API Documentation

Signing Flow

The NDA signing process follows a specific lifecycle. Understanding this flow is essential for API consumers who want to automate NDA creation and tracking.

Getting Started

The SwiftNDA API allows you to create, list, and download NDAs programmatically. All API requests require authentication via an API key.

curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://swiftnda.com/api/v1/me

curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://swiftnda.com/api/v1/ndas?page=1&pageSize=10

curl -X POST -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "recipientCompany": "Partner Inc",
    "purpose": "Discuss potential partnership",
    "ndaTermYears": 2,
    "confidentialityTermYears": 3,
    "senderPrintName": "Jane Smith",
    "senderTitle": "CEO",
    "senderCompany": "Acme Corp",
    "senderAddressCountry": "US",
    "senderAddressState": "CA",
    "senderAddressCity": "San Francisco",
    "senderAddressZip": "94105",
    "senderAddressStreet": "123 Market St",
    "governingLaw": "California",
    "jurisdiction": "San Francisco County, California",
    "creationType": "quick"
  }' \
  https://swiftnda.com/api/v1/ndas

Authentication

All API requests must include your API key in the Authorization header using the Bearer token scheme.

Authorization: Bearer snda_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

As an alternative to the Bearer scheme, you can send the key in an X-API-Key header.

Base URL

https://swiftnda.com/api/v1

Endpoints

The SwiftNDA API provides 5 endpoints for managing your NDAs and account.

curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://swiftnda.com/api/v1/me

{
  "success": true,
  "user": {
    "id": "user_abc123",
    "name": "Jane Smith",
    "email": "jane@example.com",
    "senderCompany": "Acme Corp",
    "image": "https://lh3.googleusercontent.com/..."
  },
  "apiKey": {
    "id": "key_xyz789",
    "name": "My Production Key"
  },
  "subscription": {
    "planId": "plan_pro_monthly",
    "planName": "Pro",
    "quotaPeriod": "monthly",
    "ndaQuota": 50,
    "remaining": 47,
    "creditBalance": 0,
    "periodEnd": "2026-09-01T00:00:00.000Z"
  }
}

curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://swiftnda.com/api/v1/ndas?page=1&pageSize=10&status=draft"

{
  "success": true,
  "ndas": [
    {
      "id": "nda_abc123-def456-...",
      "status": "draft",
      "senderCompany": "Acme Corp",
      "recipientCompany": "Partner Inc",
      "projectDescription": "API integration project",
      "createdAt": "2026-01-15T10:30:00.000Z",
      "updatedAt": "2026-01-15T10:30:00.000Z"
    }
  ],
  "pagination": {
    "page": 1,
    "pageSize": 10,
    "total": 42,
    "totalPages": 5,
    "sortBy": "updatedAt",
    "sortOrder": "desc"
  }
}

curl -X POST \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "recipientCompany": "Partner Inc",
    "projectDescription": "API integration project",
    "purpose": "Discuss potential partnership and shared technology",
    "ndaTermYears": 2,
    "confidentialityTermYears": 3,
    "senderPrintName": "Jane Smith",
    "senderTitle": "CEO",
    "senderCompany": "Acme Corp",
    "senderAddressCountry": "US",
    "senderAddressState": "CA",
    "senderAddressCity": "San Francisco",
    "senderAddressZip": "94105",
    "senderAddressStreet": "123 Market St",
    "senderAddressSuite": "Suite 400",
    "senderPhone": "+14155551234",
    "governingLaw": "California",
    "jurisdiction": "San Francisco County, California",
    "creationType": "quick"
  }' \
  https://swiftnda.com/api/v1/ndas

