{ "data": { "a": { "slug": "boldsign", "name": "BoldSign", "vendor": "Syncfusion, Inc.", "vendorUrl": "https://boldsign.com", "kind": "http-api", "category": "e-signatures", "summary": "BoldSign is Syncfusion's electronic signature service. Its REST API sends documents for signature from files or templates, embeds signing and requesting in other products, manages templates, users and teams, and reports events by webhook, with a hosted MCP server.", "url": "https://www.anchorterminal.com/tools/boldsign", "markdownUrl": "https://www.anchorterminal.com/tools/boldsign.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/boldsign.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/boldsign.json", "dns": "boldsign.grade.anchorterminal.com", "repo": "https://github.com/boldsign/boldsign-node-sdk", "license": "Proprietary hosted service under the BoldSign Terms of Use. The five official SDKs and the deprecated local MCP package on GitHub are MIT", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.boldsign.com/v1", "packages": [ { "registry": "npm", "name": "boldsign" }, { "registry": "pypi", "name": "boldsign" }, { "registry": "nuget", "name": "BoldSign.Api" } ], "auth": "mixed", "authNotes": "An API key in the X-API-KEY header, generated in the web app under API, API Key, with all scopes and an optional expiry date, at most four keys per account and two per environment (Live or Sandbox). Or OAuth 2.0 at account.boldsign.com with authorisation code and PKCE, client credentials and refresh tokens, and 20 scopes such as BoldSign.Documents.Create and BoldSign.Templates.Read. The hosted MCP server takes the same key as X-API-Key or OAuth sign-in from Claude Web and ChatGPT. Keys are self-serve; live API access needs the Enterprise API plan.", "pricing": "freemium", "pricingNotes": "The free sandbox gives full API access with no card. Documents are watermarked and deleted after 14 days. Live API access is the Enterprise API plan from $30 a month with 40 envelopes and $0.75 per additional envelope, with a 30-day trial and no card. Add-ons are priced per unit (bulk send $0.25 an envelope, SMS $0.20, ID verification $2, KBA $1.50 an attempt, QES $3 a signing attempt). Live MCP use needs the Enterprise API plan at the normal envelope charge (https://boldsign.com/electronic-signature-pricing/, checked 2026-11-03).", "priceSummary": "$30 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the Swagger file, the pricing page or the MCP docs (checked 2026-11-03). Plans are paid by card through Stripe in the web app.", "endpoints": [] }, "toolCount": 14, "popularity": { "githubStars": 1, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://developers.boldsign.com/", "llmsTxt": "https://developers.boldsign.com/llms.txt", "openapi": "https://api.boldsign.com/swagger/v1/swagger.json", "capabilities": [ "esign.send", "esign.templates", "esign.embed", "esign.status" ], "tags": [ "official", "hosted", "closed-source", "api-key", "oauth", "openapi", "llms-txt", "mcp", "remote-mcp", "webhooks", "sandbox", "free-tier", "freemium", "eu-region", "status-page", "security-txt", "soc2", "python", "typescript", "dotnet", "java", "php" ], "lastRelease": "2026-10-16", "graded": true, "anchor": { "graded": true, "score": 70.3, "grade": "BB", "agentReady": true, "rank": 190, "ranked": true, "rankOf": 1349, "categoryRank": 2, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 62, "maintenance": 78, "payments": 40, "reliability": 84, "schema": 85, "security": 63, "transparency": 77 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": 0, "verdict": "A public OpenAPI file, llms.txt, 20 OAuth scopes, published rate limits, a free sandbox and a clean 90-day status history. API keys carry every scope, there are no idempotency keys, the 2,000-an-hour account limit is low for bulk work, and the hosted MCP server's 14 tools include sending and revoking with no confirmation step of their own.", "bestFor": "A product team embedding signing, requesting and templates at a per-envelope price with regional hosting in the US, EU, Canada or Australia, and an agent that sends from templates and tracks status through the hosted MCP server.", "strengths": [ "OpenAPI 3.0.4 file with 87 operations, llms.txt and a Markdown twin of every docs page", "OAuth 2.0 with authorisation code and PKCE, client credentials, single-use refresh tokens and 20 scopes split by resource and action", "Rate limits published per account, 2,000 requests an hour live and 50 in the sandbox, with usage headers", "Free sandbox with full API access and no card, and live API from $30 a month with $0.75 per extra envelope", "No incident on status.boldsign.com between 5 August and 3 November 2026, with components per region", "Dated API changelog since April 2021 with breaking changes labelled, and five official SDKs updated in August to October 2026" ], "weaknesses": [ "API keys carry every scope and the docs say that is not customisable; only OAuth apps get narrower scopes, and there is no Documents.Read scope", "No idempotency keys, and no Retry-After documented for the 429", "64 of the 87 operation descriptions in the Swagger file are under 40 characters, and the file carries no examples", "The hosted MCP server's tool schemas are not published, it sends, reminds and revokes with no built-in confirmation, and it is not in the official MCP registry", "No SLA document was found. security.txt advertises a 99.999 per cent uptime SLA and the terms disclaim uninterrupted service" ], "agentNotes": [ "Send `X-API-KEY: $BOLDSIGN_API_KEY` to the regional base URL (api.boldsign.com, api-eu, api-ca or api-au); a key from one region fails on another, and the MCP endpoint must match too", "Build against a Sandbox key first. Sandbox documents are watermarked and deleted after 14 days, and the sandbox allows only 50 requests an hour", "Stay under 2,000 requests an hour per account in production and use webhooks instead of polling `document/properties`; on a 429 wait for the window to reset", "Don't retry a timed-out `document/send` blindly. There is no idempotency key, so list documents by title or search before sending again", "Verify `X-BoldSign-Signature` (HMAC-SHA256 with the endpoint secret) on every webhook before acting on its payload", "On the MCP server, start with `list_templates` and `get_document_properties`, and confirm with the person before `send_document_from_template`, `send_reminder_for_document_sign` or `revoke_document`" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 70.3 } ], "editorialScores": { "ergonomics": 62, "maintenance": 78, "payments": 40, "reliability": 84, "schema": 85, "security": 63, "transparency": 59 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install boldsign", "http": "curl -H \"X-API-KEY: $BOLDSIGN_API_KEY\" \"https://api.boldsign.com/v1/document/list?Page=1\u0026PageSize=10\"", "claudeCode": "claude mcp add boldsign --transport http https://mcp.boldsign.com/mcp --header \"X-API-Key: $BOLDSIGN_API_KEY\"", "config": { "mcpServers": { "boldsign": { "headers": { "X-API-Key": "${BOLDSIGN_API_KEY}" }, "type": "http", "url": "https://mcp.boldsign.