> ## Documentation Index > Fetch the complete documentation index at: https://docs.sajn.se/llms.txt > Use this file to discover all available pages before exploring further. # Create a bundle > Creates a draft bundle. A bundle sends several documents as one invitation, so each party signs all of their documents with one signature. Every document keeps its own signature, seal, audit trail, and certificate. The bundle owns who signs and how the send behaves: its parties and its send settings, which it writes onto every document in it. Each document keeps its content, fields, and document-level settings. Pass `documentIds` to add existing drafts. Their parties become the bundle's parties, one per email address. A person who signs with different methods, verifications, or roles on different documents, or documents with different signing modes, return `409 INVALID_STATE`. A document without parties gets every bundle party. Pass `parties` to set the parties yourself. They replace the parties the documents brought, and a party whose email address one of the documents already had keeps that document's fields. Send the bundle with `POST /api/v1/bundles/{id}/send` once it holds 2 or more documents. **Permission required:** `EDIT_DOCUMENT` on the workspace, and access to every document in the bundle. Requires a Team plan. ## OpenAPI ````yaml /api/openapi.json post /api/v1/bundles openapi: 3.1.0 info: title: sajn API version: 2026-10 description: >- # sajn - API v1 With the sajn REST API, you can add digital document signing to your own applications. ## Overview sajn is a Swedish digital document signing platform. With the API, you can: - Create and manage documents and templates - Add the parties who sign, review, or organize a document - Send documents for signing by email or SMS - Track document status and signatures - Manage contacts and companies - Organize documents with tags and custom fields - Verify identities with sajn ID, through BankID and other eIDs ## Authentication Every endpoint (except the health check) requires a bearer token in the Authorization header: ``` Authorization: Bearer YOUR_TOKEN ``` Two kinds of token are accepted: - **API key** — generated in the developer settings. A key belongs to a service account (`sajn_svc_...`), a non-human account the organization owns, or to the person who created it (`sajn_usr_...`). It can reach any endpoint its owner's workspace role permits, and holds no organization permissions. Service-account keys keep working when the person who created them leaves. Older keys start with `sajn_sk_` and keep working. - **OAuth 2.0 access token** — issued via the authorization-code flow (PKCE for public clients) to a connected application. Bound to one workspace and limited to the **scopes** the user granted at consent — effective access is *workspace role ∩ granted scopes*. An API key acts in its default workspace. To act in another workspace the key's account is a member of, send its ID in the `Sajn-Workspace` header: ``` Sajn-Workspace: WORKSPACE_ID ``` `GET /api/v1/workspaces` lists the workspaces the token can reach. A workspace that doesn't exist and one the key can't reach both return `403 WORKSPACE_ACCESS_DENIED`, and a header that isn't a single workspace ID returns `400 VALIDATION_FAILED`; the key's default workspace is never used instead. Each operation lists the OAuth scopes it requires in its security section. The scopes are coarse and resource-oriented (e.g. `documents:read`, `documents:write`, `documents:delete`, `contacts:read`). Personal API keys are not scope-limited; OAuth tokens are. ## Rate Limiting Limits apply per organization and scale with the plan: | Plan | Per minute | |---|---| | Basic | 60 | | Solo | 120 | | Team | 600 | | Enterprise | 2 000 | | Sandbox | 60 | Every response carries `X-RateLimit-Limit`, `X-RateLimit-Remaining` and `X-RateLimit-Reset` for the minute window. A `429` response includes `Retry-After` in seconds. ## Query parameters Query parameters are plain strings, such as `?externalId=12345&archived=false`: - Booleans are `true` or `false`. - Dates are ISO 8601 dates (`2026-10-01`) or date-times (`2026-10-01T08:00:00Z`). A date-time without an offset is UTC. - Filters that take several values accept a comma-separated list (`status=PENDING,COMPLETED`) or a repeated parameter (`status=PENDING&status=COMPLETED`). An unknown query parameter returns `400`, so a misspelled filter never silently returns everything. ## Pagination Every list returns `{ data, hasMore, nextCursor }`. To walk a list, pass `nextCursor` as `cursor` on the next request, keep the other parameters unchanged, and stop when `hasMore` is `false`. `limit` sets the page size, from 1 to 100, with a default of 25. To get the number of items that match the filters, pass `include=total`, and the response adds `total`. Lists sort newest first. To sort another way, pass `orderBy` and `orderDirection` where the list takes them. A list bounded by its parent, such as a document's parties, returns every item in one response, with `hasMore` set to `false` and `nextCursor` set to `null`. On the documents list, the cursor is keyset-based: it stays correct while documents are created and updated between requests. To mirror documents into your own system, sort by `updatedAt` and use the `updatedAfter` filter. ## Idempotent requests Send an `Idempotency-Key` header (any unique string up to 255 characters, for example a UUID) on `POST`, `PATCH` or `DELETE` requests to make retries safe. The first request runs normally and its response is stored for 24 hours, errors included. A retry with the same key and the same method, path and body returns the stored response with the header `Idempotent-Replayed: true`. Reusing a key with a different request returns `400 IDEMPOTENCY_KEY_REUSED`; retrying while the first request is still running returns `409 IDEMPOTENCY_KEY_IN_USE` with `Retry-After`. Responses with a `429` or `5xx` status aren't stored, so the retry runs again. Keys are scoped to the workspace. ## Versioning The API is versioned by date (`YYYY-MM`), and this reference documents version `2026-10`. To choose the version for a request, send the `Sajn-Version` header: ``` Sajn-Version: 2026-10 ``` Without the header, a request uses your organization's default version. An organization without a default is pinned to the latest version by its first request. Every response returns the version that served it in `Sajn-Version`. On a deprecated version, responses also carry `Deprecation` and `Sunset` headers, and from the sunset date its requests return `400`. For details, see https://docs.sajn.se/api-reference/versioning. ## Webhooks Each webhook endpoint has its own API version, set when you create it, that decides the payload shape. Deliveries carry it in the `Sajn-Version` header. The delivery body is the event, `{ id, type, createdAt, apiVersion, workspaceId, environment, actor, data }`, signed according to [Standard Webhooks](https://www.standardwebhooks.com) in the `webhook-id`, `webhook-timestamp` and `webhook-signature` headers. Common document events: - `document.created` - A document is created. - `document.sent` - A document is sent for signing. - `document.party.opened` - A party opens the document. - `document.party.signed` - A party signs the document. - `document.fully_signed` - Every signer has signed, before the document is sealed. - `document.completed` - The document is sealed and complete. - `document.rejected` - A party rejects the document. For every event type, see `POST /api/v1/webhooks`. ## Error Handling Every error response has the same JSON shape: ```json { "code": "NOT_FOUND", "message": "Document not found", "userMessage": "Dokumentet hittades inte.", "requestId": "req_V1StGXR8Z5jdHi6BmyT2", "resource": "document" } ``` - `code` is always present and comes from the closed list in the following table. Branch on it, not on the status or the message. - `message` is English text for developers. When the operation has no more specific text, it's the meaning of `code` from the following table. Its wording can change, so don't parse it. - `userMessage` is always present. It's text that is safe to show your users, usually in Swedish. - `requestId` identifies the request and matches the `Sajn-Request-Id` header, which every