Provision and manage private labels from your own systems

The private labels you administer, with how many people each seats. slug is the reseller you act for — the :slug in the reseller endpoints. A key sees its own reseller's labels only.

Response 200on success

{
  status: "OK"
  data: {
    totalDomains: number
    totalUsers: number
    domains: { domain: string, companyName: string, userCount: number }[]
    isReseller: boolean
    slug: string | null
  }
}

Errors

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The reseller your key was minted for has been deleted

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Finds people on the hosts you administer by email or name, up to 50. domain narrows the search to one host, and an empty query then lists everyone on it. A signed-in admin also searches the reseller's own staff; a key searches its private labels only.

Parameters

• querystringOptional

  Search (empty for everyone)

• domainstring (a host you administer)Optional

  Only this host

Response 200on success

{
  status: "OK"
  data: {
    users: { id: string, firstName: string, lastName: string, email: string, status: string, domain: string }[]
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "INVALID_REQUEST", "message": "…" } }

  A body that does not decode — a missing or mistyped field

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The reseller your key was minted for has been deleted

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Seats someone on a host you administer, creating their account if needed; they are emailed a link to set a password.

Parameters

• emailstringRequired

  Email

• firstNamestringRequired

  First name

• lastNamestringRequired

  Last name

• domainstring (a host you administer)Required

  Domain

Response 200on success

{
  status: "OK"
  data: {
    message: string
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  A domain you do not administer. A key administers its reseller's private labels only, not the reseller's own host

• 400
  { "status": "Err", "error": { "code": "DOMAIN_NOT_FOUND", "message": "…" } }

  No live tenant has that host

• 400
  { "status": "Err", "error": { "code": "ALREADY_IN_DOMAIN", "message": "…" } }

  They already hold a seat there

• 400
  { "status": "Err", "error": { "code": "SEAT_QUOTA_REACHED", "message": "…" } }

  The host has used every seat its package grants

• 400
  { "status": "Err", "error": { "code": "INVALID_EMAIL", "message": "…" } }

  Not one plain email address — refused before any account exists

• 400
  { "status": "Err", "error": { "code": "INVALID_NAME", "message": "…" } }

  A blank first or last name

• 400
  { "status": "Err", "error": { "code": "INVALID_REQUEST", "message": "…" } }

  A body that does not decode — a missing or mistyped field

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The reseller your key was minted for has been deleted

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Takes someone's seat on a host away and signs them out at once. Their account is kept, so adding them again seats it again, without any admin rights they held. Owners and admins cannot be removed, whether with an API key or signed in.

Parameters

• emailstringRequired

  Email

• domainstring (a host you administer)Required

  Domain

Response 200on success

{
  status: "OK"
  data: {
    message: string
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  A domain you do not administer. A key administers its reseller's private labels only, not the reseller's own host

• 400
  { "status": "Err", "error": { "code": "USER_NOT_FOUND", "message": "…" } }

  Nobody with that email is on that host

• 400
  { "status": "Err", "error": { "code": "CANNOT_REMOVE_OWNER", "message": "…" } }

  That is the owner or another of the admins here

• 400
  { "status": "Err", "error": { "code": "INVALID_REQUEST", "message": "…" } }

  A body that does not decode — a missing or mistyped field

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The reseller your key was minted for has been deleted

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Changes a host's colours. Send only the ones to change; one left blank keeps its current colour. Colours are hex, #rgb or #rrggbb.

Parameters

• domainstring (a host you administer)Required

  Domain

• colorPrimarystring (hex)Optional

  Primary

• colorPrimaryForegroundstring (hex)Optional

  Text on primary

• colorAccentstring (hex)Optional

  Accent

• colorAccentForegroundstring (hex)Optional

  Text on accent

• colorAppBarBackgroundstring (hex)Optional

  App bar

• colorFooterBackgroundstring (hex)Optional

  Footer

Response 200on success

{
  status: "OK"
  data: {
    domain: string
    message: string
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "DOMAIN_EMPTY", "message": "…" } }

  Blank domain

• 400
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  A domain you do not administer. A key administers its reseller's private labels only, not the reseller's own host

• 400
  { "status": "Err", "error": { "code": "NOT_FOUND", "message": "…" } }

  The host has no branding to change

• 400
  { "status": "Err", "error": { "code": "INVALID_COLOR", "message": "…" } }

  A colour that is not hex, #rgb or #rrggbb

• 400
  { "status": "Err", "error": { "code": "INVALID_REQUEST", "message": "…" } }

  A body that does not decode — a missing or mistyped field

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The reseller your key was minted for has been deleted

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Replaces a host's logo, its banner logo, or both. The body is multipart: the host goes in a data part as JSON, beside the image parts. Images are resized (the logo to fit 270×90, the banner to 500×500) and stored as PNG. Both are read before either is saved, so an image that cannot be read leaves the current logos as they are.

