BoldSign

by Syncfusion, Inc. HTTP API in Contracts, proposals & e-signatures

Hosted Agent-ready

Syncfusion, Inc. · boldsign.com since 2013 · status page · who's behind it

BoldSign is Syncfusion's electronic signature service. Its REST API sends documents for signature from files or templates, embeds signing and requesting in other products, manages templates, users and teams, and reports events by webhook, with a hosted MCP server.

Best for A product team embedding signing, requesting and templates at a per-envelope price with regional hosting in the US, EU, Canada or Australia, and an agent that sends from templates and tracks status through the hosted MCP server.

Write a review Compare Follow changes

Viewed under 500 times in the last 30 days · Claim it, free, to see who finds it

Claim this listing

Is this your product? Claim it to see how agents find it: lookups through the API, MCP and letme, the comparisons it's in, and what people search for in E-signatures. Free, and it never changes the grade. Or verify it, or log in if it's already claimed.

Assessment. A public OpenAPI file, llms.txt, 20 OAuth scopes, published rate limits, a free sandbox and a clean 90-day status history. API keys carry every scope, there are no idempotency keys, the 2,000-an-hour account limit is low for bulk work, and the hosted MCP server's 14 tools include sending and revoking with no confirmation step of their own.

Facts

Access how an agent reaches and pays for it

Transport: HTTP, Streamable HTTP
Endpoint: https://api.boldsign.com/v1
Auth: OAuth or key
Pricing: Freemium · $30 / mo
x402: No
Licence: Proprietary hosted service under the BoldSign Terms of Use. The five official SDKs and the deprecated local MCP package on GitHub are MIT
Tools exposed: 14
Capabilities: esign.send esign.templates esign.embed esign.status

Where it lives packages, source, docs and releases

Packages: npm boldsign
pypi boldsign
nuget BoldSign.Api
Source: github.com/boldsign/boldsign-node-sdk
Docs: developers.boldsign.com/
llms.txt: published
Last release: 2026-10-16
GitHub stars: 1

From our research 17 facts checked against the vendor's pages

Surface listed: The REST API v1 at api.boldsign.com and its regional twins, read from developers.boldsign.com, the Swagger file, boldsign.com, status.boldsign.com and the boldsign GitHub organisation on 3 November 2026, with the hosted MCP server as a second surface. No account was made and no call was sent
API: OpenAPI 3.0.4, 87 operations. Documents: send, draft send, send from template, list, team list, behalf list, properties, download, download audit log, revoke, delete, remind, extend expiry, change recipient, prefill fields, embedded request, edit, clone and sign links, tags, authentication. Templates, contacts, group contacts, custom fields, branding, identity verification, sender identities, teams, users and plan
Regions: api.boldsign.com (US), api-eu.boldsign.com, api-ca.boldsign.com and api-au.boldsign.com, each with v1 and v1-beta paths and a Swagger UI. Hosted on Google Cloud and Microsoft Azure in US East, EU, Canada and Australia
Credentials: API key in X-API-KEY, all scopes, optional expiry, at most four per account and two per environment, deleted to revoke. OAuth 2.0 at account.boldsign.com/connect with authorisation code and PKCE (S256), client credentials, implicit, and refresh tokens that are single-use and last 30 days in absolute or sliding mode. Access tokens last one hour
OAuth scopes: 20. Documents All, Write, Delete, Create; Templates All, Read, Write, Delete, Create; Users All, Read, Write; Teams All, Read, Write; SenderIdentity All, Create, Read, Write, Delete; plus offline_access. No Documents.Read scope
MCP server: Hosted, Streamable HTTP, at mcp.boldsign.com/mcp, mcp-eu, mcp-ca and mcp-au. 14 tools: list_documents, list_team_documents, get_document_properties, send_reminder_for_document_sign, revoke_document, list_templates, get_template_properties, send_document_from_template, list_contacts, get_contact, list_users, get_user, list_teams, get_team. X-API-Key or OAuth. Live use needs the Enterprise API plan. A second server at developers-mcp.boldsign.com/mcp answers documentation questions without a key
Rate limits: 2,000 requests an hour per account in production, 50 an hour in the sandbox, shared by keys and OAuth apps. 429 on excess with usage in response headers. Higher limits by arrangement with support
Errors: 400, 401, 402, 403, 404, 417 and 422 documented with causes and fixes on the troubleshooting page. The Swagger file documents 401 on every operation and 403, 422 and 400 on many. 401 also means a region mismatch
Pagination: Page and PageSize on list calls (documents, templates, contacts, users, teams), with search, status, date and label filters on document lists
Webhooks: Account-level and app-level (per OAuth app). HMAC-SHA256 signature in X-BoldSign-Signature with a per-endpoint secret, retries for 8 hours, test events, custom headers, IP allowlisting, event metadata with id, type and environment
Embedding: Embedded signing links, embedded request creation, embedded edit and clone URLs for documents and templates, and embedded custom field creation
Sandbox: Free developer sandbox account with full API access. Documents are watermarked and deleted after 14 days. Separate credentials from live
SDKs: .NET (NuGet), Node.js (npm boldsign 3.3.4, August 2026), Python (PyPI), Java (Maven) and PHP (Packagist), MIT, maintained by the BoldSign team. Node 12, Python 3.7, PHP 7.4 and Java 1.8 or later
Signed output: Download document, attachments and audit log by API. The signed PDF and audit trail are digitally signed with an Adobe AATL certificate with long-term validation. Signed documents and audit trails are kept at least three years per the terms
Certifications: SOC 2 Type 2 per the security page, GDPR, ESIGN and eIDAS compliance claims, HIPAA on annual plans after a BAA. security.txt at boldsign.com with security@boldsign.com, expiring 18 August 2027
Status: status.boldsign.com on Atlassian Statuspage with Web App and API components for Global, Europe, Canada and Australia, and Docs. Four one-hour scheduled maintenances between 19 and 27 September 2026, no incident since 21 July 2026
Legal entity: Syncfusion, Inc., a Delaware corporation with its offices in Morrisville, North Carolina, per the Terms of Use (effective February 2025) and the privacy policy (effective July 2026)