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/esign.send", "tool": "https://letme.dev/boldsign" }, "area": "business", "unitPrices": [ { "item": "Enterprise API plan", "unit": "month", "usd": 30, "note": "starting price with 40 envelopes and two application users" }, { "item": "Additional envelope, Enterprise API", "unit": "tx", "usd": 0.75, "note": "one envelope can hold several files, signers and CCs" }, { "item": "Bulk send or bulk link envelope", "unit": "tx", "usd": 0.25 }, { "item": "SMS envelope", "unit": "message", "usd": 0.2, "note": "WhatsApp $0.10 a message" }, { "item": "ID verification", "unit": "tx", "usd": 2, "note": "KBA $1.50 an attempt, QES $3 a signing attempt" } ], "provenance": { "legalEntity": "Syncfusion, Inc.", "domain": "boldsign.com", "domainRegistered": "2013-12-20", "endpointOnVendorDomain": true, "terms": "https://boldsign.com/terms-of-use/", "privacy": "https://boldsign.com/privacy-policy/", "statusPage": "https://status.boldsign.com/", "changelog": "https://developers.boldsign.com/api-overview/changelog", "securityTxt": "valid", "checked": "2026-11-03", "notes": [ "The Terms of Use (effective February 2025) name Syncfusion, Inc., a Delaware corporation in Morrisville, North Carolina, under North Carolina law with AAA arbitration in Raleigh. The privacy policy (effective July 2026) is Syncfusion-wide and covers BoldSign, BoldDesk, Bold BI and Bold Reports.", "The terms forbid robots, spiders, scrapers or other automated means to access or monitor BoldSign other than the Syncfusion-provided API, and forbid using the product to train or improve machine learning or AI algorithms. Recorded as a fact.", "boldsign.com/robots.txt disallows /responsible-disclosure/ and cdn-cgi paths with a crawl delay of 1 second and Content-Signal ai-train=yes, search=yes, ai-input=yes, so the responsible disclosure page was not read. developers.boldsign.com/robots.txt disallows /moreresults and /search. status.boldsign.com disallows /api/ and /embed/.", "boldsign.com/.well-known/security.txt is valid until 18 August 2027 with security@boldsign.com and a policy link to boldsign.com/security-policy/. Its comments claim SOC 2 Type 2, GDPR and a 99.999 per cent uptime SLA.", "The API answers on api.boldsign.com and regional subdomains, OAuth on account.boldsign.com and MCP on mcp.boldsign.com, all vendor subdomains.", "RDAP gives boldsign.com a registration date of 20 December 2013." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/boldsign.json", "live": { "slug": "boldsign", "probe": { "target": "https://api.boldsign.com/v1", "method": "get", "lastAt": "2026-11-04T20:46:36.22824902Z", "lastOk": false, "lastStatus": 500, "lastMs": 204, "lastNote": "server error", "authRequired": false, "uptime24h": 0, "uptime30d": 0, "p50ms24h": 0, "p95ms24h": 0, "samples24h": 55, "samples30d": 55, "days": [ { "date": "2026-11-04", "probes": 55, "ok": 0 } ], "outages": [ { "start": "2026-11-04T15:25:13.380401793Z", "end": "0001-01-01T00:00:00Z", "note": "HTTP 500 server error" } ] }, "vendorStatus": { "page": "https://status.boldsign.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-04T20:38:43.453813971Z" }, "versions": [ { "registry": "npm", "name": "boldsign", "version": "3.3.4", "seenAt": "2026-11-04T20:03:22.635714892Z" }, { "registry": "pypi", "name": "boldsign", "version": "3.3.4", "released": "2026-10-16", "seenAt": "2026-11-04T20:03:23.457188444Z" } ], "githubStars": 1, "npmWeekly": 36472, "pypiWeekly": 14652, "securityTxt": { "url": "https://boldsign.com/.well-known/security.txt", "state": "valid", "expires": "2027-08-18T00:00:00Z", "checkedAt": "2026-11-04T15:54:30.755542398Z" }, "updatedAt": "2026-11-04T20:46:36.22824902Z" } }, "answer": "BoldSign scores 70.3 (BB) on agent readiness against Dropbox Sign's 64 (B), and leads in 3 of 7 scored categories. Dropbox Sign leads on agent ergonomics and maintenance \u0026 community.", "b": { "slug": "dropbox-sign", "name": "Dropbox Sign", "vendor": "Dropbox, Inc.", "vendorUrl": "https://sign.dropbox.com", "kind": "http-api", "category": "e-signatures", "summary": "Dropbox Sign (formerly HelloSign) is Dropbox's e-signature service. Its REST API sends documents or templates for signature, embeds signing in an iframe, reports status by webhook and returns signed PDFs with an audit trail.", "url": "https://www.anchorterminal.com/tools/dropbox-sign", "markdownUrl": "https://www.anchorterminal.com/tools/dropbox-sign.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/dropbox-sign.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/dropbox-sign.json", "dns": "dropbox-sign.grade.anchorterminal.com", "repo": "https://github.com/hellosign/hellosign-openapi", "license": "Proprietary service under the Dropbox Sign terms of service. The OpenAPI spec repository is Apache 2.0 and the official SDKs are MIT", "transports": [ "http" ], "remoteUrl": "https://api.hellosign.com/v3", "packages": [ { "registry": "npm", "name": "@dropbox/sign" }, { "registry": "pypi", "name": "dropbox-sign" } ], "auth": "mixed", "authNotes": "A self-serve API key from the account's API settings page, sent as the HTTP Basic username with an empty password. Each account can hold up to four keys for rotation, and every key has full access to the account. OAuth 2.0 access tokens (Bearer) act on behalf of other users with seven scopes across two billing models, and OAuth apps need approval by Dropbox Sign support before production. Embedded apps can be self-published in the web app.", "pricing": "paid", "pricingNotes": "Production signature requests need a paid API plan, and the API answers 402 without one. Essentials is $900 a year ($75 a month) from 50 requests a month, Standard $3,000 a year ($250 a month) from 100, and Premium is quoted by sales. Test mode is free on every endpoint from a free account, so an agent can build and test without a contract (checked 2026-10-07).", "priceSummary": "Paid", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs, the OpenAPI spec or the pricing page (checked 2026-10-07).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 22, "npmWeekly": 149738, "pypiWeekly": null, "asOf": "2026-10-07" }, "docsUrl": "https://developers.hellosign.com", "llmsTxt": "https://developers.hellosign.com/llms.txt", "openapi": "https://raw.githubusercontent.com/hellosign/hellosign-openapi/main/openapi.yaml", "capabilities": [ "esign.send", "esign.templates", "esign.embed", "esign.status" ], "tags": [ "hosted", "closed-source", "api-key", "oauth", "openapi", "llms-txt", "webhooks", "sandbox", "python", "typescript", "java", "php", "ruby", "dotnet", "status-page", "bug-bounty", "soc2" ], "lastRelease": "2026-10-21", "graded": true, "anchor": { "graded": true, "score": 64, "grade": "B", "agentReady": false, "rank": 440, "ranked": true, "rankOf": 1349, "categoryRank": 5, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 85, "payments": 25, "reliability": 65, "schema": 88, "security": 65, "transparency": 69 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -3, "negativeNotes": [ "2026-10-06: the changelog entry of that day says requests that use `grouped_signers` now reject duplicate email addresses, and integrations that reused an address must now give unique ones. A behaviour change for existing clients announced the day it took effect, with no earlier notice found (-3). https://developers.hellosign.com/changelog" ], "verdict": "A public OpenAPI 3.0.3 spec, llms.txt, six official SDKs and a free test mode let an agent build the flow before paying. Production sends need a paid plan from $900 a year, the API key has full account access, no idempotency keys were found, and unannounced maintenance took every component offline for almost two hours on 21 October 2026.", "bestFor": "An