Send it as multipart/form-data to https://api.sign8.net rather than the usual API host: uploads to the usual host are blocked at its edge.

Parameters

• data.domainstring (a host you administer)Required

  Domain

• logo (file part)PNG, JPEG, GIF or SVG, up to 1 MBOptional

  Logo

• bannerLogo (file part)PNG, JPEG, GIF or SVG, up to 1 MBOptional

  Banner logo

Response 200on success

{
  status: "OK"
  data: {
    message: string
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "NO_FILES", "message": "…" } }

  Neither a logo nor a banner logo was attached

• 400
  { "status": "Err", "error": { "code": "DOMAIN_EMPTY", "message": "…" } }

  Blank domain

• 400
  { "status": "Err", "error": { "code": "INVALID_DATA", "message": "…" } }

  The data part is missing or is not JSON with a domain

• 400
  { "status": "Err", "error": { "code": "DOMAIN_INVALID", "message": "…" } }

  A domain that is not a host name

• 400
  { "status": "Err", "error": { "code": "INVALID_IMAGE", "message": "…" } }

  An image that cannot be read, or one larger than 4096 × 4096 pixels

• 400
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  A domain you do not administer. A key administers its reseller's private labels only, not the reseller's own host

• 400
  { "status": "Err", "error": { "code": "LIMIT_FILE_SIZE", "message": "…" } }

  An image over 1 MB

• 400
  { "status": "Err", "error": { "code": "LIMIT_UNEXPECTED_FILE", "message": "…" } }

  An image that is not PNG, JPEG, GIF or SVG, or a part it does not take

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The reseller your key was minted for has been deleted

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Every private label you provisioned, with its owner, package, template allowance, suspension and this period's counts. period is a month or lifetime, and defaults to this month.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• ?period"YYYY-MM" | "lifetime"Optional

  Period

Response 200on success

{
  status: "OK"
  data: {
    privateLabels: {
      tenantId: string
      primaryHost: string
      customDomain: string | null
      adminEmail: string | null
      assignedPackage: { packageId: string, code: string, name: string } | null
      templateQuota: { used: number, total: number, unlimited: boolean }
      metrics: { templates: number, documentsSent: number, members: number }
      status: "Active" | "Suspended"
      suspendedAt: number | null
      suspendedBy: "Platform" | "Reseller" | null
      suspendReason: string | null
    }[]
    provisionedCount: number
    period: string
  }
}

Errors

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Creates a private label under you, seats its owner (who is emailed a link to set a password) and attaches its host. It can also give the label one of your packages in the same call — with a key, that needs reseller:packages as well. The label is created first, so a refused assignment still leaves a working label, and package says what happened. Colours must be hex and links full http(s):// URLs, and a label cannot take one of sign.net's own hosts; all of that is checked before anything is created.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• owner.emailstringRequired

  Owner email

• owner.firstNamestringRequired

  Owner first name

• owner.lastNamestringRequired

  Owner last name

• config.domainstring (hostname)Required

  Domain

• config.appNamestringRequired

  App name

• config.supportUrlstring (URL)Optional

  Support URL

• config.websiteUrlstring (URL)Optional

  Website URL

• config.colorPrimarystring (hex)Optional

  Primary color

• config.colorAccentstring (hex)Optional

  Accent color

• package.packageIdstringOptional

  Package to assign

• package.confirmationKeystringOptional

  Package confirmation key (only to go over your allowance)

Response 200on success

{
  status: "OK"
  data: {
    tenantId: string
    ownerUserId: string
    domainSetup: { attached: boolean, verified: boolean, records: { type: string, name: string, value: string }[], note?: string }
    package?:
      | { outcome: "Assigned", assignmentId: string, allocated: { documents: number, seats: number, templates: number, notarizations: number } }
      | { outcome: "ConfirmationRequired", confirmation: { key: string, expiresAt: number }, warnings: { itemCode: "documents" | "seats" | "templates" | "notarizations", requested: number, remaining: number, excess: number }[] }
      | { outcome: "Failed", error: string }
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "HOST_TAKEN", "message": "…" } }

  That config.domain is already in use

• 400
  { "status": "Err", "error": { "code": "DOMAIN_INVALID", "message": "…" } }

  A config.domain that is not a hostname — not an email address or URL

• 400
  { "status": "Err", "error": { "code": "HOST_RESERVED", "message": "…" } }

  One of sign.net's own hosts, such as its app, console, admin, API or static host

• 400
  { "status": "Err", "error": { "code": "INVALID_COLOR", "message": "…" } }

  A colour that is not hex, #rgb or #rrggbb

• 400
  { "status": "Err", "error": { "code": "INVALID_URL", "message": "…" } }

  A websiteUrl, supportUrl or social link that is not a full http:// or https:// URL

• 400
  { "status": "Err", "error": { "code": "TOO_MANY_SOCIAL_LINKS", "message": "…" } }

  More than 20 social links

• 400
  { "status": "Err", "error": { "code": "OWNER_INVALID_EMAIL", "message": "…" } }

  The owner's email is not an email address

• 400
  { "status": "Err", "error": { "code": "OWNER_INVALID_NAME", "message": "…" } }

  The owner's first or last name is blank

• 400
  { "status": "Err", "error": { "code": "INVALID_REQUEST", "message": "…" } }

  Malformed body, a blank appName, or a value longer than its field

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  A key sending a package without reseller:packages — refused before anything is created

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

One private label as a billing system shows it: whether it is suspended, who owns it, how many seats it holds, its package, and whether its host is served and its DNS is right (read live).

