Priva6 API

The Priva6 API does one thing well: it sends an existing document for signature to a client. You prepare the document once in Priva6 (its content, annexes, requested fields, emails and reminders), and your software sends it to as many clients as needed.

• REST + JSON
  One endpoint, JSON in and out.
• API keys
  Created by your organization admins.
• 100 sends / hour
  Per API key.
• Audited
  Each send is in the audit trail.

The client receives an email with a secure signing link, and is saved in your organization’s clients: a new client, or the existing client with the same email (case-insensitive), updated with the details sent. Every send is recorded in the document’s audit trail, with the API key’s name.

1. In Priva6, an organization admin creates an API key in Settings → API keys. Copy it: it is shown only once.
2. Open the document to send and copy its ID, shown on the document page.
3. Call the endpoint below from your server with the client’s name and email.

curl -X POST "https://api.priva6.com/functions/v1/api/documents/3f1c9a52-7b4e-4c1d-9a2f-5e8b6d0c1a23/send" \
  -H "X-API-Key: $PRIVA6_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Jane Doe",
    "email": "jane@acme.com",
    "company": "Acme SAS",
    "position": "Data Protection Officer",
    "country": "FR",
    "expiry_days": 7,
    "sender_email": "alice@yourcompany.com"
}'

Authenticate every request with your API key in the X-API-Key header. Keys start with p6_.

X-API-Key: p6_…

Keep your key secret, on your server only: never in a browser, a mobile app or a public repository. Priva6 only stores a fingerprint of each key; if a key leaks, revoke it in Settings and create a new one. Revoked keys stop working immediately.

POSThttps://api.priva6.com/functions/v1/api/documents/{documentId}/send

Sends the latest revision of the document to the client. The ID of any revision (or the document key) can be used: the latest revision is always sent. The subject, message and link expiry default to the document’s settings, and the document’s reminders follow until the client signs.

Path parameter

Request body (JSON)

Only name and email are required. Optional client fields that are empty or omitted leave the existing client’s details unchanged.

On success, the API answers 201 Created with the signing request and the client as saved.

{
    "signature": {
        "id": "8d2e4f10-1c3b-4a5d-8e7f-9a0b1c2d3e4f",
        "status": "pending",
        "expires_at": "2026-10-29T15:04:05.000Z",
        "document_id": "3f1c9a52-7b4e-4c1d-9a2f-5e8b6d0c1a23",
        "revision": 2
    },
    "client": {
        "id": "5b6c7d8e-9f0a-4b1c-8d2e-3f4a5b6c7d8e",
        "name": "Jane Doe",
        "email": "jane@acme.com",
        "company": "Acme SAS",
        "vat": null,
        "registration_number": null,
        "website": null,
        "position": "Data Protection Officer",
        "department": null,
        "phone": null,
        "address": null,
        "zipcode": null,
        "city": null,
        "country": "FR"
    }
}

The email_subject and email_body fields accept these placeholders, replaced for each client:

If {link} isn’t placed in the body, the signing link is added at the end.

Errors use standard HTTP status codes and a JSON body with an error message in plain English:

{ "error": "A valid \"email\" is required" }

• 100 sends per hour per API key; beyond that, the API answers 429.
• Client emails are also subject to your organization’s sending quotas, which are lower during a new workspace’s first 14 days.
• Signing links stay valid from 1 to 365 days (expiry_days), 14 days unless the document says otherwise.
• An archived document can’t be sent (409) until it is restored in Priva6.

The full API is described in an OpenAPI 3.1 document you can import in Postman, Insomnia or your code generator.

Need another endpoint? Tell us what you are building at contact@priva6.com.