API Reference
The District Seal REST API lets you create signature transactions, receive webhook notifications when events occur, and query certificate verification status — from any language that can make HTTPS requests.
Base URL
https://districtseal.com/apiContent type
All request and response bodies are application/json. File upload endpoints use multipart/form-data. This is documented per endpoint.
Authentication
The API supports two authentication methods:
- API key — send as the
X-API-Keyheader. Keys are created from your dashboard under Developer → API keys. Each key has a prefix (the first 12 characters, shown in the dashboard) and a full secret (shown exactly once at creation). - Session JWT — send as
Authorization: Bearer <token>. This is the same token issued at dashboard login and used by the browser client.
See Authentication for full details and examples.
Rate limits
| Endpoint class | Limit |
|---|---|
Authentication routes (/api/auth/*) | 5–30 requests per minute per IP, depending on the route |
| Transaction creation | No hard limit; plan signature quota applies |
| Read endpoints | No hard limit at current scale |
| Webhook receipt | 120 requests per minute per IP |
Rate-limited responses return HTTP 429 with a Retry-After header.
Errors
Errors return a JSON object with a detail field:
{
"detail": "Human-readable description of the error"
}| Status | Meaning |
|---|---|
| 400 | Request malformed or missing required field |
| 401 | Missing or invalid authentication |
| 402 | Plan limit reached — upgrade to continue |
| 403 | Authenticated but not authorized for this resource |
| 404 | Resource not found |
| 409 | State conflict (e.g. consent already recorded) |
| 429 | Rate limited |
| 500 | Server error — retry; contact support if persistent |
Endpoints by category
Authentication
POST /api/auth/register | Create a new signup intent |
POST /api/auth/login | Sign in and receive a JWT |
POST /api/auth/me | Get the current user profile |
POST /api/auth/check-email | Check whether an email already has an account |
POST /api/auth/onboarding | Complete onboarding after verification |
POST /api/auth/verify-email | Verify the email OTP |
POST /api/auth/change-password | Change password (requires current password) |
POST /api/auth/2fa/setup | enable | disable | Manage TOTP two-factor authentication |
Transactions
GET /api/transactions | List your transactions |
POST /api/transactions | Create a new signature request (multipart) |
GET /api/transactions/{id} | Get one transaction with full event log |
POST /api/transactions/{id}/resend | Re-send the signing link to the signer |
POST /api/transactions/{id}/cancel | Cancel a pending transaction |
GET /api/transactions/export.csv | Export your transactions as CSV |
Signing ceremony (public, token-based)
GET /api/sign/{token}/summary | Get the signing session state |
POST /api/sign/{token}/consent | Record signer consent |
GET /api/sign/{token}/challenge | Issue the random words and liveness sequence |
POST /api/sign/{token}/capture | Submit the signing video and final frame |
POST /api/sign/{token}/webauthn/options | Get WebAuthn challenge options |
POST /api/sign/{token}/webauthn/verify | Verify the WebAuthn assertion |
POST /api/sign/{token}/forensic | Log client-side forensic events (camera enumeration, sensor variance) |
Verification (public)
GET /api/verify/{label}/{hash} | Verify a certificate by its reference and document hash prefix |
Webhooks (inbound)
POST /api/webhooks/dodo | Receive Dodo Payments events (subscription state changes) |
SDKs
District Seal does not currently provide official client SDKs. The API is standard REST and works from any HTTP client. If you build an integration you would like listed here, contact support@districtseal.com.
District Seal is a product of NEXSIM LLC, Montana, United States.
API support: support@districtseal.com