response carries. Quote it when you contact support. On a replayed idempotent response, it identifies the original request. A `400 VALIDATION_FAILED` lists every problem in `issues`: `[{ "path": "parties.0.email", "code": "INVALID_FORMAT", "message": "Invalid email address" }]`. An issue `code` is one of `INVALID_TYPE`, `INVALID_FORMAT`, `INVALID_VALUE`, `TOO_SMALL`, `TOO_BIG` or `UNRECOGNIZED_KEY`, and an issue that no single input caused has an empty `path`. A `404 NOT_FOUND` names the type of the missing resource in `resource`, such as `document` or `party`, or `null` when the API can't tell. A `403 INSUFFICIENT_SCOPE` includes `requiredScopes` and `grantedScopes`. A `401` always means the credential itself is the problem: `UNAUTHORIZED` when it's missing, invalid or revoked, `API_KEY_EXPIRED` when the key has expired. A valid token that isn't allowed to do something gets a `403`. A `409 INVALID_STATE` means the resource's state doesn't allow the operation; change the state first, then retry. A `503 UPSTREAM_UNAVAILABLE` is safe to retry with exponential backoff, and so is a `429` after `Retry-After` seconds. The API returns the following codes: | Code | Status | Meaning | |---|---|---| | `VALIDATION_FAILED` | 400 | The request failed validation. `issues` lists every problem. | | `INVALID_JSON` | 400 | The request body isn't valid JSON. | | `EXPIRED` | 400 | The link, code or resource has expired. | | `IDEMPOTENCY_KEY_REUSED` | 400 | The `Idempotency-Key` was already used with a different request. | | `WORKSPACE_REQUIRED` | 400 | The API key has no default workspace. Name one with the `Sajn-Workspace` header. | | `INVALID_API_VERSION` | 400 | The `Sajn-Version` header names a version that doesn't exist. | | `API_VERSION_SUNSET` | 400 | The requested version, or your organization's default, is past its sunset date. | | `UNAUTHORIZED` | 401 | The API token is missing, invalid or revoked. | | `API_KEY_EXPIRED` | 401 | The API key has passed its expiry date. Create a new key. | | `PERMISSION_DENIED` | 403 | The token's user isn't allowed to perform the operation, for example because their workspace role lacks a permission. | | `WORKSPACE_ACCESS_DENIED` | 403 | The workspace named by the `Sajn-Workspace` header doesn't exist, or the token can't act in it. | | `INSUFFICIENT_SCOPE` | 403 | The OAuth token wasn't granted a scope the operation requires. See `requiredScopes` and `grantedScopes`. | | `PLAN_REQUIRED` | 403 | The organization's plan doesn't include API access or the feature. | | `ACCOUNT_INACTIVE` | 403 | The organization, user or membership behind the token is deactivated or suspended. | | `ACCOUNT_SETUP_REQUIRED` | 403 | The organization must finish its setup, such as verifying an accountable person, first. | | `LIMIT_EXCEEDED` | 403 | A plan limit was reached, such as the monthly number of sent documents. | | `DOCUMENT_NOT_READY` | 409 | The document can't be sent yet. `readiness` lists what blocks it, the same list `GET /api/v1/documents/:id/readiness` returns. | | `APPROVAL_REQUIRED` | 409 | The operation needs an approval first, such as sending a document that the workspace requires an approval for. Request one with `POST /api/v1/approval-requests`. | | `NOT_FOUND` | 404 | The resource doesn't exist, or the token can't access it. `resource` names its type, such as `document`, or is `null` when the API can't tell. | | `ROUTE_NOT_FOUND` | 404 | No endpoint matches the method and path in the requested API version. | | `INVALID_STATE` | 409 | The resource's current state doesn't allow the operation, such as editing a document that was already sent or downloading a file that isn't produced yet. | | `BUNDLE_OWNS_SETTING` | 409 | The document is in a bundle, and the bundle owns what the operation changes: the parties, the send settings, sending, and withdrawing. Make the change on the bundle, through `/api/v1/bundles/{id}`. The document's `bundleId` names it. | | `ALREADY_EXISTS` | 409 | A resource with the same unique value, such as `externalId`, already exists. | | `IDEMPOTENCY_KEY_IN_USE` | 409 | A request with the same `Idempotency-Key` is still running. Retry after `Retry-After` seconds. | | `RATE_LIMITED` | 429 | The per-minute rate limit was reached. Retry after `Retry-After` seconds. | | `INTERNAL_ERROR` | 500 | Something went wrong on sajn's side. Quote `requestId` when you contact support. | | `UPSTREAM_UNAVAILABLE` | 503 | A service the operation depends on, such as an eID provider or a connected integration, failed or is unavailable. Retry with exponential backoff. | ## Support For API support, documentation, or questions: - Email: dev@sajn.se - Documentation: https://docs.sajn.se - Status: https://status.sajn.se contact: name: sajn Support email: dev@sajn.se url: https://www.sajn.se/support license: name: Policy url: https://www.sajn.se/allmanna-villkor servers: - url: https://app.sajn.se description: Production server security: [] tags: - name: Health description: API health and version information - name: Documents description: Create, manage, and send documents for signing - name: Templates description: Create and manage templates that can be used to spin up new documents - name: Parties description: Manage document parties (signers and other participants) - name: Bundles description: >- Send several documents as one invitation, so each person signs all of theirs in one action - name: Contacts description: Manage contacts and contact information - name: Companies description: Manage companies and organizations - name: Fields description: Manage document fields and sections - name: Tags description: Organize documents with tags - name: Custom Fields description: Define and manage custom fields for documents - name: sajn ID description: Identity verification with Swedish BankID - name: Files description: >- Upload and manage files. `POST /api/v1/files` returns a presigned URL that you upload the bytes to. - name: Folders description: Organize documents and templates into hierarchical folders - name: Comments description: Thread-based discussion on documents - name: Reminders description: Send and inspect signing reminders on a document - name: Helpers description: 'Reference data: languages, countries, currencies, timezones' - name: Organization description: Authenticated organization metadata and branding - name: Webhook Deliveries description: Inspect and retry past webhook deliveries - name: Delegations description: Read-only access to signer delegation events on a document - name: Blocks description: Reusable library blocks for templates paths: /api/v1/bundles: post: summary: Create a bundle description: >- Creates a draft bundle. A bundle sends several documents as one invitation, so each party signs all of their documents with one signature. Every document keeps its own signature, seal, audit trail, and certificate. The bundle owns who signs and how the send behaves: its parties and its send settings, which it writes onto every document in it. Each document keeps its content, fields, and document-level settings. Pass `documentIds` to add existing drafts. Their parties become the bundle's parties, one per email address. A person who signs with different methods, verifications, or roles on different documents, or documents with different signing modes, return `409 INVALID_STATE`. A document without parties gets every bundle party. Pass `parties` to set the parties yourself. They replace the parties the documents brought, and a party whose email address one of the documents already had keeps that document's fields. Send the bundle with `POST /api/v1/bundles/{id}/send` once it holds 2 or more documents. **Permission required:** `EDIT_DOCUMENT` on the workspace, and access to every document in the bundle. Requires a Team plan. operationId: createBundle parameters: - name: Sajn-Version in: header required: false schema: type: string enum: - 2026-09 - 2026-10 description: >- API version for this request. Without it, the request uses the organization's default version; an organization without a default is pinned to the latest version by its first request. - name: Sajn-Workspace in: header required: false schema: type: string description: >- ID of the workspace this request acts in, from `GET /api/v1/workspaces`. Without it, an API key acts