Requests, retries and limits
Request ids
Section titled “Request ids”Every response carries Sign-Request-Id. Send your own (8 to 128 characters of letters, digits, ., _, -) and it is echoed back, so your logs and ours share one id.
Safe retries
Section titled “Safe retries”Send an Idempotency-Key header (1 to 255 characters) on POST /api-keys, POST /api-keys/{id}/rotate, POST /files and POST /envelopes. The first response is stored for 24 hours, keyed by your account, your API key, the method and the path:
| You send | You get |
|---|---|
| The same key and the same body again | The stored response, with Idempotent-Replayed: true |
| The same key with a different body | 422 idempotency_key_reused |
| The same key while the first request is still running | 409 idempotency_in_flight; retry shortly (a request that dies frees its lock after 60 seconds) |
A 5xx response is never stored, so retrying it with the same key is always safe. Replays of key creation and rotation leave out secret, because the secret is never stored.
Paging
Section titled “Paging”List endpoints take limit (1 to 100, default 50) and after (the id of the last item you saw), and answer newest first:
{"data": ["…"], "has_more": true, "next_after": "01a1669f-4ed7-7b35-a0ac-d9f34f5d3ae4"}Pass next_after as after to get the next page.
Rate limits
Section titled “Rate limits”Per API key, over a sliding minute: 600 requests live, 60 in test mode. A live key making test-mode requests spends its live budget. Every authenticated response carries RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset (seconds); over the limit you get 429 rate_limited with Retry-After.
The request log
Section titled “The request log”GET /v1/requests lists every call your account made in the last 90 days, newest first: method, path, status, duration, key, mode, IP address, user agent, error code and idempotency key. Never bodies, secrets or signer data. Filter with ?mode=test or ?mode=live. A real entry:
{"id": "01a1669f-5174-7efe-bf2e-ae9e5f8629cb", "request_id": "01a1669f-50ae-7af1-86eb-541a026d93ff", "api_key_id": "01a1669e-93f1-7b20-8358-bce84a66f3c3", "mode": "test", "method": "POST", "path": "/v1/envelopes", "status": 422, "duration_ms": 411, "ip": "127.0.0.1", "user_agent": "curl/8.21.0", "error_code": "validation_failed", "idempotency_key": null, "created_at": "2026-10-23T02:37:59+00:00"}It needs the requests:read scope.