. contract.signed), and Create.

  4. 4

    Test it

    Back in Zapier, hit “Test trigger”, then sign a test contract in Coventract. Zapier receives the sample data — clientName, amount, title, status.

  5. 5

    Add your action

    Point the caught event at any of Zapier’s 6,000+ apps — create a QuickBooks invoice, post to Slack, add a Google Sheets row, update your CRM — then turn the Zap on.

Set up your first webhook

base url is your coventract domain · all responses are JSON · talk to us →