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• :tenantIdstring (32-char hex)Required

  Private label tenant id

Response 200on success

{
  status: "OK"
  data: {
    tenantId: string
    primaryHost: string
    customDomain: string | null
    createdAt: number
    status: "Active" | "Suspended"
    suspendedAt: number | null
    suspendedBy: "Platform" | "Reseller" | null
    suspendReason: string | null
    owner: { userId: string, email: string, firstName: string, lastName: string } | null
    memberCount: number
    assignment: {
      id: string
      packageId: string
      packageCode: string
      packageName: string
      currency: string
      assignedAt: number
      addons: { subscriptionAddonId: string, addonId: string, code: string, name: string, quantity: number }[]
      allocated: { documents: number, seats: number, templates: number, notarizations: number }
    } | null
    domainSetup: { attached: boolean, verified: boolean, records: { type: string, name: string, value: string }[], note?: string }
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "INVALID_TARGET", "message": "…" } }

  The tenant id is not a live private label

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Attaches a private label's host to the portal again. Provisioning attaches it without failing the provision, so a label can exist with a host that resolves nowhere (attached: false); this is the retry, and an attached host answers as attached.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• :tenantIdstring (32-char hex)Required

  Private label tenant id

Response 200on success

{
  status: "OK"
  data: {
    domainSetup: { attached: boolean, verified: boolean, records: { type: string, name: string, value: string }[], note?: string }
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "INVALID_TARGET", "message": "…" } }

  The tenant id is not a live private label

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Deletes a private label. It then leaves your subtree, so deleting it again answers 403.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• :tenantIdstring (32-char hex)Required

  Private label tenant id

Response 200on success

{
  status: "OK"
  data: {
    status: "deprovisioned"
  }
}

Errors

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Signs every user of the label out and refuses sign-in until it is unsuspended. Its data and package are kept, and it is still billed. Suspending one already suspended keeps that suspension — suspendedBy is "Platform" when sign.net made it.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• :tenantIdstring (32-char hex)Required

  Private label tenant id

• reasonstring (up to 500 characters)Optional

  Reason (only you and sign.net see it)

Response 200on success

{
  status: "OK"
  data: {
    tenantId: string
    status: "Suspended"
    suspendedAt: number
    suspendedBy: "Reseller" | "Platform"
    suspendReason: string | null
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "INVALID_TARGET", "message": "…" } }

  The tenant id is not a live private label

• 400
  { "status": "Err", "error": { "code": "INVALID_REQUEST", "message": "…" } }

  A reason over 500 characters

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Lifts your suspension of a private label. Unsuspending one that is not suspended changes nothing and still succeeds.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• :tenantIdstring (32-char hex)Required

  Private label tenant id

Response 200on success

{
  status: "OK"
  data: {
    tenantId: string
    status: "Active"
    suspendedAt: null
    suspendedBy: null
    suspendReason: null
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "SUSPENDED_BY_PLATFORM", "message": "…" } }

  sign.net suspended it, and only sign.net can lift that

• 400
  { "status": "Err", "error": { "code": "INVALID_TARGET", "message": "…" } }

  The tenant id is not a live private label

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

The templates a private label's members made in its portal — a summary; you view them, you do not author them.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• :tenantIdstring (32-char hex)Required

  Private label tenant id

Response 200on success

{
  status: "OK"
  data: {
    templates: { id: string, title: string, slug: string, isPrivate: boolean, createdAt: number }[]
  }
}

Errors

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Adds someone to a private label, creating their account if needed and emailing them a link to set a password. created is false when an account with that email was already on the label.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• :tenantIdstring (32-char hex)Required

  Private label tenant id

• emailstringRequired

  Email

• firstNamestringRequired

  First name

• lastNamestringRequired

  Last name

Response 200on success

{
  status: "OK"
  data: {
    status: "created" | "added"
    userID: string
    created: boolean
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "INVALID_TARGET", "message": "…" } }

  The tenant id is not a live private label

• 400
  { "status": "Err", "error": { "code": "SEAT_QUOTA_REACHED", "message": "…" } }

  The label has used every seat its package grants

• 400
  { "status": "Err", "error": { "code": "INVALID_EMAIL", "message": "…" } }