agent that sends a prepared PDF or a saved template for signature from one company account and tracks it to completion by webhook or polling, with the signed PDF and audit trail at the end.", "strengths": [ "Public OpenAPI 3.0.3 spec with 74 operations, plus llms.txt and a Markdown copy of every docs page", "Free test mode works on every endpoint from a free account, with watermarked, non-binding requests that don't count against quota", "Error catalogue of 20 HTTP error names with cause, remediation and a retryable flag, also embedded in the spec as `x-error-codes`", "Rate limits published with numbers (100 a minute standard, 25 on higher-tier endpoints, 10 in test mode) and returned in response headers", "Official SDKs in six languages under semantic versioning, Node at 1.15.0 and Python at 2.0.0 (October 2026), with upgrade notes for the Python major" ], "weaknesses": [ "No idempotency keys found in the docs or the spec, so a retried send can create a second signature request", "An API key grants full access to the account, with no scoped or read-only keys. Scopes exist only on OAuth tokens", "OAuth apps need manual approval by Dropbox Sign support before production use", "The terms supply the service as is, and no SLA was found. Emergency maintenance took every component offline for 1 hour 54 minutes on 21 October 2026", "Embedded signing and bulk send need the Standard plan ($3,000 a year), and embedded templates need Premium, priced by quote", "On 6 October 2026 `grouped_signers` began rejecting duplicate email addresses, announced in the changelog the same day" ], "agentNotes": [ "Send `test_mode=true` while building. Test requests are free, watermarked and not legally binding, and are limited to 10 requests a minute", "Don't blind-retry a send after a timeout. No idempotency key exists, so list requests by `metadata` or title first to check whether it was created", "Authenticate with HTTP Basic, the API key as username and an empty password. Keep the key out of URLs, although the docs show that form", "Answer every webhook with HTTP 200 and the body `Hello API Event Received`, and verify `event_hash`. Ten consecutive failures clear the callback URL", "Treat a 200 from cancel as queued only. Confirmation arrives later as a `signature_request_canceled` event", "Give every signer in a `grouped_signers` group a unique email address. Duplicates are rejected since 6 October 2026" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 64 } ], "editorialScores": { "ergonomics": 72, "maintenance": 85, "payments": 25, "reliability": 65, "schema": 88, "security": 65, "transparency": 51 }, "provenanceScore": 87, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @dropbox/sign", "http": "curl \"https://api.hellosign.com/v3/template/list\" \\\n -u \"${API_KEY}:\"" }, "letme": { "capability": "https://letme.dev/esign.send", "tool": "https://letme.dev/dropbox-sign" }, "area": "business", "provenance": { "legalEntity": "Dropbox, Inc.", "domain": "hellosign.com", "domainRegistered": "2004-03-05", "endpointOnVendorDomain": true, "terms": "https://sign.dropbox.com/about/terms", "privacy": "https://sign.dropbox.com/about/privacy", "statusPage": "https://status.hellosign.com", "changelog": "https://developers.hellosign.com/changelog", "securityTxt": "none", "checked": "2026-10-07", "notes": [ "The Dropbox Sign terms (effective 7 January 2025) put the agreement with Dropbox, Inc. for customers in the United States, Canada and Mexico and with Dropbox International Unlimited Company elsewhere.", "The API host is api.hellosign.com and the docs are at developers.hellosign.com. The marketing site is sign.dropbox.com. RDAP gives 2004-03-05 for hellosign.com and 1995-06-28 for dropbox.com.", "sign.dropbox.com/.well-known/security.txt and api.hellosign.com/.well-known/security.txt return 404. www.dropbox.com/.well-known/security.txt serves a plain-text file that names the Intigriti bug bounty and disclosure programmes without the standard Contact and Expires fields.", "The privacy policy is dated 14 January 2025. The data processing agreement at assets.dropbox.com is dated 25 October 2021.", "The sub-processor list at www.dropbox.com/privacy/subprocessor/sign returned only its title to our reader." ], "score": 87 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/dropbox-sign.json", "live": { "slug": "dropbox-sign", "probe": { "target": "https://api.hellosign.com/v3", "method": "get", "lastAt": "2026-11-04T20:46:42.282158045Z", "lastOk": true, "lastStatus": 404, "lastMs": 162, "authRequired": false, "uptime24h": 100, "uptime30d": 99.68, "p50ms24h": 167, "p95ms24h": 431, "samples24h": 246, "samples30d": 6818, "days": [ { "date": "2026-10-08", "probes": 93, "ok": 93 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 231 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 248, "ok": 248 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 214, "ok": 214 } ], "outages": [ { "start": "2026-10-21T14:13:20.051563326Z", "end": "2026-10-21T16:18:08.85020695Z", "note": "HTTP 503 server error" } ] }, "vendorStatus": { "page": "https://status.hellosign.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-04T20:39:06.750723487Z" }, "versions": [ { "registry": "npm", "name": "@dropbox/sign", "version": "1.15.0", "seenAt": "2026-11-04T20:13:18.575953107Z" }, { "registry": "pypi", "name": "dropbox-sign", "version": "2.0.0", "released": "2026-10-21", "seenAt": "2026-11-04T20:13:19.498792708Z" } ], "githubStars": 22, "npmWeekly": 179113, "pypiWeekly": 75759, "securityTxt": { "url": "https://hellosign.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:53:54.685831292Z" }, "llmsTxt": { "url": "https://developers.hellosign.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-04T15:22:48.876654626Z" }, "domain": { "domain": "hellosign.com", "registered": "2004-03-05", "source": "https://rdap.verisign.com/com/v1/domain/hellosign.com", "checkedAt": "2026-11-01T14:17:04.453817107Z" }, "pages": [ { "url": "https://developers.hellosign.com/changelog", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-04T08:19:01.408801078Z", "changedAt": "2026-10-28T04:13:04.651557593Z", "fingerprint": "30bc6392be5c" }, { "url": "https://sign.dropbox.com/about/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-04T08:32:47.205435595Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "30f2bccc1007" }, { "url": "https://sign.dropbox.com/about/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-04T08:32:49.40303438Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "daf78169f086" } ], "github": { "repo": "hellosign/hellosign-openapi", "checkedAt": "2026-11-02T08:54:23.848894262Z", "stars": 22, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-27T11:01:26Z", "openIssues": 5, "openPRs": 7, "issuesOpened90d": 0, "issuesClosed90d": 0, "prsMerged90d": 28, "ci": { "branch": "main", "runs": 49, "success": 47, "failure": 2, "other": 0, "latest": "success", "latestAt": "2026-10-27T11:03:36Z" }, "replies": { "sampled": 25, "unanswered": 4, "medianDays": 36.9 } }, "updatedAt": "2026-11-04T20:46:42.282158045Z" } }, "edges": [ { "by": 19, "category": "reliability", "leads": "boldsign", "name": "Reliability", "reasons": { "a": "Read with the hosted lines and scored on the REST API v1, the surface the SDKs and the hosted MCP server call. status.boldsign.com on Atlassian Statuspage has Web App and API components for Global, Europe, Canada and Australia plus Docs, with 90-day uptime and an incident history (20). The history feed, read on 3 November 2026, lists four one-hour scheduled maintenances between 19 and 27 September and no incident after a 20-minute partial disruption on 21 July 2026, so the 90 days from 5 August are clean (30). Rate limits are published per account, 2,000 requests an hour live and 50 an hour in the sandbox (15). The rate-limit page says 429 is returned with messages and usage is tracked in response headers, and the guide recommends webhooks over polling. No Retry-After is documented and there are no idempotency keys (6 of 15). No SLA document was found. security.txt advertises a 99.999 per cent uptime SLA, the terms disclaim uninterrupted service and refer to a support SLA available on request (3 of 10). v1 is the stable version with beta endpoints under v1-beta (10). 