{
  "success": true,
  "nda": {
    "id": "nda_a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "status": "draft",
    "senderCompany": "Acme Corp",
    "recipientCompany": "Partner Inc",
    "projectDescription": "API integration project",
    "creationType": "quick",
    "pdfUrl": "/storage/pdfs/nda_a1b2c3d4-...",
    "createdAt": "2026-01-15T10:30:00.000Z",
    "updatedAt": "2026-01-15T10:30:00.000Z",
    "senderSigningUrl": "https://swiftnda.com/ndas/nda_a1b2c3d4-.../sign?role=sender",
    "recipientSigningUrl": "https://swiftnda.com/ndas/nda_a1b2c3d4-.../sign?role=recipient"
  }
}

{
  "success": false,
  "error": "Validation failed",
  "code": "VALIDATION_FAILED",
  "details": [
    { "field": "recipientCompany", "message": "Recipient company name is required" },
    { "field": "purpose", "message": "Purpose is required" }
  ]
}

curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://swiftnda.com/api/v1/ndas/nda_a1b2c3d4-e5f6-7890-abcd-ef1234567890

{
  "success": true,
  "nda": {
    "id": "nda_a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "status": "fully_signed",
    "senderCompany": "Acme Corp",
    "recipientCompany": "Partner Inc",
    "projectDescription": "API integration project",
    "duration": 2,
    "pdfUrl": "/storage/pdfs/nda_a1b2c3d4-...",
    "recipientEmail": "client@partner.com",
    "emailSentAt": "2026-01-15T11:00:00.000Z",
    "recipientSignedAt": "2026-01-16T09:00:00.000Z",
    "senderSignedAt": "2026-01-15T10:35:00.000Z",
    "createdAt": "2026-01-15T10:30:00.000Z",
    "updatedAt": "2026-01-16T09:00:00.000Z",
    "purpose": "Discuss potential partnership",
    "ndaTermYears": 2,
    "confidentialityTermYears": 3,
    "creationType": "quick",
    "senderPrintName": "Jane Smith",
    "senderTitle": "CEO",
    "senderCompany": "Acme Corp",
    "senderAddressCountry": "US",
    "senderAddressState": "CA",
    "senderAddressCity": "San Francisco",
    "senderAddressZip": "94105",
    "senderAddressStreet": "123 Market St",
    "governingLaw": "California",
    "jurisdiction": "San Francisco County, California",
    "senderSigningUrl": "https://swiftnda.com/ndas/nda_a1b2c3d4-.../sign?role=sender",
    "recipientSigningUrl": "https://swiftnda.com/ndas/nda_a1b2c3d4-.../sign?role=recipient"
  },
  "signatures": [
    {
      "id": "sig_abc123",
      "signerType": "sender",
      "signerName": "Jane Smith",
      "signerEmail": "jane@acme.com",
      "signedAt": "2026-01-15T10:35:00.000Z",
      "ipAddress": "192.168.1.1"
    },
    {
      "id": "sig_def456",
      "signerType": "recipient",
      "signerName": "Bob Johnson",
      "signerEmail": "bob@partner.com",
      "signedAt": "2026-01-16T09:00:00.000Z",
      "ipAddress": "10.0.0.1"
    }
  ]
}

curl -H "Authorization: Bearer YOUR_API_KEY" \
  -o nda-document.pdf \
  https://swiftnda.com/api/v1/ndas/nda_a1b2c3d4-e5f6-7890-abcd-ef1234567890/pdf

const response = await fetch(
  "https://swiftnda.com/api/v1/ndas/NDA_ID/pdf",
  { headers: { Authorization: "Bearer YOUR_API_KEY" } }
);

const pdfBuffer = await response.arrayBuffer();
// Save to file or process as needed

curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://swiftnda.com/api/v1/ndas/NDA_ID/status

curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://swiftnda.com/api/v1/ndas/NDA_ID/signatures

curl -X POST https://swiftnda.com/api/v1/ndas/NDA_ID/send \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"recipientEmail": "partner@example.com", "recipientName": "Jordan Partner"}'

curl -X PATCH https://swiftnda.com/api/v1/ndas/NDA_ID \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"recipientCompany": "Corrected Co, LLC", "purpose": "Updated evaluation purpose"}'

curl -X DELETE https://swiftnda.com/api/v1/ndas/NDA_ID \
  -H "Authorization: Bearer YOUR_API_KEY"

curl -H "Authorization: Bearer YOUR_API_KEY" \
  -o nda-audit-trail.pdf \
  https://swiftnda.com/api/v1/ndas/NDA_ID/audit-pdf

Quota

One rule applies to both the dashboard and the API: drafts are free. 1 NDA is consumed from your plan when you (the sender) sign it. Your counterparty signs for free.