  Not one plain email address — refused before any account exists

• 400
  { "status": "Err", "error": { "code": "INVALID_NAME", "message": "…" } }

  A blank first or last name

• 400
  { "status": "Err", "error": { "code": "INVALID_REQUEST", "message": "…" } }

  A body that does not decode — a missing or mistyped field

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Everyone holding a seat on a private label, owner first. role tells the owner from the label's other admins and its members; isOwner is true for every admin, as it always has been. People who were only sent a document take no seat and are left out.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• :tenantIdstring (32-char hex)Required

  Private label tenant id

Response 200on success

{
  status: "OK"
  data: {
    members: {
      id: string
      firstName: string
      lastName: string
      email: string
      status: string
      role: "owner" | "admin" | "member"
      isOwner: boolean
      createdAt: number
    }[]
  }
}

Errors

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Takes someone off a private label: their seat is revoked, they are signed out at once, and sign-in refuses them. Removing someone already removed answers the same, so a retry is safe. The owner and the label's other admins cannot be removed this way.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• :tenantIdstring (32-char hex)Required

  Private label tenant id

• :userIdstring (32-char hex)Required

  User id

Response 200on success

{
  status: "OK"
  data: {
    status: "removed"
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "CANNOT_REMOVE_OWNER", "message": "…" } }

  That user is the label's owner or another of its admins

• 400
  { "status": "Err", "error": { "code": "USER_NOT_FOUND", "message": "…" } }

  No one on this private label has that id

• 400
  { "status": "Err", "error": { "code": "INVALID_TARGET", "message": "…" } }

  The tenant id is not a live private label

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Emails someone on a private label a fresh link to set their password, in the label's branding. The one provisioning sent lasts a day, so a customer whose DNS was not live by then needs another. At most one every 5 minutes per person.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• :tenantIdstring (32-char hex)Required

  Private label tenant id

• :userIdstring (32-char hex)Required

  User id

Response 200on success

{
  status: "OK"
  data: {
    status: "sent"
  }
}

Errors

• 429
  { "status": "Err", "error": { "code": "TOO_FREQUENT", "message": "…" } }

  They were sent one in the last 5 minutes — wait for the Retry-After header

• 400
  { "status": "Err", "error": { "code": "USER_NOT_FOUND", "message": "…" } }

  No one on this private label has that id

• 400
  { "status": "Err", "error": { "code": "INVALID_TARGET", "message": "…" } }

  The tenant id is not a live private label

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Your API keys, newest first — metadata only, never the secret.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

Response 200on success

{
  status: "OK"
  data: {
    keys: { id: string, lastFour: string, scopes: string[], createdAt: number, lastUsedAt: number | null, revokedAt: number | null }[]
  }
}

Errors

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

The packages you sell to your private labels, a page at a time. sign.net neither sees nor charges these prices.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• querystringOptional

  Search (empty for all)

• pagenumber (from 1)Required

  Page

• pageSizenumber (1 to 100)Required

  Page size

Response 200on success

{
  status: "OK"
  data: {
    packages: {
      id: string
      code: string
      name: string
      currency: string
      billingCycle: "Monthly" | "Quarterly" | "Biannual" | "Annual" | "OneTime"
      basePriceMinor: number
      isActive: boolean
      createdAt: number
      updatedAt: number
    }[]
    total: number
    page: number
    pageSize: number
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "INVALID_REQUEST", "message": "…" } }

  A body that does not decode — a missing or mistyped field

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

One package with its items and description. assignedCount is how many live private labels hold it, which is what a price change would reach.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• idstring (32-char hex)Required

  Package id

Response 200on success

{
  status: "OK"
  data: {
    billingPackage: { id, code, name, description: string | null, currency, billingCycle, basePriceMinor, isActive, createdAt, updatedAt }
    items: { itemCode: "documents" | "seats" | "templates" | "notarizations", includedQty: number, overageBundleSize: number, overageBundlePriceMinor: number }[]
    assignedCount: number
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "PACKAGE_NOT_FOUND", "message": "…" } }

  No package of yours has that id — another reseller's reads the same as a missing one

• 400
  { "status": "Err", "error": { "code": "INVALID_REQUEST", "message": "…" } }

  A body that does not decode — a missing or mistyped field

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Adds a package to your catalogue. basePriceMinor is your price to your customer, in minor units; what the package costs you is the quantities it commits, which come off your sign.net allowance when it is assigned.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• codestringRequired

  Code

• namestringRequired

  Name

• descriptionstring | nullRequired

  Description

• currencystringRequired

  Currency

• billingCycle"Monthly" | "Quarterly" | "Biannual" | "Annual" | "OneTime"Required

  Billing cycle

• basePriceMinornumberRequired

  Your package price (minor units)

• items{ itemCode: "documents" | "seats" | "templates" | "notarizations", includedQty: number, overageBundleSize: number, overageBundlePriceMinor: number }[]Required

