# SwiftNDA API

SwiftNDA is a platform for creating, signing, and managing Non-Disclosure
Agreements (NDAs) with digital signatures. This file orients LLM agents that
want to drive the API. It is not the contract — the machine-readable contract
is the OpenAPI 3.1 document linked below.

## Base URL

https://swiftnda.com  (paths are under /api/v1)

## Authentication

Every request needs an API key, sent either as a bearer token
(`Authorization: Bearer snda_...`) or in the `X-API-Key` header. Create keys on
your SwiftNDA profile page. Keys are rate-limited to 100 requests/minute.

## The two rules an agent cannot infer

1. Creating an NDA is FREE and never consumes quota. `POST /api/v1/ndas` returns
   a draft with a `senderSigningUrl` and a `recipientSigningUrl`. Quota is
   consumed only when the SENDER (the NDA owner) signs — either in the browser via
   `senderSigningUrl`, or via `POST /api/v1/ndas/{id}/execute` once the owner has
   granted that authorization in the dashboard.
2. Recipient signing is FREE and browser-based. Share `recipientSigningUrl` with
   the counterparty; they sign in the browser with no account. There is no API
   endpoint for recipient signing — it is deliberately human/browser-only.

## Vocabulary

Every party field is canonical: `sender*` is the NDA owner (disclosing party),
`recipient*` is the counterparty. Errors use one envelope:
`{ "success": false, "error": "...", "code": "MACHINE_CODE", "details"?: [...] }`.

## Endpoints (v1)

- GET    /api/v1/me                     — the authenticated account + subscription/quota
- GET    /api/v1/ndas                   — list NDAs (paginated; sortBy/sortOrder/createdAfter/createdBefore)
- POST   /api/v1/ndas                   — create an NDA (free; Idempotency-Key supported)
- GET    /api/v1/ndas/{ndaId}           — NDA detail + signatures
- PATCH  /api/v1/ndas/{ndaId}           — update a draft NDA (draft-only)
- DELETE /api/v1/ndas/{ndaId}           — delete an NDA
- GET    /api/v1/ndas/{ndaId}/status    — cheap lifecycle-status polling target
- GET    /api/v1/ndas/{ndaId}/signatures— list signatures
- POST   /api/v1/ndas/{ndaId}/send      — email the recipient signing invitation
- POST   /api/v1/ndas/{ndaId}/execute   — execute the SENDER signature (needs a granted authorization; consumes quota)
- GET    /api/v1/ndas/{ndaId}/pdf       — download the NDA PDF
- GET    /api/v1/ndas/{ndaId}/audit-pdf — download the audit-trail PDF (fully-signed only)
- GET/POST/PATCH/DELETE /api/v1/webhooks[/{id}] — manage webhook subscriptions
- POST   /api/v1/webhooks/{id}/test     — send a test delivery

(The SENDER signature can be executed via POST /api/v1/ndas/{id}/execute once the
owner grants an authorization in the dashboard (else 403 NO_SIGNING_AUTHORIZATION);
otherwise the sender signs via senderSigningUrl in the browser. Recipient signing is
browser-only by design — there is no API endpoint for it. See the OpenAPI spec for
full request/response schemas, error codes, and rate-limit headers.)

## Machine-readable contract & docs

- OpenAPI 3.1 spec: https://swiftnda.com/api/v1/openapi.json
- MCP server:       https://swiftnda.com/mcp  (Streamable HTTP, stateless, POST) — the
  same operations as MCP tools mapped 1:1 onto the v1 endpoints above; authenticate with
  the same API key via `Authorization: Bearer snda_...` (or the `X-API-Key` header).
- Human docs:       https://swiftnda.com/api-docs