Error Codes

All error responses follow a consistent JSON format with a success: false field.

Error Response Format

{
  "success": false,
  "error": "Human-readable error message",
  "code": "OPTIONAL_ERROR_CODE",
  "details": [
    { "field": "fieldName", "message": "Field-specific error" }
  ]
}

Rate Limits

API-key requests are rate-limited to 100 requests per minute per API key. This is one shared budget per key across all surfaces — both the /api/v1/* API and the key-authenticated web routes (/api/*) draw down the same per-key counter, so a key gets one budget total, not one per surface. Session-cookie (browser) requests are not rate-limited. On v1 responses the rate-limit headers below are returned on every response; on web routes they are returned on the 429 only.

Rate Limit Headers

When Rate Limited (429)

{
  "success": false,
  "error": "Too many requests. Please slow down.",
  "code": "RATE_LIMITED",
  "retryAfter": 42
}

Retries & Idempotency

If a POST /api/v1/ndas request times out or its connection drops, you can safely retry it without risking a duplicate NDA (and a second signing link). Send an Idempotency-Key header identifying the logical creation.

Behavior

• Retry with the same key and the same body — you get back the original response, unchanged, with an Idempotency-Replayed: true header. No second NDA is created.
• Same key, different body — rejected with 409 IDEMPOTENCY_KEY_REUSED. Use a new key for a genuinely new request.
• Retry while the original is still in flight — returns 409 IDEMPOTENCY_IN_PROGRESS with a retryAfter hint (seconds); retry after that.
• No header — the request runs normally, with no idempotency protection.

Example

curl -X POST \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 3f9c2b7a-1d4e-4a2b-8c6f-9e0a1b2c3d4e" \
  -d '{ "recipientCompany": "Partner Inc", "purpose": "Discuss partnership", "ndaTermYears": 2, "confidentialityTermYears": 3, "senderPrintName": "Jane Smith", "senderTitle": "CEO", "senderCompany": "Acme Corp", "senderAddressCountry": "US", "senderAddressCity": "San Francisco", "senderAddressZip": "94105", "senderAddressStreet": "123 Market St", "governingLaw": "California", "jurisdiction": "San Francisco County, California", "creationType": "quick" }' \
  https://swiftnda.com/api/v1/ndas

Idempotency currently applies to POST /api/v1/ndas. Read-only endpoints (GET) are naturally safe to retry.

Automated Sender Signing

The sender signature is the one human bottleneck in an otherwise API-drivable flow. An agent can execute it via POST /api/v1/ndas/:id/execute once the account owner has authorized it. Recipient signing is always browser-based and is never executable via the API.

Legal shape (ESIGN/UETA). Intent to sign is captured once, by the human, in a dashboard grant ceremony on the profile page: they adopt a signature (type their name or draw it), read the authorization statement, tick an explicit checkbox, and choose a scope (all of their API keys, or one key). The API then executes the sender signature under that recorded, revocable, audited grant. Grants can be revoked at any time (effective immediately), and the audit-trail PDF records that the signature was executed via an authorized API key, when the authority was granted, and which version of the authorization text was accepted.

Quota. Executing the sender signature consumes one NDA of quota, exactly as signing in the browser does. If the plan's quota is exhausted, the call returns 403 QUOTA_EXHAUSTED. Check GET /api/v1/me (subscription.remaining) before executing.