in its default workspace. The token's user must be a member of the workspace; an OAuth token only accepts the workspace it was granted for. A workspace that doesn't exist or can't be reached returns `403 WORKSPACE_ACCESS_DENIED`. - name: Idempotency-Key in: header required: false schema: type: string maxLength: 255 description: >- Makes retries safe. A retry with the same key and the same request replays the stored response for 24 hours (header `Idempotent-Replayed: true`); the same key with a different request returns 400. requestBody: description: Body content: application/json: schema: type: object properties: name: description: >- The bundle name, shown as the heading of the bundle page and in the invitation. type: - string - 'null' maxLength: 200 subject: description: The subject line of the invitation email. type: - string - 'null' message: description: A message included in every invitation. type: - string - 'null' expiresAt: description: >- The expiry date of the bundle. Every document in it gets the same one. type: - string - 'null' format: date-time signableAfterExpired: type: boolean description: Whether the documents can still be signed after `expiresAt`. sendPlainTextEmailOnly: description: >- Send plain text invitations only, without HTML. null inherits the workspace default. type: - boolean - 'null' redirectUrl: description: >- URL to send a party to once they have signed. Must be http(s). type: - string - 'null' redirectEnabled: type: boolean description: Whether `redirectUrl` is used. signingMode: type: string enum: - PARALLEL - SEQUENTIAL description: >- How the parties sign: `PARALLEL`, all at once, or `SEQUENTIAL`, one at a time in the order of each party's `signingOrder`. The order runs across every document in the bundle. language: type: string enum: - sv - en - 'no' - da - fi - de - is - es - fr - it description: >- Language of the bundle page and the emails to the parties, an ISO 639-1 code such as `sv`. reminderIntervalDays: description: >- Days between automatic reminders. `0` turns them off, and null uses the default of 3. type: - integer - 'null' minimum: 0 maximum: 9007199254740991 internalRecipients: description: >- Email addresses that receive a copy of each sealed PDF once its document is completed. At most 5. Pass an empty array to clear. maxItems: 5 type: array items: type: string format: email pattern: >- ^(?:[A-Za-z0-9_'+\-]+\.)*[A-Za-z0-9_'+\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$ nationalIdDisplayMode: description: >- How national identity numbers are displayed to signers: `FULL`, `PARTIAL`, or `NONE`. null keeps each document's own setting. type: - string - 'null' enum: - FULL - PARTIAL - NONE - null openVerification: description: >- Verification every party passes before the document opens: `PIN`, `SMS`, `EMAIL`, or an eID such as `SE_BANKID`. null means none. A party's own `openVerification` overrides it. type: - string - 'null' enum: - PIN - SMS - EMAIL - SE_BANKID - NO_BANKID_BIOMETRIC - NO_BANKID_HIGH - DK_MITID - DK_MITID_ERHVERV - FI_FTN - NL_IDIN - null documentIds: description: >- Draft documents to add, up to 50. Each one must be a `DRAFT` in the workspace that isn't in another bundle, and each of its parties needs an email address. Its parties become the bundle's parties, one per email address. maxItems: 50 type: array items: type: string minLength: 1 parties: description: >- The bundle's parties. When you pass them, they replace the parties the documents brought, as `PUT /api/v1/bundles/{id}/parties` does. maxItems: 100 type: array items: type: object properties: name: type: string minLength: 1 description: The party's full name. email: type: string format: email pattern: >- ^(?:[A-Za-z0-9_'+\-]+\.)*[A-Za-z0-9_'+\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$ description: >- The email address the party gets the invitation at. A bundle has one party per email address, and a party already in the bundle with this address keeps its ID, so the fields assigned to it stay. phone: description: >- Phone number, for SMS invitations and SMS verification. type: - string - 'null' role: description: >- `SIGNER` (default), `ORGANIZER`, or `REVIEWER`. Only `SIGNER` parties sign. type: string enum: - SIGNER - ORGANIZER - REVIEWER signingOrder: description: >- The party's step for `SEQUENTIAL` signing. Defaults to its position in `parties`, starting at 1. type: - integer - 'null' minimum: -9007199254740991 maximum: 9007199254740991 delivery: type: array items: type: string enum: - EMAIL - SMS - IN_APP description: >- How the party gets the invitation: `["EMAIL"]`, `["SMS"]`, `["EMAIL", "SMS"]` for both, or `["IN_APP"]` to sign in person on your device. `[]` sends nothing, so you share the signing URL yourself. Each channel needs the matching contact detail. signatureMethod: description: >- How the party signs: `DRAWING`, `SE_BANKID`, `CLICK_TO_SIGN`, or another eID. Call `GET /api/v1/helpers/signature-methods` for the methods your account can use. A party already in the bundle keeps its method when you leave it out, and a new one gets `DRAWING`. type: string enum: - NONE - DRAWING - SE_BANKID - MANUAL - CLICK_TO_SIGN - NO_BANKID_BIOMETRIC - NO_BANKID_HIGH - NO_QES - DK_MITID - DK_MITID_ERHVERV - FI_FTN - NL_IDIN - ZEALID_QES signVerification: description: >- Verification the party passes before signing: `PIN`, `SMS`, `EMAIL`, or an eID such as `SE_BANKID`. null means none. Call `GET /api/v1/helpers/two-step-verifications` for the methods your account can use. type: - string - 'null' enum: - PIN - SMS - EMAIL - SE_BANKID - NO_BANKID_BIOMETRIC - NO_BANKID_HIGH - DK_MITID - DK_MITID_ERHVERV - FI_FTN - NL_IDIN - null openVerification: description: >- Verification this party passes before the documents open, in place of the bundle's `openVerification`: `SMS`, `EMAIL`, or an eID such as `SE_BANKID`. null uses the bundle's. type: - string - 'null' enum: - PIN - SMS - EMAIL - SE_BANKID - NO_BANKID_BIOMETRIC - NO_BANKID_HIGH - DK_MITID - DK_MITID_ERHVERV - FI_FTN - NL_IDIN - null documentIds: description: >- The documents in the bundle the party is on. Leave it out for every document. maxItems: 50 type: array items: type: string minLength: 1 required: - name - email additionalProperties: false additionalProperties: false example: name: Anställningspaket – Kai Lindqvist expiresAt: '2026-10-28T22:00:00.000Z' documentIds: - cm4k2x9p10003abcd1234efgh - cm4k2x9p10022abcd1234efgh parties: - name: Kai Lindqvist email: kai@example.com signatureMethod: SE_BANKID responses: '201': description: '201' content: application/json: schema: type: object properties: id: type: string description: The bundle ID. name: description: >- The bundle name, shown as the heading of the bundle page and in the invitation. type: - string - 'null' status: type: string enum: - DRAFT - OPEN - COMPLETED - CANCELED description: >- `DRAFT` while you build it, and again after a withdraw. `OPEN` from the send until every document is resolved, then `COMPLETED`. `CANCELED` after a cancel. subject: description: The subject line of the invitation email. type: - string - 'null' message: description: A message included in every invitation. type: - string - 'null' expiresAt: description: >- The expiry date of the bundle. Every document in it gets the same one. type: - string - 'null' format: date-time signingMode: type: string enum: - PARALLEL - SEQUENTIAL description: >- How the parties sign: `PARALLEL`, all at once, or `SEQUENTIAL`, one at a time in the order of each party's `signingOrder`. The order runs across every document in the bundle. language: type: string enum: - sv - en - 'no' - da - fi - de - is - es - fr - it description: >- Language of the bundle page and the emails to the parties, an ISO 639-1 code such as `sv`. reminderIntervalDays: description: >- Days between automatic reminders. `0` turns them off, and null uses the default of 3. type: - integer - 'null' minimum: -9007199254740991 maximum: 9007199254740991 signableAfterExpired: type: boolean description: >- Whether the documents can still be signed after `expiresAt`. internalRecipients: type: array items: type: string description: >- Email addresses that receive a copy of each sealed PDF once its document is completed. nationalIdDisplayMode: description: >- How national identity numbers