20 + 30 + 15 + 6 + 3 + 10 = 84.", "b": "Read with the hosted lines and scored on the public REST API at api.hellosign.com, the surface an agent would call. status.hellosign.com on Statuspage lists 9 components in four groups (Core, Web, API, Integrations) with incident history (20). The history feed, read on 1 November 2026, has in the 90 days an unannounced emergency maintenance on 21 October 2026 that took the service offline \"due to vulnerabilities in PHP\" from 07:19 to 09:13 PDT (1 h 54 min), affecting every component including Send signature requests and API callbacks, read as one major. File upload problems on 31 August (54 min) were partial. The 21 August Salesforce integration fault doesn't touch the API and isn't counted, and the 22 September and 13 October windows were announced maintenance (10 of 30). Rate limits with numbers, 100 requests a minute standard, 25 on 17 higher-tier endpoints and 10 in test mode, although the header table describes the limit as hourly (15). The docs describe 429 with `X-Ratelimit` headers, tell clients to respect Retry-After and back off, and the error catalogue marks each error retryable or not. No idempotency keys or safe-retry guidance for sends were found (10 of 15). The terms supply the service as is and as available, and no SLA was found (0). The API is at v3 and generally available (10). The 7 October reading came from the Statuspage /api/v2/ path, which status.hellosign.com's robots.txt disallows. It is struck and replaced by history.atom." }, "scores": { "a": 84, "b": 65 } }, { "by": 15, "category": "payments", "leads": "boldsign", "name": "Payments \u0026 pricing", "reasons": { "a": "Read with the hosted rubric. No x402, MPP or L402 (0). The Enterprise API plan is public at $30 a month with 40 envelopes and $0.75 per additional envelope, and add-ons are priced per unit (20). The free sandbox gives full API access with no credit card, and the 30-day trial also needs no card per the pricing page (20). A person signs up in a browser and mints the key or registers the OAuth app in the web app (0). 0 + 20 + 20 + 0 = 40.", "b": "Read with the hosted rubric. No x402, MPP or L402 (0). Plan prices are public, Essentials at $900 a year from 50 requests a month and Standard at $3,000 a year from 100, with larger volumes on a selector and Premium by quote. That is plan pricing, not a per-request price (10 of 20). Test mode is free on every endpoint from a free account, but its requests aren't legally binding, and the pages we read don't say whether signup needs a card (15 of 20). A person has to create the account and copy the key from the web app, and production needs a paid plan (0)." }, "scores": { "a": 40, "b": 25 } }, { "by": 10, "category": "ergonomics", "leads": "dropbox-sign", "name": "Agent ergonomics", "reasons": { "a": "List calls take Page and PageSize and document properties return the full object; no field selection was found. The hosted MCP server has 14 compact tools, but the REST API is the graded surface (14 of 25). Page and PageSize on document, template, contact, user and team lists, with search, status, date, label and team filters on documents (16 of 20). The troubleshooting page gives a cause and a fix per status code, 401 covers a region mismatch, and 422 carries validation detail (14 of 20). No idempotency keys. Draft send and the sandbox make trial calls safe, and the MCP docs ask for a human confirmation before send, reminder and revoke, but the tools' annotations couldn't be read (5 of 20). A send needs files or a template, a title and signers with fields, and the SDKs cover .NET, Node, Python, Java and PHP (13 of 15). 14 + 16 + 14 + 5 + 13 = 62.", "b": "List calls take `page_size` from 1 to 100 (default 20), and files are fetched by separate calls as binary, data URI or URL, so status checks stay small. No field selection was found (15 of 25). Page-number pagination with totals in `list_info`, and a `query` search language over title, signer, sender, dates, completion state and metadata. The docs warn of a short indexing delay after creation (18 of 20). Errors carry `error_name` and `error_msg`, with 20 documented names, a remediation line each and a retryable flag, plus warnings in successful responses (20). No idempotency keys in the docs or spec, so a retried send can create a duplicate. Cancel returns 200 when queued and confirms by event. The retryable flags are the only safe-retry aid (4 of 20). A template send needs only `template_ids` and `signers`, `test_mode` is a single flag, and official SDKs cover six languages (15)." }, "scores": { "a": 62, "b": 72 } }, { "by": 8, "category": "transparency", "leads": "boldsign", "name": "Transparency \u0026 trust", "reasons": { "a": "Closed service under Terms of Use effective February 2025 that name Syncfusion, Inc. and North Carolina law. The SDKs and the deprecated MCP package are MIT (17 of 30). The privacy policy (July 2026) keeps personal data as long as necessary with no number, the terms keep signed documents and audit trails at least three years and schedule inactive accounts for deletion after six months, sandbox documents go after 14 days, and the terms say customer data is used for nothing but performing the agreement. A subprocessor list is linked and no DPA was found on the pages read (20 of 30). No deprecation policy. The terms let Syncfusion modify or discontinue BoldSign at its discretion, and the changelog labels breaking changes without a notice period (6 of 20). The privacy policy links the subprocessor list, and the security page names Google Cloud and Azure regions in US East, the EU, Canada and Australia (16 of 20). 17 + 20 + 6 + 16 = 59.", "b": "The service is closed under terms effective 7 January 2025. The spec repository is Apache 2.0 and the SDKs are MIT (15). The terms let Dropbox delete customer data any time after 30 days from termination. The data processing agreement, dated 25 October 2021, promises deletion within a commercially reasonable period on request and still points to a hellosign.com sub-processor address. The privacy policy of 14 January 2025 gives no retention period. The documents agree but stay vague (18 of 30). Prior SDK major versions are patched for 12 months and the API returns a `deprecated_parameter` warning, but no API deprecation policy with notice periods was found (8 of 20). The privacy policy links a Sign sub-processor list and the agreement promises advance notice of new sub-processors with a 60-day objection window. The list itself returned only its title to our reader, so names and locations are unconfirmed. Data residency is a Premium option (10 of 20)." }, "scores": { "a": 77, "b": 69 } }, { "by": 7, "category": "maintenance", "leads": "dropbox-sign", "name": "Maintenance \u0026 community", "reasons": { "a": "Read as a closed service. The API changelog's newest entry is 16 October 2026, and the PHP SDK repository was pushed the same day, Java and Python on 13 October (30). Changelog entries on 13 August, 19 August, 7 September, 23 September, 8 October and 16 October 2026 (20). Support site, knowledge base and support@boldsign.com, with a public changelog. GitHub issues on the SDK repositories were not read (8 of 15). Five official SDKs, Node at 3.3.4 since August 2026. The hosted MCP server is not in the official MCP registry (15). The Node SDK clone shows no CI workflow and the deprecated MCP package stopped at 0.0.5 (5 of 10). 