If the presenting key has no active grant, the call returns 403 NO_SIGNING_AUTHORIZATION with a message telling you the owner must grant it in the dashboard (the message includes the settings URL). A key-specific grant takes precedence over an all-keys grant; a revoked grant is ignored. The call is idempotent — re-executing after the sender already signed replays the existing signature without a second quota charge.

curl -X POST \
  -H "Authorization: Bearer YOUR_API_KEY" \
  https://swiftnda.com/api/v1/ndas/NDA_ID/execute

# 200 -> { "success": true, "signature": { "signerType": "sender", ... }, "ndaStatus": "awaiting_client" }
# 403 -> { "success": false, "code": "NO_SIGNING_AUTHORIZATION", "error": "... grant it in the dashboard (...)" }
# 403 -> { "success": false, "code": "QUOTA_EXHAUSTED", "quotaExceeded": true, "upgradeUrl": "/pricing" }

Webhooks

Subscribe your own URL to your NDAs' lifecycle events. When an event fires, SwiftNDA POSTs a signed JSON payload to every one of your active subscriptions that lists that event. Delivery is a single attempt with a 5-second timeout; 20 consecutive failures auto-disable a subscription (reactivate it with a PATCH).

Events

Create a subscription

The response returns the signing secret in full exactly once — store it. Everywhere else it is masked (whsec_…1a2b). A maximum of 5 active subscriptions per account is enforced (403 WEBHOOK_LIMIT_REACHED). URLs must use https in production.

curl -X POST https://swiftnda.com/api/v1/webhooks \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://your-app.example.com/hooks/swiftnda", "events": ["nda.completed", "recipient.signed"], "description": "prod receiver"}'

Manage & test

• GET /api/v1/webhooks — list (secrets masked).
• GET /api/v1/webhooks/:id — retrieve one.
• PATCH /api/v1/webhooks/:id — update url/events/description/isActive. Sending isActive: true reactivates and resets the failure counter.
• DELETE /api/v1/webhooks/:id — remove a subscription.
• POST /api/v1/webhooks/:id/test — deliver a signed webhook.test to verify your receiver; the response reports the delivered status code or the failure reason.

Verifying the signature

Each delivery carries X-Webhook-Signature (hex HMAC-SHA256 of the raw request body, keyed with your subscription secret), plus X-Webhook-Event and X-Webhook-Subscription-Id. Compare with a constant-time check.

// Node.js (Express) — verify X-Webhook-Signature
import crypto from "crypto";

app.post("/hooks/swiftnda", express.raw({ type: "application/json" }), (req, res) => {
  const secret = process.env.SWIFTNDA_WEBHOOK_SECRET; // "whsec_..."
  const expected = crypto.createHmac("sha256", secret).update(req.body).digest("hex");
  const received = req.header("X-Webhook-Signature") || "";
  const ok =
    expected.length === received.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received));
  if (!ok) return res.status(401).end();

  const event = JSON.parse(req.body.toString());
  console.log(req.header("X-Webhook-Event"), event.ndaId, event.status);
  res.status(200).end();
});

# Python (Flask) — verify X-Webhook-Signature
import hmac, hashlib
from flask import request, abort

@app.post("/hooks/swiftnda")
def swiftnda_webhook():
    secret = os.environ["SWIFTNDA_WEBHOOK_SECRET"]  # "whsec_..."
    expected = hmac.new(secret.encode(), request.get_data(), hashlib.sha256).hexdigest()
    received = request.headers.get("X-Webhook-Signature", "")
    if not hmac.compare_digest(expected, received):
        abort(401)
    event = request.get_json()
    print(request.headers["X-Webhook-Event"], event["ndaId"], event["status"])
    return "", 200

LLM Agent Compatibility

The SwiftNDA API is designed to be easily consumed by LLM agents and AI assistants. Here's what makes it agent-friendly:

Example: Node.js / TypeScript

const API_KEY = process.env.SWIFTNDA_API_KEY;
const BASE_URL = "https://swiftnda.com/api/v1";