are displayed to signers: `FULL`, `PARTIAL`, or `NONE`. null keeps each document's own setting. type: - string - 'null' enum: - FULL - PARTIAL - NONE - null openVerification: description: >- Verification every party passes before the document opens: `PIN`, `SMS`, `EMAIL`, or an eID such as `SE_BANKID`. null means none. A party's own `openVerification` overrides it. type: - string - 'null' enum: - PIN - SMS - EMAIL - SE_BANKID - NO_BANKID_BIOMETRIC - NO_BANKID_HIGH - DK_MITID - DK_MITID_ERHVERV - FI_FTN - NL_IDIN - null sendPlainTextEmailOnly: description: >- Send plain text invitations only, without HTML. null inherits the workspace default. type: - boolean - 'null' redirectUrl: description: URL to send a party to once they have signed. type: - string - 'null' redirectEnabled: type: boolean description: Whether `redirectUrl` is used. documentCount: type: integer minimum: -9007199254740991 maximum: 9007199254740991 description: The number of documents in `documents`. createdAt: type: string format: date-time description: When the bundle was created. updatedAt: type: string format: date-time description: When the bundle was last updated. documents: type: array items: type: object properties: id: type: string description: The document ID. name: type: string status: type: string enum: - DRAFT - PENDING_APPROVAL - PENDING - COMPLETED - EXPIRED - CANCELLED - REJECTED - IMPORTED parties: type: array items: type: object properties: id: type: string description: >- The party ID on this document, for the document and party endpoints. bundlePartyId: description: >- The bundle party this document party belongs to, from `parties`. type: - string - 'null' name: type: string email: type: - string - 'null' format: email pattern: >- ^(?:[A-Za-z0-9_'+\-]+\.)*[A-Za-z0-9_'+\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$ role: type: string enum: - SIGNER - ORGANIZER - REVIEWER signingStatus: type: string enum: - NOT_SIGNED - SIGNED - REJECTED signedAt: type: - string - 'null' format: date-time required: - id - bundlePartyId - name - email - role - signingStatus - signedAt additionalProperties: false required: - id - name - status - parties additionalProperties: false description: The documents in the bundle, oldest first. parties: type: array items: type: object properties: id: type: string description: >- The party ID. To get the party's signing URL, pass it to `GET /api/v1/bundles/{id}/parties/{partyId}`. name: type: string email: type: string format: email pattern: >- ^(?:[A-Za-z0-9_'+\-]+\.)*[A-Za-z0-9_'+\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$ description: >- The email address the party gets the invitation at. A bundle has one party per email address. phone: type: - string - 'null' role: type: string enum: - SIGNER - ORGANIZER - REVIEWER signingOrder: description: The party's step for `SEQUENTIAL` signing. type: - integer - 'null' minimum: -9007199254740991 maximum: 9007199254740991 delivery: type: array items: type: string enum: - EMAIL - SMS - IN_APP description: >- How the party gets the invitation: `["EMAIL"]`, `["SMS"]`, `["EMAIL", "SMS"]` for both, or `["IN_APP"]` to sign in person on your device. `[]` sends nothing, so you share the signing URL yourself. Each channel needs the matching contact detail. signatureMethod: description: >- How the party signs: `DRAWING`, `SE_BANKID`, `CLICK_TO_SIGN`, or another eID. type: - string - 'null' enum: - NONE - DRAWING - SE_BANKID - MANUAL - CLICK_TO_SIGN - NO_BANKID_BIOMETRIC - NO_BANKID_HIGH - NO_QES - DK_MITID - DK_MITID_ERHVERV - FI_FTN - NL_IDIN - ZEALID_QES - null signVerification: description: >- Verification the party passes before signing: `PIN`, `SMS`, `EMAIL`, or an eID such as `SE_BANKID`. null means none. Call `GET /api/v1/helpers/two-step-verifications` for the methods your account can use. type: - string - 'null' enum: - PIN - SMS - EMAIL - SE_BANKID - NO_BANKID_BIOMETRIC - NO_BANKID_HIGH - DK_MITID - DK_MITID_ERHVERV - FI_FTN - NL_IDIN - null openVerification: description: >- Verification this party passes before the documents open, in place of the bundle's `openVerification`. null uses the bundle's. type: - string - 'null' enum: - PIN - SMS - EMAIL - SE_BANKID - NO_BANKID_BIOMETRIC - NO_BANKID_HIGH - DK_MITID - DK_MITID_ERHVERV - FI_FTN - NL_IDIN - null status: description: >- `SIGNED` when the party has signed every one of their documents, `REJECTED` when they rejected any of them, otherwise `PENDING`. null for a party that doesn't sign, an `ORGANIZER` or `REVIEWER`. type: - string - 'null' enum: - PENDING - SIGNED - REJECTED - null documentIds: type: array items: type: string description: The documents in the bundle the party is on. required: - id - name - email - phone - role - signingOrder - delivery - signatureMethod - signVerification - openVerification - status - documentIds additionalProperties: false description: The bundle's parties, in signing order. required: - id - name - status - subject - message - expiresAt - signingMode - language - reminderIntervalDays - signableAfterExpired - internalRecipients - nationalIdDisplayMode - openVerification - sendPlainTextEmailOnly - redirectUrl - redirectEnabled - documentCount - createdAt - updatedAt - documents - parties additionalProperties: false example: id: cm4k2x9p10044abcd1234efgh name: Anställningspaket – Kai Lindqvist status: DRAFT subject: Ditt anställningsavtal från Exempelbolaget AB message: >- Hej Kai! Här är ditt anställningsavtal. Signera det med BankID senast den 28 oktober. expiresAt: '2026-10-28T22:00:00.000Z' signingMode: PARALLEL language: sv reminderIntervalDays: 3 signableAfterExpired: false internalRecipients: - hr@example.com nationalIdDisplayMode: FULL openVerification: PIN sendPlainTextEmailOnly: false redirectUrl: null redirectEnabled: true documentCount: 1 createdAt: '2026-09-28T09:12:00.000Z' updatedAt: '2026-09-28T09:15:00.000Z' documents: - id: cm4k2x9p10003abcd1234efgh name: Anställningsavtal – Kai Lindqvist status: DRAFT parties: - id: cm4k2x9p10004abcd1234efgh bundlePartyId: cm4k2x9p10004abcd1234efgh name: Kai Lindqvist email: kai@example.com role: SIGNER signingStatus: NOT_SIGNED signedAt: null parties: - id: cm4k2x9p10004abcd1234efgh name: Kai Lindqvist email: kai@example.com phone: '+46701740605' role: SIGNER signingOrder: 1 delivery: - EMAIL signatureMethod: SE_BANKID signVerification: PIN openVerification: PIN status: PENDING documentIds: - cm4k2x9p10003abcd1234efgh headers: Sajn-Version: description: API version that served the request. schema: type: string Deprecation: description: >- Present only when the version is deprecated: when it was deprecated, as `@`. schema: type: string Sunset: description: >- Present only when the version is deprecated: the HTTP date from which requests on this version return 400 `API_VERSION_SUNSET`. schema: type: string Sajn-Request-Id: description: >- Identifier of the request. Error bodies repeat it as `requestId`; quote it when you contact support. schema: type: string X-RateLimit-Limit: description: Requests allowed per minute. schema: type: integer X-RateLimit-Remaining: description: Requests left in the current minute. schema: type: integer X-RateLimit-Reset: description: When the minute window resets, in Unix seconds. schema: type: integer Idempotent-Replayed: description: >- `true` when the response is a stored response replayed for a repeated `Idempotency-Key`. schema: type: string '400': description: Error response content: application/json: schema: type: object properties: code: type: string enum: - VALIDATION_FAILED - INVALID_JSON - EXPIRED - IDEMPOTENCY_KEY_REUSED - WORKSPACE_REQUIRED - INVALID_API_VERSION - API_VERSION_SUNSET - UNAUTHORIZED - API_KEY_EXPIRED - PERMISSION_DENIED - WORKSPACE_ACCESS_DENIED - INSUFFICIENT_SCOPE - PLAN_REQUIRED - ACCOUNT_INACTIVE - ACCOUNT_SETUP_REQUIRED - LIMIT_EXCEEDED - DOCUMENT_NOT_READY - APPROVAL_REQUIRED - NOT_FOUND - ROUTE_NOT_FOUND - INVALID_STATE - BUNDLE_OWNS_SETTING - ALREADY_EXISTS - IDEMPOTENCY_KEY_IN_USE - RATE_LIMITED - INTERNAL_ERROR - UPSTREAM_UNAVAILABLE description: >- Machine-readable error code from a closed list. Branch on it, never on `message`. message: type: string description: >- What went wrong, in English, for developers. Its wording can change; don't parse it. userMessage: type: string description: >- Text that is safe to show to an end user, usually in Swedish requestId: type: string description: >- Identifier of the request, the same value as the `Sajn-Request-Id` header. Quote it when you contact support. resource: description: >- On a 404 `NOT_FOUND`, the type of the missing resource, such as `document` or `party`; `null` when the API can't tell type: - string - 'null' issues: description: Every validation issue, on a 400 `VALIDATION_FAILED` type: array items: type: object properties: path: type: string description: >- Dotted path to the invalid value, such as `parties.0.email`; empty when no single input caused the issue code: type: string enum: - INVALID_TYPE - INVALID_FORMAT - INVALID_VALUE - TOO_SMALL - TOO_BIG - UNRECOGNIZED_KEY message: type: string description: What is wrong with the value, in English required: - path - code - message additionalProperties: false requiredScopes: description: >- OAuth scopes the endpoint requires, on a 403 `INSUFFICIENT_SCOPE` type: array items: type: string grantedScopes: description: >- OAuth scopes the token was granted, on a 403 `INSUFFICIENT_SCOPE` type: array items: type: string readiness: description: >- What blocks sending the document, on a 409 `DOCUMENT_NOT_READY` type: array items: type: object properties: code: type: string description: >- What is wrong, such as `MISSING_EMAIL` or `NO_EXPIRATION`. New codes can be added. severity: type: string enum: - BLOCKER - WARNING description: '`BLOCKER` stops the send; `WARNING` doesn''t.' message: type: string description: What is wrong, in English userMessage: type: string description: >- The same, naming the party or field, in Swedish, for showing to a user required: - code - severity - message - userMessage additionalProperties: false required: - code - message - userMessage - requestId additionalProperties: {} description: Error response example: code: VALIDATION_FAILED message: 'Invalid input: expected string, received number' userMessage: Förfrågan innehåller ogiltiga värden. requestId: req_V1StGXR8Z5jdHi6BmyT2 issues: - path: name code: INVALID_TYPE message: 'Invalid input: expected string, received number' headers: Sajn-Version: description: API version that served the request. schema: type: string Deprecation: description: >- Present only when the version is deprecated: when it was deprecated, as `@`. schema: type: string Sunset: description: >- Present only when the version is deprecated: the HTTP date from which requests on this version return 400 `API_VERSION_SUNSET`. schema: type: string Sajn-Request-Id: description: >- Identifier of the request. Error bodies repeat it as `requestId`; quote it when you contact support. schema: type: string X-RateLimit-Limit: description: Requests allowed per minute. schema: type: integer X-RateLimit-Remaining: description: Requests left in the current minute. schema: type: integer X-RateLimit-Reset: description: When the minute window resets, in Unix seconds. schema: type: integer Idempotent-Replayed: description: >- `true` when the response is a stored response replayed for a repeated `Idempotency-Key`. schema: type: string '401': description: Error response content: application/json: schema: type: object properties: code: type: string enum: - VALIDATION_FAILED - INVALID_JSON - EXPIRED - IDEMPOTENCY_KEY_REUSED - WORKSPACE_REQUIRED - INVALID_API_VERSION - API_VERSION_SUNSET - UNAUTHORIZED - API_KEY_EXPIRED - PERMISSION_DENIED - WORKSPACE_ACCESS_DENIED - INSUFFICIENT_SCOPE - PLAN_REQUIRED - ACCOUNT_INACTIVE - ACCOUNT_SETUP_REQUIRED - LIMIT_EXCEEDED - DOCUMENT_NOT_READY - APPROVAL_REQUIRED - NOT_FOUND - ROUTE_NOT_FOUND - INVALID_STATE - BUNDLE_OWNS_SETTING - ALREADY_EXISTS - IDEMPOTENCY_KEY_IN_USE - RATE_LIMITED - INTERNAL_ERROR - UPSTREAM_UNAVAILABLE description: >- Machine-readable error code from a closed list. Branch on it, never on `message`. message: type: string description: >- What went wrong, in English, for developers. Its wording can change; don't parse it. userMessage: type: string description: >- Text that is safe to show to an end user, usually in Swedish requestId: type: string description: >- Identifier of the request, the same value as the `Sajn-Request-Id` header. Quote it when you contact support. resource: description: >- On a 404 `NOT_FOUND`, the type of the missing resource, such as `document` or `party`; `null` when the API can't tell type: - string - 'null' issues: description: Every validation issue, on a 400 `VALIDATION_FAILED` type: array items: type: object properties: path: type: string description: >- Dotted path to the invalid value, such as `parties.0.email`; empty when no single input caused the issue code: type: string enum: - INVALID_TYPE - INVALID_FORMAT - INVALID_VALUE - TOO_SMALL - TOO_BIG - UNRECOGNIZED_KEY message: type: string description: What is wrong with the value, in English required: - path - code - message additionalProperties: false requiredScopes: description: >- OAuth scopes the endpoint requires, on a 403 `INSUFFICIENT_SCOPE` type: array items: type: string grantedScopes: description: >- OAuth scopes the token was granted, on a 403 `INSUFFICIENT_SCOPE` type: array items: type: string readiness: description: >- What blocks sending the document, on a 409 `DOCUMENT_NOT_READY` type: array items: type: object properties: code: type: string description: >- What is wrong, such as `MISSING_EMAIL` or `NO_EXPIRATION`. New codes can be added. severity: type: string enum: - BLOCKER - WARNING description: '`BLOCKER` stops the send; `WARNING` doesn''t.' message: type: string description: What is wrong, in English userMessage: type: string description: >- The same, naming the party or field, in Swedish, for showing to a user required: - code - severity - message - userMessage additionalProperties: false required: - code - message - userMessage - requestId additionalProperties: {} description: Error response example: code: UNAUTHORIZED message: Invalid API token userMessage: Ogiltig API-nyckel requestId: req_V1StGXR8Z5jdHi6BmyT2 headers: Sajn-Version: description: API version that served the request. schema: type: string Deprecation: description: >- Present only when the version is deprecated: when it was deprecated, as `@`. schema: type: string Sunset: description: >- Present only when the version is deprecated: the HTTP date from which requests on this version return 400 `API_VERSION_SUNSET`. schema: type: string Sajn-Request-Id: description: >- Identifier of the request. Error bodies repeat it as `requestId`; quote it when you contact support. schema: type: string X-RateLimit-Limit: description: Requests allowed per minute. schema: type: integer X-RateLimit-Remaining: description: Requests left in the current minute. schema: type: integer X-RateLimit-Reset: description: When the minute window resets, in Unix seconds. schema: type: integer Idempotent-Replayed: description: >- `true` when the response is a stored response replayed for a repeated `Idempotency-Key`. schema: type: string '403': description: Error response content: application/json: schema: type: object properties: code: type: string enum: - VALIDATION_FAILED - INVALID_JSON - EXPIRED - IDEMPOTENCY_KEY_REUSED - WORKSPACE_REQUIRED - INVALID_API_VERSION - API_VERSION_SUNSET - UNAUTHORIZED - API_KEY_EXPIRED - PERMISSION_DENIED - WORKSPACE_ACCESS_DENIED - INSUFFICIENT_SCOPE - PLAN_REQUIRED - ACCOUNT_INACTIVE - ACCOUNT_SETUP_REQUIRED - LIMIT_EXCEEDED - DOCUMENT_NOT_READY - APPROVAL_REQUIRED - NOT_FOUND - ROUTE_NOT_FOUND - INVALID_STATE - BUNDLE_OWNS_SETTING - ALREADY_EXISTS - IDEMPOTENCY_KEY_IN_USE - RATE_LIMITED - INTERNAL_ERROR - UPSTREAM_UNAVAILABLE description: >- Machine-readable error code from a closed list. Branch on it, never on `message`. message: type: string description: >- What went wrong, in English, for developers. Its wording can change; don't parse it. userMessage: type: string description: >- Text that is safe to show to an end user, usually in Swedish requestId: type: string description: >- Identifier of the request, the same value as the `Sajn-Request-Id` header. Quote it when you contact support. resource: description: >- On a 404 `NOT_FOUND`, the type of the missing resource, such as `document` or `party`; `null` when the API can't tell type: - string - 'null' issues: description: Every validation