BoldSign vs SignWell

BoldSign 63

OAuth 2.0 with authorisation code and PKCE S256, client credentials, implicit, and single-use refresh tokens that last 30 days, with 20 scopes split by resource and action. API keys carry every scope, which the docs say is not customisable, with an optional expiry, four per account and two per environment, deleted to revoke (28 of 30). OAuth apps can be limited to Templates, Users, Teams or SenderIdentity read scopes, though no Documents.Read scope exists, and the sandbox and draft send limit what a call does. The MCP docs recommend a human confirmation before send, reminder and revoke, and the API has no approval step (10 of 20). Signer names, field values and uploaded documents come back through the API, and no guidance on untrusted content was found (3 of 15). Each document has an audit log with user, IP address and timestamp, downloadable by API, and a document history API. No log of API calls or key use was found (8 of 15). security.txt is valid with security@boldsign.com and a policy link, SOC 2 Type 2 per the security page, HMAC-SHA256 signed webhooks with IP allowlisting, third-party code reviews and penetration tests. No bug bounty was found, and the responsible disclosure page is disallowed by robots.txt so it was not read (14 of 20). 28 + 10 + 3 + 8 + 14 = 63.

SignWell 47

One API key sent in the X-Api-Key header, created under Settings, API, and revocable per the 401 entry in the status table. No scopes, expiry, read-only keys or OAuth flow for API clients were found (18 of 30). The pricing page lists user roles and permissions, and draft and test_mode limit what a call does. The MCP server creates drafts only and asks for confirmation before send, recipient changes and delete, but the API itself has no approval step (8 of 20). Signer-entered values and decline messages come back through the API, and no guidance on untrusted content was found (3 of 15). Each completed document has an audit trail with IP address, timestamp and email. The security page mentions access logs. No log of API calls was found (8 of 15). The security page states SOC 2 Type II and a third-party HIPAA audit, with the report sent on request. No security.txt, disclosure policy or bug bounty was found, and the webhook hash covers only the event type and time (10 of 20). security.txt still returned 404 on 2 November 2026; the other lines rest on the 9 October check. 18 + 8 + 3 + 8 + 10 = 47.

BoldSign 77

Closed service under Terms of Use effective February 2025 that name Syncfusion, Inc. and North Carolina law. The SDKs and the deprecated MCP package are MIT (17 of 30). The privacy policy (July 2026) keeps personal data as long as necessary with no number, the terms keep signed documents and audit trails at least three years and schedule inactive accounts for deletion after six months, sandbox documents go after 14 days, and the terms say customer data is used for nothing but performing the agreement. A subprocessor list is linked and no DPA was found on the pages read (20 of 30). No deprecation policy. The terms let Syncfusion modify or discontinue BoldSign at its discretion, and the changelog labels breaking changes without a notice period (6 of 20). The privacy policy links the subprocessor list, and the security page names Google Cloud and Azure regions in US East, the EU, Canada and Australia (16 of 20). 17 + 20 + 6 + 16 = 59.

SignWell 65

The service is closed under terms and conditions last revised on 22 August 2025 that name Docsketch, LLC and Oregon law. The CLI, MCP server and SDKs are MIT (17 of 30). The privacy policy of 28 May 2026 names AWS for hosting, says data is processed in the United States and lists 15 sub-processors. Retention is stated only as while the account is active or as needed, and no DPA was found on the pages read (18 of 30). No deprecation policy or dated notice was found beyond the promise that v1 keeps working. The terms allow the service to be changed or discontinued with or without notice (3 of 20). Sub-processors are listed with addresses and purposes, 13 in the United States, one in Malta and one in Canada (16 of 20). Not re-read on 2 November 2026. 17 + 18 + 3 + 16 = 54.