  Items

Response 200on success

{
  status: "OK"
  data: {
    id: string
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "EMPTY_CODE", "message": "…" } }

  Blank code

• 400
  { "status": "Err", "error": { "code": "EMPTY_NAME", "message": "…" } }

  Blank name

• 400
  { "status": "Err", "error": { "code": "DUPLICATE_ITEM", "message": "…" } }

  The same itemCode twice

• 400
  { "status": "Err", "error": { "code": "INVALID_REQUEST", "message": "…" } }

  Malformed body, an unknown itemCode, a quantity outside 0–10,000,000, or more than four items

• 400
  { "status": "Err", "error": { "code": "CODE_IN_USE", "message": "…" } }

  You already have one with that code — codes are unique to you, not globally

• 400
  { "status": "Err", "error": { "code": "CATALOGUE_FULL", "message": "…" } }

  You already hold 100 — deactivating one frees its code, not its slot

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Changes a package; only what you send changes. Code, currency and billing cycle are fixed once created. A new price reaches its holders from their next period.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• idstring (32-char hex)Required

  Package id

• namestringOptional

  Name

• descriptionstring | nullOptional

  Description

• isActivebooleanOptional

  Active

• basePriceMinornumberOptional

  Your package price (minor units)

• items{ itemCode: "documents" | "seats" | "templates" | "notarizations", includedQty: number, overageBundleSize: number, overageBundlePriceMinor: number }[]Optional

  Items

Response 200on success

{
  status: "OK"
  data: {
    message: "Success"
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "PACKAGE_NOT_FOUND", "message": "…" } }

  No package of yours has that id — another reseller's reads the same as a missing one

• 400
  { "status": "Err", "error": { "code": "EMPTY_NAME", "message": "…" } }

  Blank name

• 400
  { "status": "Err", "error": { "code": "DUPLICATE_ITEM", "message": "…" } }

  The same itemCode twice

• 400
  { "status": "Err", "error": { "code": "INVALID_REQUEST", "message": "…" } }

  Malformed body, an unknown itemCode, a quantity outside 0–10,000,000, or more than four items

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

The add-ons you sell on top of your packages, a page at a time.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• querystringOptional

  Search (empty for all)

• pagenumber (from 1)Required

  Page

• pageSizenumber (1 to 100)Required

  Page size

Response 200on success

{
  status: "OK"
  data: {
    addons: {
      id: string
      code: string
      name: string
      currency: string
      priceMinor: number
      billingCycle: "Monthly" | "Quarterly" | "Biannual" | "Annual" | "OneTime"
      isActive: boolean
      createdAt: number
      updatedAt: number
    }[]
    total: number
    page: number
    pageSize: number
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "INVALID_REQUEST", "message": "…" } }

  A body that does not decode — a missing or mistyped field

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

One add-on with what it grants. areGrantsLocked turns true the first time it is attached anywhere; its price can still change after that, its grants cannot.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• idstring (32-char hex)Required

  Add-on id

Response 200on success

{
  status: "OK"
  data: {
    addon: { id, code, name, description: string | null, currency, priceMinor, billingCycle, isActive, createdAt, updatedAt }
    items: { itemCode: "documents" | "seats" | "templates" | "notarizations", grantedQty: number }[]
    areGrantsLocked: boolean
    activeAttachments: number
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "ADDON_NOT_FOUND", "message": "…" } }

  No add-on of yours has that id — another reseller's reads the same as a missing one

• 400
  { "status": "Err", "error": { "code": "INVALID_REQUEST", "message": "…" } }

  A body that does not decode — a missing or mistyped field

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Adds an add-on to your catalogue. It must grant at least one item.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• codestringRequired

  Code

• namestringRequired

  Name

• descriptionstring | nullRequired

  Description

• currencystringRequired

  Currency

• billingCycle"Monthly" | "Quarterly" | "Biannual" | "Annual" | "OneTime"Required

  Billing cycle

• priceMinornumberRequired

  Your add-on price (minor units)

• items{ itemCode: "documents" | "seats" | "templates" | "notarizations", grantedQty: number }[]Required

  Grants

Response 200on success

{
  status: "OK"
  data: {
    id: string
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "NO_GRANTS", "message": "…" } }

  An empty items list — an add-on must grant something

• 400
  { "status": "Err", "error": { "code": "EMPTY_CODE", "message": "…" } }

  Blank code

• 400
  { "status": "Err", "error": { "code": "EMPTY_NAME", "message": "…" } }

  Blank name

• 400
  { "status": "Err", "error": { "code": "DUPLICATE_ITEM", "message": "…" } }

  The same itemCode twice

• 400
  { "status": "Err", "error": { "code": "INVALID_REQUEST", "message": "…" } }

  Malformed body, an unknown itemCode, a quantity outside 0–10,000,000, or more than four items