issue, on a 400 `VALIDATION_FAILED` type: array items: type: object properties: path: type: string description: >- Dotted path to the invalid value, such as `parties.0.email`; empty when no single input caused the issue code: type: string enum: - INVALID_TYPE - INVALID_FORMAT - INVALID_VALUE - TOO_SMALL - TOO_BIG - UNRECOGNIZED_KEY message: type: string description: What is wrong with the value, in English required: - path - code - message additionalProperties: false requiredScopes: description: >- OAuth scopes the endpoint requires, on a 403 `INSUFFICIENT_SCOPE` type: array items: type: string grantedScopes: description: >- OAuth scopes the token was granted, on a 403 `INSUFFICIENT_SCOPE` type: array items: type: string readiness: description: >- What blocks sending the document, on a 409 `DOCUMENT_NOT_READY` type: array items: type: object properties: code: type: string description: >- What is wrong, such as `MISSING_EMAIL` or `NO_EXPIRATION`. New codes can be added. severity: type: string enum: - BLOCKER - WARNING description: '`BLOCKER` stops the send; `WARNING` doesn''t.' message: type: string description: What is wrong, in English userMessage: type: string description: >- The same, naming the party or field, in Swedish, for showing to a user required: - code - severity - message - userMessage additionalProperties: false required: - code - message - userMessage - requestId additionalProperties: {} description: Error response example: code: INSUFFICIENT_SCOPE message: 'Insufficient OAuth scope: requires documents:write' userMessage: Applikationen saknar behörighet (scope) för denna åtgärd. requestId: req_V1StGXR8Z5jdHi6BmyT2 requiredScopes: - documents:write grantedScopes: - profile:read headers: Sajn-Version: description: API version that served the request. schema: type: string Deprecation: description: >- Present only when the version is deprecated: when it was deprecated, as `@`. schema: type: string Sunset: description: >- Present only when the version is deprecated: the HTTP date from which requests on this version return 400 `API_VERSION_SUNSET`. schema: type: string Sajn-Request-Id: description: >- Identifier of the request. Error bodies repeat it as `requestId`; quote it when you contact support. schema: type: string X-RateLimit-Limit: description: Requests allowed per minute. schema: type: integer X-RateLimit-Remaining: description: Requests left in the current minute. schema: type: integer X-RateLimit-Reset: description: When the minute window resets, in Unix seconds. schema: type: integer Idempotent-Replayed: description: >- `true` when the response is a stored response replayed for a repeated `Idempotency-Key`. schema: type: string '404': description: Error response content: application/json: schema: type: object properties: code: type: string enum: - VALIDATION_FAILED - INVALID_JSON - EXPIRED - IDEMPOTENCY_KEY_REUSED - WORKSPACE_REQUIRED - INVALID_API_VERSION - API_VERSION_SUNSET - UNAUTHORIZED - API_KEY_EXPIRED - PERMISSION_DENIED - WORKSPACE_ACCESS_DENIED - INSUFFICIENT_SCOPE - PLAN_REQUIRED - ACCOUNT_INACTIVE - ACCOUNT_SETUP_REQUIRED - LIMIT_EXCEEDED - DOCUMENT_NOT_READY - APPROVAL_REQUIRED - NOT_FOUND - ROUTE_NOT_FOUND - INVALID_STATE - BUNDLE_OWNS_SETTING - ALREADY_EXISTS - IDEMPOTENCY_KEY_IN_USE - RATE_LIMITED - INTERNAL_ERROR - UPSTREAM_UNAVAILABLE description: >- Machine-readable error code from a closed list. Branch on it, never on `message`. message: type: string description: >- What went wrong, in English, for developers. Its wording can change; don't parse it. userMessage: type: string description: >- Text that is safe to show to an end user, usually in Swedish requestId: type: string description: >- Identifier of the request, the same value as the `Sajn-Request-Id` header. Quote it when you contact support. resource: description: >- On a 404 `NOT_FOUND`, the type of the missing resource, such as `document` or `party`; `null` when the API can't tell type: - string - 'null' issues: description: Every validation issue, on a 400 `VALIDATION_FAILED` type: array items: type: object properties: path: type: string description: >- Dotted path to the invalid value, such as `parties.0.email`; empty when no single input caused the issue code: type: string enum: - INVALID_TYPE - INVALID_FORMAT - INVALID_VALUE - TOO_SMALL - TOO_BIG - UNRECOGNIZED_KEY message: type: string description: What is wrong with the value, in English required: - path - code - message additionalProperties: false requiredScopes: description: >- OAuth scopes the endpoint requires, on a 403 `INSUFFICIENT_SCOPE` type: array items: type: string grantedScopes: description: >- OAuth scopes the token was granted, on a 403 `INSUFFICIENT_SCOPE` type: array items: type: string readiness: description: >- What blocks sending the document, on a 409 `DOCUMENT_NOT_READY` type: array items: type: object properties: code: type: string description: >- What is wrong, such as `MISSING_EMAIL` or `NO_EXPIRATION`. New codes can be added. severity: type: string enum: - BLOCKER - WARNING description: '`BLOCKER` stops the send; `WARNING` doesn''t.' message: type: string description: What is wrong, in English userMessage: type: string description: >- The same, naming the party or field, in Swedish, for showing to a user required: - code - severity - message - userMessage additionalProperties: false required: - code - message - userMessage - requestId additionalProperties: {} description: Error response example: code: NOT_FOUND message: Bundle not found userMessage: Resursen hittades inte. requestId: req_V1StGXR8Z5jdHi6BmyT2 resource: bundle headers: Sajn-Version: description: API version that served the request. schema: type: string Deprecation: description: >- Present only when the version is deprecated: when it was deprecated, as `@`. schema: type: string Sunset: description: >- Present only when the version is deprecated: the HTTP date from which requests on this version return 400 `API_VERSION_SUNSET`. schema: type: string Sajn-Request-Id: description: >- Identifier of the request. Error bodies repeat it as `requestId`; quote it when you contact support. schema: type: string X-RateLimit-Limit: description: Requests allowed per minute. schema: type: integer X-RateLimit-Remaining: description: Requests left in the current minute. schema: type: integer X-RateLimit-Reset: description: When the minute window resets, in Unix seconds. schema: type: integer Idempotent-Replayed: description: >- `true` when the response is a stored response replayed for a repeated `Idempotency-Key`. schema: type: string '409': description: Error response content: application/json: schema: type: object properties: code: type: string enum: - VALIDATION_FAILED - INVALID_JSON - EXPIRED - IDEMPOTENCY_KEY_REUSED - WORKSPACE_REQUIRED - INVALID_API_VERSION - API_VERSION_SUNSET - UNAUTHORIZED - API_KEY_EXPIRED - PERMISSION_DENIED - WORKSPACE_ACCESS_DENIED - INSUFFICIENT_SCOPE - PLAN_REQUIRED - ACCOUNT_INACTIVE - ACCOUNT_SETUP_REQUIRED - LIMIT_EXCEEDED - DOCUMENT_NOT_READY - APPROVAL_REQUIRED - NOT_FOUND - ROUTE_NOT_FOUND - INVALID_STATE - BUNDLE_OWNS_SETTING - ALREADY_EXISTS - IDEMPOTENCY_KEY_IN_USE - RATE_LIMITED - INTERNAL_ERROR - UPSTREAM_UNAVAILABLE description: >- Machine-readable error code from a closed list. Branch on it, never on `message`. message: type: string description: >- What went wrong, in English, for developers. Its wording can change; don't parse it. userMessage: type: string description: >- Text that is safe to show to an end user, usually in Swedish requestId: type: string description: >- Identifier of the request, the same value as the `Sajn-Request-Id` header. Quote it when you contact support. resource: description: >- On a 404 `NOT_FOUND`, the type of the missing resource, such as `document` or `party`; `null` when the API can't tell type: - string - 'null' issues: description: Every validation issue, on a 400 `VALIDATION_FAILED` type: array items: type: object properties: path: type: string description: >- Dotted path to the invalid value, such as `parties.0.email`; empty when no single input caused the issue code: type: string enum: - INVALID_TYPE - INVALID_FORMAT - INVALID_VALUE - TOO_SMALL - TOO_BIG - UNRECOGNIZED_KEY message: type: string description: What is wrong with the value, in English