Signing (client)

The sign.* family (9 verbs). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.

Createsign.annotation.create

A PDF annotation/variable overlay row. { documentId, pageNumber, type?, x, y, width, height, color?, label?, comment?, metadata?(json) }. created_by_id = acting user.

Call POST /v/sign.annotation.create with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool sign.annotation.create.

Deletesign.annotation.delete

Delete one annotation by id, workspace-fenced. { annotationId }.

Call POST /v/sign.annotation.delete with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool sign.annotation.delete.

Delete Manysign.annotation.deleteMany

Delete all annotations for a document, workspace-fenced (0-row = success). { documentId }. Lifted OUT of the doc-purge $transaction cascades (regenerable rows).

Call POST /v/sign.annotation.deleteMany with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool sign.annotation.deleteMany.

Updatesign.annotation.update

Partial patch by id (metadata===null -> SQL NULL preserved via the present-flag). { annotationId, pageNumber?, type?, x?, y?, width?, height?, color?, label?(|null), comment?(|null), metadata?(json|null) }. Workspace-fenced.

Call POST /v/sign.annotation.update with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool sign.annotation.update.

Createsign.envelopeExt.create

The 1:1 provider-orchestration tail of the kernel envelope. { envelopeId, sourceFileId?, signingOrder?(SEQUENTIAL|PARALLEL), consentText?, sourceDocumentId? }.

Call POST /v/sign.envelopeExt.create with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool sign.envelopeExt.create.

Updatesign.envelopeExt.update

Partial COALESCE patch by envelopeId. { envelopeId, consentText?, signedFileId?, signedFileChecksum?, auditCertFileId?, auditCertChecksum?, signingOrder?, reminderCadence?(json|null) }.

Call POST /v/sign.envelopeExt.update with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool sign.envelopeExt.update.

Createsign.fieldExt.create

The 1:1 Designer UI vocabulary for a kernel field. { fieldId, envelopeId, uiType, recipientRole?, defaultValue?, options?(json), tabOrder?, label? }.

Call POST /v/sign.fieldExt.create with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool sign.fieldExt.create.

Delete Manysign.fieldExt.deleteMany

Best-effort hygiene cleanup after the kernel field is removed (0-row delete is success). { fieldId }. Workspace-fenced.

Call POST /v/sign.fieldExt.deleteMany with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool sign.fieldExt.deleteMany.

Updatesign.fieldExt.update

Partial patch by fieldId; UPDATE-only (does NOT synthesise an ext row - rows_affected==0 -> changed

Call POST /v/sign.fieldExt.update with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool sign.fieldExt.update.