• 400
  { "status": "Err", "error": { "code": "CODE_IN_USE", "message": "…" } }

  You already have one with that code — codes are unique to you, not globally

• 400
  { "status": "Err", "error": { "code": "CATALOGUE_FULL", "message": "…" } }

  You already hold 100 — deactivating one frees its code, not its slot

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Changes an add-on; only what you send changes. What it grants can change only until it has been attached somewhere; its price can always change.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• idstring (32-char hex)Required

  Add-on id

• namestringOptional

  Name

• descriptionstring | nullOptional

  Description

• isActivebooleanOptional

  Active

• priceMinornumberOptional

  Your add-on price (minor units)

• items{ itemCode: "documents" | "seats" | "templates" | "notarizations", grantedQty: number }[]Optional

  Grants

Response 200on success

{
  status: "OK"
  data: {
    message: "Success"
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "ADDON_NOT_FOUND", "message": "…" } }

  No add-on of yours has that id — another reseller's reads the same as a missing one

• 400
  { "status": "Err", "error": { "code": "ADDON_IN_USE", "message": "…" } }

  items sent for an add-on that has ever been attached — create a new one instead

• 400
  { "status": "Err", "error": { "code": "NO_GRANTS", "message": "…" } }

  An empty items list

• 400
  { "status": "Err", "error": { "code": "EMPTY_NAME", "message": "…" } }

  Blank name

• 400
  { "status": "Err", "error": { "code": "DUPLICATE_ITEM", "message": "…" } }

  The same itemCode twice

• 400
  { "status": "Err", "error": { "code": "INVALID_REQUEST", "message": "…" } }

  Malformed body, an unknown itemCode, a quantity outside 0–10,000,000, or more than four items

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

The package and add-ons a private label holds, and how much of your allowance they take. assignment is null when it has none.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• :tenantIdstring (32-char hex)Required

  Private label tenant id

Response 200on success

{
  status: "OK"
  data: {
    assignment: {
      id: string
      packageId: string
      packageCode: string
      packageName: string
      currency: string
      assignedAt: number
      addons: { subscriptionAddonId: string, addonId: string, code: string, name: string, quantity: number }[]
      allocated: { documents: number, seats: number, templates: number, notarizations: number }
    } | null
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "INVALID_TARGET", "message": "…" } }

  The tenant id is not a live private label

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Gives a private label one of your packages. This spends your sign.net allowance immediately, whether or not the label uses it, and caps the label at what it was given. Going past your allowance takes a second call with the confirmation key.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• :tenantIdstring (32-char hex)Required

  Private label tenant id

• packageIdstringRequired

  Package

• confirmationKeystringOptional

  Confirmation key (only to go over your allowance)

Response 200on success

{
  status: "OK"
  data: {
    outcome: "Assigned"
    assignmentId: string
    allocated: { documents: number, seats: number, templates: number, notarizations: number }
  }
}

Errors

• 200
  { "status": "OK", "data": { "outcome": "ConfirmationRequired", "confirmation": { "key": "…", "expiresAt": 1758800000000 }, "warnings": [{ "itemCode": "seats", "requested": 10, "remaining": 3, "excess": 7 }] } }

  It would take you past your allowance. NOTHING was written — send the identical body again with confirmationKey to go ahead

• 400
  { "status": "Err", "error": { "code": "ALREADY_ASSIGNED", "message": "…" } }

  That label already has a package — remove it first, or attach an add-on

• 400
  { "status": "Err", "error": { "code": "PACKAGE_NOT_FOUND", "message": "…" } }

  No package of yours has that id — another reseller's reads the same as a missing one

• 400
  { "status": "Err", "error": { "code": "PACKAGE_INACTIVE", "message": "…" } }

  That package is deactivated

• 400
  { "status": "Err", "error": { "code": "NO_SUBSCRIPTION", "message": "…" } }

  sign.net has not put you on a plan, so there is no allowance to assign from

• 400
  { "status": "Err", "error": { "code": "INVALID_TARGET", "message": "…" } }

  The tenant id is not a live private label

• 400
  { "status": "Err", "error": { "code": "CONFIRMATION_INVALID", "message": "…" } }

  The confirmationKey was issued for a different request

• 400
  { "status": "Err", "error": { "code": "CONFIRMATION_EXPIRED", "message": "…" } }

  The confirmationKey is over 10 minutes old — send again without it for a new one

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Takes a private label's package back and frees the allowance for future promises. The period it was held in is still billed for it.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• :tenantIdstring (32-char hex)Required

  Private label tenant id

Response 200on success

{
  status: "OK"
  data: {
    outcome: "Unassigned"
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "NOT_ASSIGNED", "message": "…" } }

  That private label has no package of yours — none at all, or one another reseller assigned before it moved to you

• 400
  { "status": "Err", "error": { "code": "INVALID_TARGET", "message": "…" } }

  The tenant id is not a live private label

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Tops a private label up without changing its package. Spends granted quantity × quantity of your allowance, the same way assigning does.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• :tenantIdstring (32-char hex)Required