required: - path - code - message additionalProperties: false requiredScopes: description: >- OAuth scopes the endpoint requires, on a 403 `INSUFFICIENT_SCOPE` type: array items: type: string grantedScopes: description: >- OAuth scopes the token was granted, on a 403 `INSUFFICIENT_SCOPE` type: array items: type: string readiness: description: >- What blocks sending the document, on a 409 `DOCUMENT_NOT_READY` type: array items: type: object properties: code: type: string description: >- What is wrong, such as `MISSING_EMAIL` or `NO_EXPIRATION`. New codes can be added. severity: type: string enum: - BLOCKER - WARNING description: '`BLOCKER` stops the send; `WARNING` doesn''t.' message: type: string description: What is wrong, in English userMessage: type: string description: >- The same, naming the party or field, in Swedish, for showing to a user required: - code - severity - message - userMessage additionalProperties: false required: - code - message - userMessage - requestId additionalProperties: {} description: Error response example: code: INVALID_STATE message: >- The resource's current state doesn't allow the operation, such as editing a document that was already sent or downloading a file that isn't produced yet. userMessage: Åtgärden är inte möjlig i resursens nuvarande status. requestId: req_V1StGXR8Z5jdHi6BmyT2 headers: Sajn-Version: description: API version that served the request. schema: type: string Deprecation: description: >- Present only when the version is deprecated: when it was deprecated, as `@`. schema: type: string Sunset: description: >- Present only when the version is deprecated: the HTTP date from which requests on this version return 400 `API_VERSION_SUNSET`. schema: type: string Sajn-Request-Id: description: >- Identifier of the request. Error bodies repeat it as `requestId`; quote it when you contact support. schema: type: string X-RateLimit-Limit: description: Requests allowed per minute. schema: type: integer X-RateLimit-Remaining: description: Requests left in the current minute. schema: type: integer X-RateLimit-Reset: description: When the minute window resets, in Unix seconds. schema: type: integer Retry-After: description: Seconds to wait before you retry. schema: type: integer Idempotent-Replayed: description: >- `true` when the response is a stored response replayed for a repeated `Idempotency-Key`. schema: type: string '429': description: Error response content: application/json: schema: type: object properties: code: type: string enum: - VALIDATION_FAILED - INVALID_JSON - EXPIRED - IDEMPOTENCY_KEY_REUSED - WORKSPACE_REQUIRED - INVALID_API_VERSION - API_VERSION_SUNSET - UNAUTHORIZED - API_KEY_EXPIRED - PERMISSION_DENIED - WORKSPACE_ACCESS_DENIED - INSUFFICIENT_SCOPE - PLAN_REQUIRED - ACCOUNT_INACTIVE - ACCOUNT_SETUP_REQUIRED - LIMIT_EXCEEDED - DOCUMENT_NOT_READY - APPROVAL_REQUIRED - NOT_FOUND - ROUTE_NOT_FOUND - INVALID_STATE - BUNDLE_OWNS_SETTING - ALREADY_EXISTS - IDEMPOTENCY_KEY_IN_USE - RATE_LIMITED - INTERNAL_ERROR - UPSTREAM_UNAVAILABLE description: >- Machine-readable error code from a closed list. Branch on it, never on `message`. message: type: string description: >- What went wrong, in English, for developers. Its wording can change; don't parse it. userMessage: type: string description: >- Text that is safe to show to an end user, usually in Swedish requestId: type: string description: >- Identifier of the request, the same value as the `Sajn-Request-Id` header. Quote it when you contact support. resource: description: >- On a 404 `NOT_FOUND`, the type of the missing resource, such as `document` or `party`; `null` when the API can't tell type: - string - 'null' issues: description: Every validation issue, on a 400 `VALIDATION_FAILED` type: array items: type: object properties: path: type: string description: >- Dotted path to the invalid value, such as `parties.0.email`; empty when no single input caused the issue code: type: string enum: - INVALID_TYPE - INVALID_FORMAT - INVALID_VALUE - TOO_SMALL - TOO_BIG - UNRECOGNIZED_KEY message: type: string description: What is wrong with the value, in English required: - path - code - message additionalProperties: false requiredScopes: description: >- OAuth scopes the endpoint requires, on a 403 `INSUFFICIENT_SCOPE` type: array items: type: string grantedScopes: description: >- OAuth scopes the token was granted, on a 403 `INSUFFICIENT_SCOPE` type: array items: type: string readiness: description: >- What blocks sending the document, on a 409 `DOCUMENT_NOT_READY` type: array items: type: object properties: code: type: string description: >- What is wrong, such as `MISSING_EMAIL` or `NO_EXPIRATION`. New codes can be added. severity: type: string enum: - BLOCKER - WARNING description: '`BLOCKER` stops the send; `WARNING` doesn''t.' message: type: string description: What is wrong, in English userMessage: type: string description: >- The same, naming the party or field, in Swedish, for showing to a user required: - code - severity - message - userMessage additionalProperties: false required: - code - message - userMessage - requestId additionalProperties: {} description: Error response example: code: RATE_LIMITED message: API rate limit exceeded userMessage: För många förfrågningar. Försök igen om en stund. requestId: req_V1StGXR8Z5jdHi6BmyT2 headers: Sajn-Version: description: API version that served the request. schema: type: string Deprecation: description: >- Present only when the version is deprecated: when it was deprecated, as `@`. schema: type: string Sunset: description: >- Present only when the version is deprecated: the HTTP date from which requests on this version return 400 `API_VERSION_SUNSET`. schema: type: string Sajn-Request-Id: description: >- Identifier of the request. Error bodies repeat it as `requestId`; quote it when you contact support. schema: type: string X-RateLimit-Limit: description: Requests allowed per minute. schema: type: integer X-RateLimit-Remaining: description: Requests left in the current minute. schema: type: integer X-RateLimit-Reset: description: When the minute window resets, in Unix seconds. schema: type: integer Retry-After: description: Seconds to wait before you retry. schema: type: integer Idempotent-Replayed: description: >- `true` when the response is a stored response replayed for a repeated `Idempotency-Key`. schema: type: string '500': description: Error response content: application/json: schema: type: object properties: code: type: string enum: - VALIDATION_FAILED - INVALID_JSON - EXPIRED - IDEMPOTENCY_KEY_REUSED - WORKSPACE_REQUIRED - INVALID_API_VERSION - API_VERSION_SUNSET - UNAUTHORIZED - API_KEY_EXPIRED - PERMISSION_DENIED - WORKSPACE_ACCESS_DENIED - INSUFFICIENT_SCOPE - PLAN_REQUIRED - ACCOUNT_INACTIVE - ACCOUNT_SETUP_REQUIRED - LIMIT_EXCEEDED - DOCUMENT_NOT_READY - APPROVAL_REQUIRED - NOT_FOUND - ROUTE_NOT_FOUND - INVALID_STATE - BUNDLE_OWNS_SETTING - ALREADY_EXISTS - IDEMPOTENCY_KEY_IN_USE - RATE_LIMITED - INTERNAL_ERROR - UPSTREAM_UNAVAILABLE description: >- Machine-readable error code from a closed list. Branch on it, never on `message`. message: type: string description: >- What went wrong, in English, for developers. Its wording can change; don't parse it. userMessage: type: string description: >- Text that is safe to show to an end user, usually in Swedish requestId: type: string description: >- Identifier of the request, the same value as the `Sajn-Request-Id` header. Quote it when you contact support. resource: description: >- On a 404 `NOT_FOUND`, the type of the missing resource, such as `document` or `party`; `null` when the API can't tell type: - string - 'null' issues: description: Every validation issue, on a 400 `VALIDATION_FAILED` type: array items: type: object properties: path: type: string description: >- Dotted path to the invalid value, such as `parties.0.email`; empty when no single input caused the issue code: type: string enum: - INVALID_TYPE - INVALID_FORMAT - INVALID_VALUE - TOO_SMALL - TOO_BIG - UNRECOGNIZED_KEY message: type: string description: What is wrong with the value, in English required: - path - code - message additionalProperties: false requiredScopes: description: >- OAuth scopes the endpoint requires, on a 403 `INSUFFICIENT_SCOPE` type: array items: type: string grantedScopes: description: >- OAuth scopes the token was granted, on a 403 `INSUFFICIENT_SCOPE` type: array items: type: string readiness: description: >- What blocks sending the document, on a 409 `DOCUMENT_NOT_READY` type: array items: type: object properties: code: type: string description: >- What is wrong, such as `MISSING_EMAIL` or `NO_EXPIRATION`. New codes can be added. severity: type: string enum: - BLOCKER - WARNING description: '`BLOCKER` stops the send; `WARNING` doesn''t.' message: type: string description: What is wrong, in English userMessage: type: string description: >- The same, naming the party or field, in Swedish, for showing to a user required: - code - severity - message - userMessage additionalProperties: false required: - code - message - userMessage - requestId additionalProperties: {} description: Error response example: code: INTERNAL_ERROR message: Internal server error userMessage: Något gick fel. requestId: req_V1StGXR8Z5jdHi6BmyT2 headers: Sajn-Version: description: API version that served the request. schema: type: string Deprecation: description: >- Present only when the version is deprecated: when it was deprecated, as `@`. schema: type: string Sunset: description: >- Present only when the version is deprecated: the HTTP date from which requests on this version return 400 `API_VERSION_SUNSET`. schema: type: string Sajn-Request-Id: description: >- Identifier of the request. Error bodies repeat it as `requestId`; quote it when you contact support. schema: type: string X-RateLimit-Limit: description: Requests allowed per minute. schema: type: integer X-RateLimit-Remaining: description: Requests left in the current minute. schema: type: integer X-RateLimit-Reset: description: When the minute window resets, in Unix seconds. schema: type: integer '503': description: >- `UPSTREAM_UNAVAILABLE`: a service the operation depends on failed. Retry with exponential backoff. content: application/json: schema: type: object properties: code: type: string enum: - VALIDATION_FAILED - INVALID_JSON - EXPIRED - IDEMPOTENCY_KEY_REUSED - WORKSPACE_REQUIRED - INVALID_API_VERSION - API_VERSION_SUNSET - UNAUTHORIZED - API_KEY_EXPIRED - PERMISSION_DENIED - WORKSPACE_ACCESS_DENIED - INSUFFICIENT_SCOPE - PLAN_REQUIRED - ACCOUNT_INACTIVE - ACCOUNT_SETUP_REQUIRED - LIMIT_EXCEEDED - DOCUMENT_NOT_READY - APPROVAL_REQUIRED - NOT_FOUND - ROUTE_NOT_FOUND - INVALID_STATE - BUNDLE_OWNS_SETTING - ALREADY_EXISTS - IDEMPOTENCY_KEY_IN_USE - RATE_LIMITED - INTERNAL_ERROR - UPSTREAM_UNAVAILABLE description: >- Machine-readable error code from a closed list. Branch on it, never on `message`. message: type: string description: >- What went wrong, in English, for developers. Its wording can change; don't parse it. userMessage: type: string description: >- Text that is safe to show to an end user, usually in Swedish requestId: type: string description: >- Identifier of the request, the same value as the `Sajn-Request-Id` header. Quote it when you contact support. resource: description: >- On a 404 `NOT_FOUND`, the type of the missing resource, such as `document` or `party`; `null` when the API can't tell type: - string - 'null' issues: description: Every validation issue, on a 400 `VALIDATION_FAILED` type: array items: type: object properties: path: type: string description: >- Dotted path to the invalid value, such as `parties.0.email`; empty when no single input caused the issue code: type: string enum: - INVALID_TYPE - INVALID_FORMAT - INVALID_VALUE - TOO_SMALL - TOO_BIG - UNRECOGNIZED_KEY message: type: string description: What is wrong with the value, in English required: - path - code - message additionalProperties: false requiredScopes: description: >- OAuth scopes the endpoint requires, on a 403 `INSUFFICIENT_SCOPE` type: array items: type: string grantedScopes: description: >- OAuth scopes the token was granted, on a 403 `INSUFFICIENT_SCOPE` type: array items: type: string readiness: description: >- What blocks sending the document, on a 409 `DOCUMENT_NOT_READY` type: array items: type: object properties: code: type: string description: >- What is wrong, such as `MISSING_EMAIL` or `NO_EXPIRATION`. New codes can be added. severity: type: string enum: - BLOCKER - WARNING description: '`BLOCKER` stops the send; `WARNING` doesn''t.' message: type: string description: What is wrong, in English userMessage: type: string description: >- The same, naming the party or field, in Swedish, for showing to a user required: - code - severity - message - userMessage additionalProperties: false required: - code - message - userMessage - requestId additionalProperties: {} description: Error response example: code: UPSTREAM_UNAVAILABLE message: >- A service the operation depends on, such as an eID provider or a connected integration, failed or is unavailable. Retry with exponential backoff. userMessage: En extern tjänst svarar inte just nu. Försök igen om en stund. requestId: req_V1StGXR8Z5jdHi6BmyT2 headers: Sajn-Version: description: API version that served the request. schema: type: string Deprecation: description: >- Present only when the version is deprecated: when it was deprecated, as `@`. schema: type: string Sunset: description: >- Present only when the version is deprecated: the HTTP date from which requests on this version return 400 `API_VERSION_SUNSET`. schema: type: string Sajn-Request-Id: description: >- Identifier of the request. Error bodies repeat it as `requestId`; quote it when you contact support. schema: type: string X-RateLimit-Limit: description: Requests allowed per minute. schema: type: integer X-RateLimit-Remaining: description: Requests left in the current minute. schema: type: integer X-RateLimit-Reset: description: When the minute window resets, in Unix seconds. schema: type: integer security: - bearerAuth: [] - oauth2: - documents:write components: securitySchemes: bearerAuth: type: http scheme: bearer description: >- API key, e.g. `Authorization: Bearer sajn_svc_...`. Not scope-limited: acts with its owner's workspace role. oauth2: type: oauth2 description: >- OAuth 2.0 access token for a connected application. Limited to the scopes granted at consent. flows: authorizationCode: authorizationUrl: https://app.sajn.se/oauth/authorize tokenUrl: https://app.sajn.se/api/oauth/token refreshUrl: https://app.sajn.se/api/oauth/token scopes: profile:read: >- Read the user's profile, including name, phone number and email address. documents:read: Read documents. documents:write: Create documents and edit the documents the user created. documents:delete: >- Delete documents, files, folders, custom fields and comment threads. forms:read: Read forms and their settings. forms:write: Create, edit and publish forms. forms:delete: Permanently delete forms and their submissions. forms:submissions:read: Read form submissions and the respondents' contact details. templates:read: Read templates. templates:write: Create and edit templates. contacts:read: Read contacts. contacts:write: Create and edit contacts. contacts:delete: Delete contacts. organization:read: Read information about the organization. audit:read: Read document activity and event logs. signatures:read: >- Read the identity the eID verified at signing, including the national identity number. sajnid:read: Read sajn ID verifications. sajnid:write: Create sajn ID verifications. login:read: Read the result of sajn Login sessions. login:write: Start sajn Login sessions. webhooks:read: Read webhooks and their deliveries. webhooks:write: Create, edit and delete webhooks. actions:read: Read suggested actions and what each one does. actions:write: >- Approve, dismiss and snooze suggested actions. An approval can send reminders to counterparties, terminate agreements and create follow-ups. members:read: Read the workspace's members. members:write: Invite and manage workspace members. roles:read: Read the workspace's roles and permissions. roles:write: Create, edit and delete workspace roles. sajn:read: >- MCP only. Read everything the user's role can read in the workspace. sajn:write: >- MCP only. Includes sajn:read, and create, change and send within the user's role. sajn:admin: >- MCP only. Includes sajn:write, and manage members, roles and settings within the user's role. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.