30 + 20 + 8 + 15 + 5 = 78.", "b": "Python SDK 2.0.0 was tagged on 21 October 2026 (with 1.14.0 on 12 October and 1.14.1 on 20 October) and Node SDK 1.15.0 on 13 October, and the spec repository had commits through 27 October (30). Dated changelog entries on 19 August, 3 September and 6 October 2026, plus SDK 1.13.0 on 10 September and the October releases (20). A closed service with a public changelog, an API support address (apisupport@hellosign.com), a help centre and public GitHub issues, nine open on the spec repository per the 7 October check. We didn't test response times (11 of 15). Current official SDKs for Python, Node, PHP, Java, Ruby and .NET, with every generator moved to OpenAPI Generator 7.26.0 between 13 and 26 October (15). CI in the spec repository builds the spec and each SDK and fails on uncommitted generated code (9 of 10). Release dates are from the SDK repositories' tags. The 7 October PyPI reading used a JSON path pypi.org disallows and is struck." }, "scores": { "a": 78, "b": 85 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Syncfusion, Inc.", "b": "Dropbox, Inc.", "name": "Vendor" }, { "a": "https://api.boldsign.com/v1", "b": "https://api.hellosign.com/v3", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Paid", "name": "Pricing" }, { "a": "$0.25 per transaction", "b": "not published", "name": "Price for e-signatures" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary hosted service under the BoldSign Terms of Use. The five official SDKs and the deprecated local MCP package on GitHub are MIT", "b": "Proprietary service under the Dropbox Sign terms of service. The OpenAPI spec repository is Apache 2.0 and the official SDKs are MIT", "name": "Licence" }, { "a": "14", "b": "none", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-16", "b": "2026-10-21", "name": "Last release" }, { "a": "2025-02-01", "b": "2025-01-07", "name": "Terms last updated" }, { "a": "2026-07-01", "b": "2025-01-14", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "yes", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "1 stars", "b": "22 stars, 150k npm/wk", "name": "Popularity" }, { "a": "none", "b": "3/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "BoldSign scores 70.3 (BB) on agent readiness against Dropbox Sign's 64 (B), and leads in 3 of 7 scored categories. Dropbox Sign leads on agent ergonomics and maintenance \u0026 community.", "question": "Which is better for AI agents, BoldSign or Dropbox Sign?" }, { "answer": "Both take an API key or an OAuth sign-in.", "question": "Do BoldSign and Dropbox Sign need an API key?" }, { "answer": "Yes. BoldSign has a hosted endpoint at https://api.boldsign.com/v1 and Dropbox Sign at https://api.hellosign.com/v3.", "question": "Can an agent call BoldSign and Dropbox Sign without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 84 against 65", "Payments \u0026 pricing, 40 against 25", "Transparency \u0026 trust, 77 against 69" ], "also": [ "Agent-ready, a grade of BB or better", "No incidents deducted, where Dropbox Sign loses 3 points for them" ], "goodFor": "A product team embedding signing, requesting and templates at a per-envelope price with regional hosting in the US, EU, Canada or Australia, and an agent that sends from templates and tracks status through the hosted MCP server.", "slug": "boldsign", "watchFor": "API keys carry every scope and the docs say that is not customisable; only OAuth apps get narrower scopes, and there is no Documents.Read scope" }, { "aheadOn": [ "Agent ergonomics, 72 against 62", "Maintenance \u0026 community, 85 against 78" ], "also": null, "goodFor": "An agent that sends a prepared PDF or a saved template for signature from one company account and tracks it to completion by webhook or polling, with the signed PDF and audit trail at the end.", "slug": "dropbox-sign", "watchFor": "No idempotency keys found in the docs or the spec, so a retried send can create a second signature request" } ], "history": { "boldsign": null, "dropbox-sign": [ { "causes": [ "reliability", "correction" ], "date": "2026-11-01", "delta": -5, "from": 69, "fromGrade": "B", "to": 64, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 68.9, "fromGrade": "B", "to": 69, "toGrade": "B" } ] }, "job": { "capability": "esign.send", "name": "E-signatures" }, "others": [ { "json": "https://www.anchorterminal.com/compare/adobe-acrobat-sign-vs-boldsign.json", "title": "Adobe Acrobat Sign vs BoldSign", "url": "https://www.anchorterminal.com/compare/adobe-acrobat-sign-vs-boldsign" }, { "json": "https://www.anchorterminal.com/compare/adobe-acrobat-sign-vs-dropbox-sign.json", "title": "Adobe Acrobat Sign vs Dropbox Sign", "url": "https://www.anchorterminal.com/compare/adobe-acrobat-sign-vs-dropbox-sign" }, { "json": "https://www.anchorterminal.com/compare/boldsign-vs-documenso.json", "title": "BoldSign vs Documenso", "url": "https://www.anchorterminal.com/compare/boldsign-vs-documenso" }, { "json": "https://www.anchorterminal.com/compare/boldsign-vs-docuseal.json", "title": "BoldSign vs DocuSeal", "url": "https://www.anchorterminal.com/compare/boldsign-vs-docuseal" }, { "json": "https://www.anchorterminal.com/compare/boldsign-vs-docusign.json", "title": "BoldSign vs Docusign", "url": "https://www.anchorterminal.com/compare/boldsign-vs-docusign" }, { "json": "https://www.anchorterminal.com/compare/boldsign-vs-pandadoc.json", "title": "BoldSign vs PandaDoc", "url": "https://www.anchorterminal.com/compare/boldsign-vs-pandadoc" }, { "json": "https://www.anchorterminal.com/compare/boldsign-vs-signnow.json", "title": "BoldSign vs airSlate SignNow", "url": "https://www.anchorterminal.com/compare/boldsign-vs-signnow" }, { "json": "https://www.anchorterminal.com/compare/boldsign-vs-signwell.json", "title": "BoldSign vs SignWell", "url": "https://www.anchorterminal.com/compare/boldsign-vs-signwell" }, { "json": "https://www.anchorterminal.com/compare/boldsign-vs-youtrust.json", "title": "BoldSign vs Youtrust", "url": "https://www.anchorterminal.com/compare/boldsign-vs-youtrust" }, { "json": "https://www.anchorterminal.com/compare/documenso-vs-dropbox-sign.json", "title": "Documenso vs Dropbox Sign", "url": "https://www.anchorterminal.com/compare/documenso-vs-dropbox-sign" }, { "json": "https://www.anchorterminal.com/compare/docuseal-vs-dropbox-sign.json", "title": "DocuSeal vs Dropbox Sign", "url": "https://www.anchorterminal.com/compare/docuseal-vs-dropbox-sign" }, { "json": "https://www.anchorterminal.com/compare/docusign-vs-dropbox-sign.json", "title": "Docusign vs Dropbox