// List all draft NDAs
const response = await fetch(`${BASE_URL}/ndas?status=draft`, {
  headers: { Authorization: `Bearer ${API_KEY}` },
});
const data = await response.json();
console.log(`Found ${data.pagination.total} draft NDAs`);

// Create a new NDA
const createResponse = await fetch(`${BASE_URL}/ndas`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    recipientCompany: "Partner Inc",
    purpose: "Discuss partnership",
    ndaTermYears: 2,
    confidentialityTermYears: 3,
    senderPrintName: "Jane Smith",
    senderTitle: "CEO",
    senderCompany: "Acme Corp",
    senderAddressCountry: "US",
    senderAddressCity: "San Francisco",
    senderAddressZip: "94105",
    senderAddressStreet: "123 Market St",
    governingLaw: "California",
    jurisdiction: "San Francisco County, California",
    creationType: "quick",
  }),
});

if (createResponse.status === 201) {
  const newNda = await createResponse.json();
  console.log(`Created NDA: ${newNda.nda.id}`);
  // Creation is free; send the sender's signing URL to sign (which consumes quota).
  console.log(`Sign here: ${newNda.nda.senderSigningUrl}`);
}

Example: Python

import requests

API_KEY = "YOUR_API_KEY"
BASE_URL = "https://swiftnda.com/api/v1"
headers = {"Authorization": f"Bearer {API_KEY}"}

# List NDAs
response = requests.get(f"{BASE_URL}/ndas", headers=headers)
data = response.json()
print(f"Found {data['pagination']['total']} NDAs")

# Download a PDF
pdf_response = requests.get(
    f"{BASE_URL}/ndas/{nda_id}/pdf", headers=headers
)
with open("nda.pdf", "wb") as f:
    f.write(pdf_response.content)

MCP Server

SwiftNDA is also a hosted MCP (Model Context Protocol) server, so an agent in Claude Code, Claude Desktop, or claude.ai can drive your NDAs as native tools — no glue code. It is the same API behind this page: every tool maps 1:1 onto a v1 endpoint and is authenticated with the same API key. The server adds no new permissions — a tool can do exactly what your API key can do.

https://swiftnda.com/mcp

Authentication

Present the same API key you use for the REST API, in the transport header — as a bearer token (primary) or the X-API-Key header. Never put a key in a tool argument. A missing, malformed, invalid, or revoked key returns 401 (with a WWW-Authenticate: Bearer challenge); a guest-account key returns 403 — the same ladder the REST API uses.

Authorization: Bearer snda_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Tools

The server exposes these 18 tools, each a pass-through to the matching v1 endpoint documented above:

This includes agent-executed sender signing (nda_execute_sender_signature) and webhook management (webhook_*). Webhooks deliver to your own backend, not the MCP client, and nda_execute_sender_signature consumes 1 NDA of quota under a dashboard-granted signing authorization.

Connect a client

Claude Code

Add the server with the CLI (one line):

claude mcp add --transport http swiftnda https://swiftnda.com/mcp \
  --header "Authorization: Bearer snda_..."

Claude Desktop

Add an entry to mcpServers in your claude_desktop_config.json:

{
  "mcpServers": {
    "swiftnda": {
      "type": "http",
      "url": "https://swiftnda.com/mcp",
      "headers": {
        "Authorization": "Bearer snda_..."
      }
    }
  }
}

claude.ai custom connector

In claude.ai go to Settings → Connectors → Add custom connector, name it SwiftNDA, and use the remote server URL below. In the connector's advanced settings, add the Authorization header carrying your key:

Remote MCP server URL:  https://swiftnda.com/mcp
HTTP header:            Authorization: Bearer snda_...

Any other MCP client

Point any Streamable-HTTP MCP client at https://swiftnda.com/mcp and send your key on every request via the Authorization: Bearer snda_... (or X-API-Key) header. The server is stateless and POST-only — there is no SSE stream or session to manage.