BoldSign 85

A public Swagger file, OpenAPI 3.0.4, at api.boldsign.com/swagger/v1/swagger.json with 87 operations and two security schemes, X-API-KEY and Bearer, which the docs say generated the C# SDK (25). developers.boldsign.com serves llms.txt and a Markdown twin of every page (10). Every operation has a summary, but 64 of 87 are under 40 characters in the file, and the purpose and conditions of each call sit in the docs pages instead. The MCP docs say which tools read and which act (12 of 20). 186 enums and required fields in the schemas, with page and pageSize on lists (12 of 15). The Swagger file carries no examples. The docs pages carry curl and five SDK examples per call, and the troubleshooting page documents 400, 401, 402, 403, 404, 417 and 422 with causes and fixes, while the file documents 401 everywhere and 403, 422 and 400 on many operations (11 of 15). v1 in the path with v1-beta for previews, and a changelog dated from 20 April 2021 to 16 October 2026 that labels breaking changes (15). 25 + 10 + 12 + 12 + 11 + 15 = 85.

SignWell 75

Public OpenAPI 3.0.1 file at developers.signwell.com with 28 operations since Get Account and Update Account were added (reference pages dated 13 October 2026), and one security scheme (25). llms.txt and a Markdown twin of every reference page (10). Each operation has a description that states its purpose and some conditions, such as which recipients can still be updated, though none says when not to use a call (12 of 20). Request bodies are typed with required fields and 27 enums, with a free-form metadata object (11 of 15). The file carries 79 examples and documents 400, 401, 404, 409, 422 and 429 responses, and the getting started page has a status code table and a 422 error example (12 of 15). The version is in the path as v1 with a written promise that v1 keeps working. No public API changelog was found (5 of 15). 25 + 10 + 12 + 11 + 12 + 5 = 75.

BoldSign 62

List calls take Page and PageSize and document properties return the full object; no field selection was found. The hosted MCP server has 14 compact tools, but the REST API is the graded surface (14 of 25). Page and PageSize on document, template, contact, user and team lists, with search, status, date, label and team filters on documents (16 of 20). The troubleshooting page gives a cause and a fix per status code, 401 covers a region mismatch, and 422 carries validation detail (14 of 20). No idempotency keys. Draft send and the sandbox make trial calls safe, and the MCP docs ask for a human confirmation before send, reminder and revoke, but the tools' annotations couldn't be read (5 of 20). A send needs files or a template, a title and signers with fields, and the SDKs cover .NET, Node, Python, Java and PHP (13 of 15). 14 + 16 + 14 + 5 + 13 = 62.

SignWell 52

Responses can't be trimmed by field. url_only on the completed PDF call returns a link in place of the file (10 of 25). limit (default 10, maximum 50) and page exist on the two bulk send lists only. List Documents is marked x-internal in the vendor's SDK copy of the description and is absent from the public reference (8 of 20). A status code table, 422 errors keyed by field and a 429 message give an agent enough to recover (15 of 20). No idempotency keys. test_mode and draft make trial calls safe, and the MCP server's 16 tools carry readOnlyHint and destructiveHint annotations with confirm_send, confirm_update and confirm_delete inputs (6 of 20). A create call needs files, recipients and at least one field. Official SDKs exist for Ruby, Node, Python and PHP, now at 0.2.0 (PHP 19 October, Node, Python and Ruby 29 October 2026) (13 of 15). 10 + 8 + 15 + 6 + 13 = 52.

BoldSign 40

Read with the hosted rubric. No x402, MPP or L402 (0). The Enterprise API plan is public at $30 a month with 40 envelopes and $0.75 per additional envelope, and add-ons are priced per unit (20). The free sandbox gives full API access with no credit card, and the 30-day trial also needs no card per the pricing page (20). A person signs up in a browser and mints the key or registers the OAuth app in the web app (0). 0 + 20 + 20 + 0 = 40.

SignWell 35

No x402, MPP or L402 (0). A per-unit price is public, from $0.85 an API document down to $0.20 with monthly volume, with no seat or monthly minimum (20). The free account includes 3 API documents a month and unlimited test mode. The API pricing page says the 25 free documents a month need a card on file, and we did not run the signup flow to see whether the free account asks for one (15 of 20). A person has to sign up in a browser and copy the key from Settings (0). The API pricing page, re-read on 2 November 2026, is unchanged. 0 + 20 + 15 + 0 = 35.