  Private label tenant id

• addonIdstringRequired

  Add-on

• quantitynumber (at least 1)Required

  Quantity

• confirmationKeystringOptional

  Confirmation key (only to go over your allowance)

Response 200on success

{
  status: "OK"
  data: {
    outcome: "Attached"
    subscriptionAddonId: string
  }
}

Errors

• 200
  { "status": "OK", "data": { "outcome": "ConfirmationRequired", "confirmation": { "key": "…", "expiresAt": 1758800000000 }, "warnings": [{ "itemCode": "seats", "requested": 10, "remaining": 3, "excess": 7 }] } }

  It would take you past your allowance. NOTHING was written — send the identical body again with confirmationKey to go ahead

• 400
  { "status": "Err", "error": { "code": "ALREADY_ATTACHED", "message": "…" } }

  That add-on is already on this label — remove it and attach it again to change the quantity

• 400
  { "status": "Err", "error": { "code": "NOT_ASSIGNED", "message": "…" } }

  That label has no package of yours — assign one before adding to it

• 400
  { "status": "Err", "error": { "code": "ADDON_NOT_FOUND", "message": "…" } }

  No add-on of yours has that id — another reseller's reads the same as a missing one

• 400
  { "status": "Err", "error": { "code": "ADDON_INACTIVE", "message": "…" } }

  That add-on is deactivated

• 400
  { "status": "Err", "error": { "code": "INVALID_QUANTITY", "message": "…" } }

  Quantity below 1 (a zero is a mistake, not a no-op), or one granting more than 10,000,000 of an item

• 400
  { "status": "Err", "error": { "code": "NO_SUBSCRIPTION", "message": "…" } }

  sign.net has not put you on a plan, so there is no allowance to assign from

• 400
  { "status": "Err", "error": { "code": "INVALID_TARGET", "message": "…" } }

  The tenant id is not a live private label

• 400
  { "status": "Err", "error": { "code": "CONFIRMATION_INVALID", "message": "…" } }

  The confirmationKey was issued for a different request

• 400
  { "status": "Err", "error": { "code": "CONFIRMATION_EXPIRED", "message": "…" } }

  The confirmationKey is over 10 minutes old — send again without it for a new one

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Takes an add-on back off a private label, releasing what it allocated.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• :tenantIdstring (32-char hex)Required

  Private label tenant id

• :subscriptionAddonIdstring (32-char hex)Required

  Attached add-on id

Response 200on success

{
  status: "OK"
  data: {
    outcome: "Removed"
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "NOT_ASSIGNED", "message": "…" } }

  That private label has no package of yours — none at all, or one another reseller assigned before it moved to you

• 400
  { "status": "Err", "error": { "code": "ADDON_NOT_FOUND", "message": "…" } }

  Nothing attached to this label has that subscriptionAddonId

• 400
  { "status": "Err", "error": { "code": "INVALID_TARGET", "message": "…" } }

  The tenant id is not a live private label

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

What your private labels used in a month — documents, notarisations, points, seats and templates — in total and per label. Leave the period out for the current month.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• ?periodstring (YYYY-MM)Optional

  Period

Response 200on success

{
  status: "OK"
  data: {
    period: string
    total: { documents: number, notarizations: number, points: number, seats: number, templates: number }
    privateLabels: {
      tenantId: string
      primaryHost: string
      metrics: { documents: number, notarizations: number, points: number, seats: number, templates: number }
    }[]
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "INVALID_PERIOD", "message": "…" } }

  A period that is not YYYY-MM

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Your plan with sign.net, what you have promised out to your labels, and what they actually used — counts, never sign.net's prices. remaining is what is left once what is allocated to your labels, what your own team used (ownUsed) and what labels used beyond their packages (labelsBeyondAllocation) are taken off: assigning spends a label's share straight away, so its usage inside the package takes nothing more. subscription is null when sign.net has not put you on a plan.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

Response 200on success

{
  status: "OK"
  data: {
    subscription: { packageName: string, billingCycle: string } | null
    window: { from: number, to: number } | null
    items: {
      itemCode: "documents" | "seats" | "templates" | "notarizations"
      includedQty: number
      allocatedNow: number
      used: number
      ownUsed: number
      labelsBeyondAllocation: number
      remaining: number
      overAllocatedBy: number
    }[]
    byPrivateLabel: {
      tenantId: string
      primaryHost: string
      allocatedInPeriod: { documents: number, seats: number, templates: number, notarizations: number }
      actual: { documents: number, seats: number, templates: number, notarizations: number }
      billed: { documents: number, seats: number, templates: number, notarizations: number }
    }[]
  }
}

Errors

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Your points pool and each private label's. Units are the truth; points are units × sign.net's rate card. A label with hasPool: false has no package and spends from drawsFrom — you. Counts and points only, never prices.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