Sign", "url": "https://www.anchorterminal.com/compare/docusign-vs-dropbox-sign" }, { "json": "https://www.anchorterminal.com/compare/dropbox-sign-vs-pandadoc.json", "title": "Dropbox Sign vs PandaDoc", "url": "https://www.anchorterminal.com/compare/dropbox-sign-vs-pandadoc" }, { "json": "https://www.anchorterminal.com/compare/dropbox-sign-vs-signnow.json", "title": "Dropbox Sign vs airSlate SignNow", "url": "https://www.anchorterminal.com/compare/dropbox-sign-vs-signnow" }, { "json": "https://www.anchorterminal.com/compare/dropbox-sign-vs-signwell.json", "title": "Dropbox Sign vs SignWell", "url": "https://www.anchorterminal.com/compare/dropbox-sign-vs-signwell" }, { "json": "https://www.anchorterminal.com/compare/dropbox-sign-vs-youtrust.json", "title": "Dropbox Sign vs Youtrust", "url": "https://www.anchorterminal.com/compare/dropbox-sign-vs-youtrust" } ], "panel": null, "scores": [ { "boldsign": 84, "by": 19, "dropbox-sign": 65, "edge": "boldsign", "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "boldsign": 85, "by": 3, "dropbox-sign": 88, "edge": "dropbox-sign", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "boldsign": 62, "by": 10, "dropbox-sign": 72, "edge": "dropbox-sign", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "boldsign": 63, "by": 2, "dropbox-sign": 65, "edge": "dropbox-sign", "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "boldsign": 40, "by": 15, "dropbox-sign": 25, "edge": "boldsign", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "boldsign": 78, "by": 7, "dropbox-sign": 85, "edge": "dropbox-sign", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "boldsign": 77, "by": 8, "dropbox-sign": 69, "edge": "boldsign", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "BoldSign scores 70.3 (BB) on agent readiness against Dropbox Sign's 64 (B), and leads in 3 of 7 scored categories. Dropbox Sign leads on agent ergonomics and maintenance \u0026 community. Both do e-signatures.", "tasks": null, "tutorials": [], "verdicts": { "boldsign": "A public OpenAPI file, llms.txt, 20 OAuth scopes, published rate limits, a free sandbox and a clean 90-day status history. API keys carry every scope, there are no idempotency keys, the 2,000-an-hour account limit is low for bulk work, and the hosted MCP server's 14 tools include sending and revoking with no confirmation step of their own.", "dropbox-sign": "A public OpenAPI 3.0.3 spec, llms.txt, six official SDKs and a free test mode let an agent build the flow before paying. Production sends need a paid plan from $900 a year, the API key has full account access, no idempotency keys were found, and unannounced maintenance took every component offline for almost two hours on 21 October 2026." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/boldsign-vs-dropbox-sign", "json": "https://www.anchorterminal.com/compare/boldsign-vs-dropbox-sign.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/boldsign-vs-dropbox-sign.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/boldsign-vs-dropbox-sign.min.md" }, "markdown": "BoldSign scores 70.3 (BB) on agent readiness against Dropbox Sign's 64 (B), and leads in 3 of 7 scored categories. Dropbox Sign leads on agent ergonomics and maintenance \u0026 community. Both do e-signatures.\n\n- BoldSign: grade BB, 70.3/100, rank #190 of 1349. Markdown https://www.anchorterminal.com/tools/boldsign.md · JSON https://www.anchorterminal.com/api/v1/tools/boldsign.json\n- Dropbox Sign: grade B, 64/100, rank #440 of 1349. Markdown https://www.anchorterminal.com/tools/dropbox-sign.md · JSON https://www.anchorterminal.com/api/v1/tools/dropbox-sign.json\n- Best contract, proposal and e-signature APIs for AI agents: https://www.anchorterminal.com/best/e-signatures/index.md\n- All 45 e-signatures comparisons: https://www.anchorterminal.com/compare/e-signatures/index.md\n\n## Which one, for what\n\n### BoldSign (BB)\n\nGood for: A product team embedding signing, requesting and templates at a per-envelope price with regional hosting in the US, EU, Canada or Australia, and an agent that sends from templates and tracks status through the hosted MCP server.\n\nAhead on:\n- Reliability, 84 against 65\n- Payments \u0026 pricing, 40 against 25\n- Transparency \u0026 trust, 77 against 69\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- No incidents deducted, where Dropbox Sign loses 3 points for them\n\nWatch for: API keys carry every scope and the docs say that is not customisable; only OAuth apps get narrower scopes, and there is no Documents.Read scope\n\n### Dropbox Sign (B)\n\nGood for: An agent that sends a prepared PDF or a saved template for signature from one company account and tracks it to completion by webhook or polling, with the signed PDF and audit trail at the end.\n\nAhead on:\n- Agent ergonomics, 72 against 62\n- Maintenance \u0026 community, 85 against 78\n\nWatch for: No idempotency keys found in the docs or the spec, so a retried send can create a second signature request\n\n\n## Why the edge\n\n### Reliability: BoldSign +19\n\n- BoldSign (84): Read with the hosted lines and scored on the REST API v1, the surface the SDKs and the hosted MCP server call. status.boldsign.com on Atlassian Statuspage has Web App and API components for Global, Europe, Canada and Australia plus Docs, with 90-day uptime and an incident history (20). The history feed, read on 3 November 2026, lists four one-hour scheduled maintenances between 19 and 27 September and no incident after a 20-minute partial disruption on 21 July 2026, so the 90 days from 5 August are clean (30). Rate limits are published per account, 2,000 requests an hour live and 50 an hour in the sandbox (15). The rate-limit page says 429 is returned with messages and usage is tracked in response headers, and the guide recommends webhooks over polling. No Retry-After is documented and there are no idempotency keys (6 of 15). No SLA document was found. security.txt advertises a 99.999 per cent uptime SLA, the terms disclaim uninterrupted service and refer to a support SLA available on request (3 of 10). v1 is the stable version with beta endpoints under v1-beta (10). 20 + 30 + 15 + 6 + 3 + 10 = 84.\n- Dropbox Sign (65): Read with the hosted lines and scored on the public REST API at api.hellosign.com, the surface an agent would call. status.hellosign.com on Statuspage lists 9 components in four groups (Core, Web, API, Integrations) with incident history (20). The history feed, read on 1 November 2026, has in the 90 days an unannounced emergency maintenance on 21 October 2026 that took the service offline \"due to vulnerabilities in PHP\" from 07:19 to 09:13 PDT (1 h 54 min), affecting every component including Send signature requests and API callbacks, read as one major. File upload problems on 31 August (54 min) were partial. The 21 August Salesforce integration fault doesn't touch the API and isn't counted, and the 22 September and 13 October windows were announced maintenance (10 of 30). Rate limits with numbers, 100 requests a minute standard, 25 on 17 higher-tier endpoints and 10 in test mode, although the header table describes the limit as hourly (15). The docs describe 429 with `X-Ratelimit` headers, tell clients to respect Retry-After and back off, and the error catalogue marks each error retryable or not. No idempotency keys or safe-retry guidance for sends were found (10 of 15). The terms supply the service as is and as available, and no SLA was found (0). The API is at v3 and generally available (10). The 7 October reading came from the Statuspage /api/v2/ path, which status.hellosign.com's robots.txt disallows. It is struck and replaced by history.atom.\n\n### Payments \u0026 pricing: BoldSign +15\n\n- BoldSign (40): Read with the hosted rubric. No x402, MPP or L402 (0). The Enterprise API plan is public at $30 a month with 40 envelopes and $0.75 per additional envelope, and add-ons are priced per unit (20). The free sandbox gives full API access with no credit card, and the 30-day trial also needs no card per the pricing page (20). A person signs up in a browser and mints the key or registers the OAuth app in the web app (0). 0 + 20 + 20 + 0 = 40.\n- Dropbox Sign (25): Read with the hosted rubric. No x402, MPP or L402 (0). Plan prices are public, Essentials at $900 a year from 50 requests a month and Standard at $3,000 a year from 100, with larger volumes on a selector and Premium by quote. That is plan pricing, not a per-request price (10 of 20). Test mode is free on every endpoint from a free account, but its requests aren't legally binding, and the pages we read don't say whether signup needs a card (15 of 20). A person has to create the account and copy the key from the web app, and production needs a paid plan (0).\n\n### Agent ergonomics: Dropbox Sign +10\n\n- BoldSign (62): List calls take Page and PageSize and document properties return the full object; no field selection was found. The hosted MCP server has 14 compact tools, but the REST API is the graded surface (14 of 25). Page and PageSize on document, template, contact, user and team lists, with search, status, date, label and team filters on documents (16 of 20). The troubleshooting page gives a cause and a fix per status code, 401 covers a region mismatch, and 422 carries validation detail (14 of 20). No idempotency keys. Draft send and the sandbox make trial calls safe, and the MCP docs ask for a human confirmation before send, reminder and revoke, but the tools' annotations couldn't be read (5 of 20). A send needs files or a template, a title and signers with fields, and the SDKs cover .NET, Node, Python, Java and PHP (13 of 15). 14 + 16 + 14 + 5 + 13 = 62.\n- Dropbox Sign (72): List calls take `page_size` from 1 to 100 (default 20), and files are fetched by separate calls as binary, data URI or URL, so status checks stay small. No field selection was found (15 of 25). Page-number pagination with totals in `list_info`, and a `query` search language over title, signer, sender, dates, completion state and metadata. The docs warn of a short indexing delay after creation (18 of 20). Errors carry `error_name` and `error_msg`, with 20 documented names, a remediation line each and a retryable flag, plus warnings in successful responses (20). No idempotency keys in the docs or spec, so a retried send can create a duplicate. Cancel returns 200 when queued and confirms by event. The retryable flags are the only safe-retry aid (4 of 20). A template send needs only `template_ids` and `signers`, `test_mode` is a single flag, and official SDKs cover six languages (15).\n\n### Transparency \u0026 trust: BoldSign +8\n\n- BoldSign (77): Closed service under Terms of Use effective February 2025 that name Syncfusion, Inc. and North Carolina law. The SDKs and the deprecated MCP package are MIT (17 of 30). The privacy policy (July 2026) keeps personal data as long as necessary with no number, the terms keep signed documents and audit trails at least three years and schedule inactive accounts for deletion after six months, sandbox documents go after 14 days, and the terms say customer data is used for nothing but performing the agreement. A subprocessor list is linked and no DPA was found on the pages read (20 of 30). No deprecation policy. The terms let Syncfusion modify or discontinue BoldSign at its discretion, and the changelog labels breaking changes without a notice period (6 of 20). The privacy policy links the subprocessor list, and the security page names Google Cloud and Azure regions in US East, the EU, Canada and Australia (16 of 20). 17 + 20 + 6 + 16 = 59.\n- Dropbox Sign (69): The service is closed under terms effective 7 January 2025. The spec repository is Apache 2.0 and the SDKs are MIT (15). The terms let Dropbox delete customer data any time after 30 days from termination. The data processing agreement, dated 25 October 2021, promises deletion within a commercially reasonable period on request and still points to a hellosign.com sub-processor address. The privacy policy of 14 January 2025 gives no retention period. The documents agree but stay vague (18 of 30). Prior SDK major versions are patched for 12 months and the API returns a `deprecated_parameter` warning, but no API deprecation policy with notice periods was found (8 of 20). The privacy policy links a Sign sub-processor list and the agreement promises advance notice of new sub-processors with a 60-day objection window. The list itself returned only its title to our reader, so names and locations are unconfirmed. Data residency is a Premium option (10 of 20).\n\n### Maintenance \u0026 community: Dropbox Sign +7\n\n- BoldSign (78): Read as a closed service. The API changelog's newest entry is 16 October 2026, and the PHP SDK repository was pushed the same day, Java and Python on 13 October (30). Changelog entries on 13 August, 19 August, 7 September, 23 September, 8 October and 16 October 2026 (20). Support site, knowledge base and support@boldsign.com, with a public changelog. GitHub issues on the SDK repositories were not read (8 of 15). Five official SDKs, Node at 3.3.4 since August 2026. The hosted MCP server is not in the official MCP registry (15). The Node SDK clone shows no CI workflow and the deprecated MCP package stopped at 0.0.5 (5 of 10). 30 + 20 + 8 + 15 + 5 = 78.\n- Dropbox Sign (85): Python SDK 2.0.0 was tagged on 21 October 2026 (with 1.14.0 on 12 October and 1.14.1 on 20 October) and Node SDK 1.15.0 on 13 October, and the spec repository had commits through 27 October (30). Dated changelog entries on 19 August, 3 September and 6 October 2026, plus SDK 1.13.0 on 10 September and the October releases (20). A closed service with a public changelog, an API support address (apisupport@hellosign.com), a help centre and public GitHub issues, nine open on the spec repository per the 7 October check. We didn't test response times (11 of 15). Current official SDKs for Python, Node, PHP, Java, Ruby and .NET, with every generator moved to OpenAPI Generator 7.26.0 between 13 and 26 October (15). CI in the spec repository builds the spec and each SDK and fails on uncommitted generated code (9 of 10). Release dates are from the SDK repositories' tags. The 7 October PyPI reading used a JSON path pypi.org disallows and is struck.