Response 200on success

{
  status: "OK"
  data: {
    reseller: {
      tenantId: string
      primaryHost: string
      hasPool: boolean
      drawsFrom: string | null
      buckets: { itemCode: "documents" | "seats" | "templates" | "notarizations", units: number, pointsPerUnit: number, points: number, activity: { Grant, Transfer, Return, Consume, Release, Overage, Revoke, Adjust, Expire, Opening: number }, carried: number | null, nextLapse: { units: number, at: number } | null }[]
    }
    cycle: { start: number, end: number | null } | null
    rates: { documents: number, seats: number, templates: number, notarizations: number }
    privateLabels: {
      tenantId: string
      primaryHost: string
      hasPool: boolean
      drawsFrom: string | null
      buckets: { itemCode: "documents" | "seats" | "templates" | "notarizations", units: number, pointsPerUnit: number, points: number, activity: { Grant, Transfer, Return, Consume, Release, Overage, Revoke, Adjust, Expire, Opening: number }, carried: number | null, nextLapse: { units: number, at: number } | null }[]
    }[]
  }
}

Errors

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Every movement on your own buckets, newest first, a page at a time. itemCode narrows it to one item.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• ?itemCode"documents" | "seats" | "templates" | "notarizations"Optional

  Item

• ?pagenumber (from 1)Optional

  Page

• ?pageSizenumber (1 to 100)Optional

  Page size

Response 200on success

{
  status: "OK"
  data: {
    rows: {
      id: string
      tenantId: string
      itemCode: "documents" | "seats" | "templates" | "notarizations"
      kind: "Grant" | "Transfer" | "Return" | "Consume" | "Release" | "Overage" | "Revoke" | "Adjust" | "Expire" | "Opening"
      units: number
      pointsPerUnit: number
      counterpartTenantId: string | null
      sourceType: string
      sourceId: string | null
      cycleStart: number | null
      expiresAt: number | null
      bundleSize: number | null
      isCapped: boolean | null
      note: string | null
      createdAt: number
    }[]
    total: number
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "INVALID_QUERY", "message": "…" } }

  page below 1, pageSize outside 1–100, or an unknown itemCode

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

One private label's buckets, or — for a label with no package — the pool it spends from.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• :tenantIdstring (32-char hex)Required

  Private label tenant id

Response 200on success

{
  status: "OK"
  data: {
    pool: {
      tenantId: string
      primaryHost: string
      hasPool: boolean
      drawsFrom: string | null
      buckets: { itemCode: "documents" | "seats" | "templates" | "notarizations", units: number, pointsPerUnit: number, points: number, activity: { Grant, Transfer, Return, Consume, Release, Overage, Revoke, Adjust, Expire, Opening: number }, carried: number | null, nextLapse: { units: number, at: number } | null }[]
    }
    cycle: { start: number, end: number | null } | null
    rates: { documents: number, seats: number, templates: number, notarizations: number }
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "INVALID_TARGET", "message": "…" } }

  The tenant id is not a live private label

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header

Every movement on one private label's buckets, newest first, a page at a time.

Parameters

• :slugstring (your primaryHost)Required

  Your reseller's domain

• :tenantIdstring (32-char hex)Required

  Private label tenant id

• ?itemCode"documents" | "seats" | "templates" | "notarizations"Optional

  Item

• ?pagenumber (from 1)Optional

  Page

• ?pageSizenumber (1 to 100)Optional

  Page size

Response 200on success

{
  status: "OK"
  data: {
    rows: {
      id: string
      tenantId: string
      itemCode: "documents" | "seats" | "templates" | "notarizations"
      kind: "Grant" | "Transfer" | "Return" | "Consume" | "Release" | "Overage" | "Revoke" | "Adjust" | "Expire" | "Opening"
      units: number
      pointsPerUnit: number
      counterpartTenantId: string | null
      sourceType: string
      sourceId: string | null
      cycleStart: number | null
      expiresAt: number | null
      bundleSize: number | null
      isCapped: boolean | null
      note: string | null
      createdAt: number
    }[]
    total: number
  }
}

Errors

• 400
  { "status": "Err", "error": { "code": "INVALID_QUERY", "message": "…" } }

  page below 1, pageSize outside 1–100, or an unknown itemCode

• 400
  { "status": "Err", "error": { "code": "INVALID_TARGET", "message": "…" } }

  The tenant id is not a live private label

• 401
  { "status": "Err", "error": { "code": "UNAUTHORIZED", "message": "…" } }

  Missing, expired or revoked access token — exchange your API key again

• 403
  { "status": "Err", "error": { "code": "INSUFFICIENT_SCOPE", "message": "…" } }

  Your key does not hold the scope above

• 403
  { "status": "Err", "error": { "code": "FORBIDDEN", "message": "…" } }

  The slug is not your key's reseller, or the target is outside your subtree

• 429
  { "error": "Too many requests, please try again later." }

  More than 60 calls a minute from your address — wait for the Retry-After header