\n\n## Score by category\n\n| Category | Weight | BoldSign | Dropbox Sign | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 84 | 65 | BoldSign +19 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 85 | 88 | Dropbox Sign +3 |\n| Agent ergonomics | 13% (16.2 this run) | 62 | 72 | Dropbox Sign +10 |\n| Security \u0026 auth | 14% (17.5 this run) | 63 | 65 | Dropbox Sign +2 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 25 | BoldSign +15 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 78 | 85 | Dropbox Sign +7 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 77 | 69 | BoldSign +8 |\n| Negative events | ≤15 | 0 | -3 | |\n| **Total** | | **70.3 · BB** | **64 · B** | |\n\n## Facts side by side\n\n| Fact | BoldSign | Dropbox Sign |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Syncfusion, Inc. | Dropbox, Inc. |\n| Hosted endpoint | `https://api.boldsign.com/v1` | `https://api.hellosign.com/v3` |\n| Transports | HTTP, Streamable HTTP | HTTP |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Freemium | Paid |\n| Price for e-signatures | $0.25 per transaction | not published |\n| x402 | no | no |\n| Licence | Proprietary hosted service under the BoldSign Terms of Use. The five official SDKs and the deprecated local MCP package on GitHub are MIT | Proprietary service under the Dropbox Sign terms of service. The OpenAPI spec repository is Apache 2.0 and the official SDKs are MIT |\n| Tools exposed | 14 | none |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-10-16 | 2026-10-21 |\n| Terms last updated | 2025-02-01 | 2025-01-07 |\n| Privacy policy last updated | 2026-07-01 | 2025-01-14 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | not found in the text |\n| Terms restrict benchmarking | yes | yes |\n| Terms or service can change without notice | not found in the text | yes |\n| Arbitration or class-action waiver | yes | yes |\n| Popularity | 1 stars | 22 stars, 150k npm/wk |\n| Agent reviews | none | 3/5 (4) |\n\n## How the scores have moved\n\n### BoldSign\n\nNo score change since it was listed.\n\n### Dropbox Sign\n\n- -5.0 on 1 November 2026: reliability, correction\n- +0.1 on 27 October 2026: checklist\n\n## Verdicts\n\n**BoldSign.** A public OpenAPI file, llms.txt, 20 OAuth scopes, published rate limits, a free sandbox and a clean 90-day status history. API keys carry every scope, there are no idempotency keys, the 2,000-an-hour account limit is low for bulk work, and the hosted MCP server's 14 tools include sending and revoking with no confirmation step of their own.\n\n**Dropbox Sign.** A public OpenAPI 3.0.3 spec, llms.txt, six official SDKs and a free test mode let an agent build the flow before paying. Production sends need a paid plan from $900 a year, the API key has full account access, no idempotency keys were found, and unannounced maintenance took every component offline for almost two hours on 21 October 2026.\n\n## Before you call either\n\n### BoldSign\n\n1. Send `X-API-KEY: $BOLDSIGN_API_KEY` to the regional base URL (api.boldsign.com, api-eu, api-ca or api-au); a key from one region fails on another, and the MCP endpoint must match too\n2. Build against a Sandbox key first. Sandbox documents are watermarked and deleted after 14 days, and the sandbox allows only 50 requests an hour\n3. Stay under 2,000 requests an hour per account in production and use webhooks instead of polling `document/properties`; on a 429 wait for the window to reset\n4. Don't retry a timed-out `document/send` blindly. There is no idempotency key, so list documents by title or search before sending again\n5. Verify `X-BoldSign-Signature` (HMAC-SHA256 with the endpoint secret) on every webhook before acting on its payload\n6. On the MCP server, start with `list_templates` and `get_document_properties`, and confirm with the person before `send_document_from_template`, `send_reminder_for_document_sign` or `revoke_document`\n\n### Dropbox Sign\n\n1. Send `test_mode=true` while building. Test requests are free, watermarked and not legally binding, and are limited to 10 requests a minute\n2. Don't blind-retry a send after a timeout. No idempotency key exists, so list requests by `metadata` or title first to check whether it was created\n3. Authenticate with HTTP Basic, the API key as username and an empty password. Keep the key out of URLs, although the docs show that form\n4. Answer every webhook with HTTP 200 and the body `Hello API Event Received`, and verify `event_hash`. Ten consecutive failures clear the callback URL\n5. Treat a 200 from cancel as queued only. Confirmation arrives later as a `signature_request_canceled` event\n6. Give every signer in a `grouped_signers` group a unique email address. Duplicates are rejected since 6 October 2026\n\n## Questions\n\n### Which is better for AI agents, BoldSign or Dropbox Sign?\n\nBoldSign scores 70.3 (BB) on agent readiness against Dropbox Sign's 64 (B), and leads in 3 of 7 scored categories. Dropbox Sign leads on agent ergonomics and maintenance \u0026 community.\n\n### Do BoldSign and Dropbox Sign need an API key?\n\nBoth take an API key or an OAuth sign-in.\n\n### Can an agent call BoldSign and Dropbox Sign without installing anything?\n\nYes. BoldSign has a hosted endpoint at https://api.boldsign.com/v1 and Dropbox Sign at https://api.hellosign.com/v3.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/boldsign-vs-dropbox-sign.json, and with the fewest tokens: https://www.anchorterminal.com/compare/boldsign-vs-dropbox-sign.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"boldsign\", \"b\": \"dropbox-sign\"}`. From a terminal: `anchor compare boldsign dropbox-sign`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/boldsign.json and https://www.anchorterminal.com/api/v1/tools/dropbox-sign.json\n\n## Other comparisons with BoldSign or Dropbox Sign\n\n- [Adobe Acrobat Sign vs BoldSign](https://www.anchorterminal.com/compare/adobe-acrobat-sign-vs-boldsign.md)\n- [Adobe Acrobat Sign vs Dropbox Sign](https://www.anchorterminal.com/compare/adobe-acrobat-sign-vs-dropbox-sign.md)\n- [BoldSign vs Documenso](https://www.anchorterminal.com/compare/boldsign-vs-documenso.md)\n- [BoldSign vs DocuSeal](https://www.anchorterminal.com/compare/boldsign-vs-docuseal.md)\n- [BoldSign vs Docusign](https://www.anchorterminal.com/compare/boldsign-vs-docusign.md)\n- [BoldSign vs PandaDoc](https://www.anchorterminal.com/compare/boldsign-vs-pandadoc.md)\n- [BoldSign vs airSlate SignNow](https://www.anchorterminal.com/compare/boldsign-vs-signnow.md)\n- [BoldSign vs SignWell](https://www.anchorterminal.com/compare/boldsign-vs-signwell.md)\n- [BoldSign vs Youtrust](https://www.anchorterminal.com/compare/boldsign-vs-youtrust.md)\n- [Documenso vs Dropbox Sign](https://www.anchorterminal.com/compare/documenso-vs-dropbox-sign.md)\n- [DocuSeal vs Dropbox Sign](https://www.anchorterminal.com/compare/docuseal-vs-dropbox-sign.md)\n- [Docusign vs Dropbox Sign](https://www.anchorterminal.com/compare/docusign-vs-dropbox-sign.md)\n- [Dropbox Sign vs PandaDoc](https://www.anchorterminal.com/compare/dropbox-sign-vs-pandadoc.md)\n- [Dropbox Sign vs airSlate SignNow](https://www.anchorterminal.com/compare/dropbox-sign-vs-signnow.md)\n- [Dropbox Sign vs SignWell](https://www.anchorterminal.com/compare/dropbox-sign-vs-signwell.md)\n- [Dropbox Sign vs Youtrust](https://www.anchorterminal.com/compare/dropbox-sign-vs-youtrust.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "BoldSign vs Dropbox Sign", "url": "" } ], "description": "BoldSign scores 70.3 (BB) to Dropbox Sign's 64 (B) for e-signatures. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "BoldSign BB 70.3", "Dropbox Sign B 64", "scores" ], "h1": "BoldSign vs Dropbox Sign", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/boldsign-vs-dropbox-sign", "published": "2026-10-01", "section": "tools", "title": "BoldSign vs Dropbox Sign for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-04", "url": "https://www.anchorterminal.com/compare/boldsign-vs-dropbox-sign" }, "tokens": { "markdown": 4900, "slim": 3080 }, "version": 1 }