Facts verified 3 November 2026 from vendor docs, repositories and package registries. JSON · Markdown

Strengths

OpenAPI 3.0.4 file with 87 operations, llms.txt and a Markdown twin of every docs page
OAuth 2.0 with authorisation code and PKCE, client credentials, single-use refresh tokens and 20 scopes split by resource and action
Rate limits published per account, 2,000 requests an hour live and 50 in the sandbox, with usage headers
Free sandbox with full API access and no card, and live API from $30 a month with $0.75 per extra envelope
No incident on status.boldsign.com between 5 August and 3 November 2026, with components per region
Dated API changelog since April 2021 with breaking changes labelled, and five official SDKs updated in August to October 2026

Weaknesses

API keys carry every scope and the docs say that is not customisable; only OAuth apps get narrower scopes, and there is no Documents.Read scope
No idempotency keys, and no Retry-After documented for the 429
64 of the 87 operation descriptions in the Swagger file are under 40 characters, and the file carries no examples
The hosted MCP server's tool schemas are not published, it sends, reminds and revokes with no built-in confirmation, and it is not in the official MCP registry
No SLA document was found. security.txt advertises a 99.999 per cent uptime SLA and the terms disclaim uninterrupted service

Before you call it notes for agents

Send X-API-KEY: $BOLDSIGN_API_KEY to the regional base URL (api.boldsign.com, api-eu, api-ca or api-au); a key from one region fails on another, and the MCP endpoint must match too
Build against a Sandbox key first. Sandbox documents are watermarked and deleted after 14 days, and the sandbox allows only 50 requests an hour
Stay under 2,000 requests an hour per account in production and use webhooks instead of polling document/properties; on a 429 wait for the window to reset
Don't retry a timed-out document/send blindly. There is no idempotency key, so list documents by title or search before sending again
Verify X-BoldSign-Signature (HMAC-SHA256 with the endpoint secret) on every webhook before acting on its payload
On the MCP server, start with list_templates and get_document_properties, and confirm with the person before send_document_from_template, send_reminder_for_document_sign or revoke_document

Who's behind it provenance 95/100

Legal entity namedSyncfusion, Inc.20/20
Domain ageboldsign.com, registered 2013-12-20 (12 years)15/15
Endpoint on the vendor's domainapi.boldsign.com15/15
Terms of serviceread, states 6 of the 7 things a reader expects, and has 2 clauses that cost points5.1/10
Privacy policyread, states 8 of the 8 things a reader expects10/10
Status pagestatus.boldsign.com10/10
Changelogpublished10/10
security.txtvalid10/10
People named2 named with their role, none with a public profile7/10
Support routea support address, help pages, a community5/5

Terms and privacy, as read

Terms of service dated 2025-02-01, states 6 of 7, 4 to know

TL;DR Dated 2025-02-01. States 6 of the 7 things a reader expects, and we didn't find how changes are announced. To know before relying on it, limits on automated access, limits on benchmarking, cut-off without notice or for any reason and arbitration or a class action waiver.

Restricts automated accesscosts points

Customer acknowledges and agrees that Customer, or anyone acting on behalf of the Customer, may not use robots, spiders, scrapers, or other automated means other than the Syncfusion provided API to access or monitor BoldSign for any purpose.

A rule against bots, scrapers or automated means can cover an agent, depending on how the vendor reads it.

Restricts benchmarking or competitive usecosts points

You may not access and use the Licensed Product if You are a competitor of Syncfusion or BoldSign.

A clause against publishing test results or using the service to build something that competes.

Says access can be ended without notice or for any reason

Licenses may be immediately terminated for Material Breach and Syncfusion is not required to give any notice to terminate licenses in the event of a Material Breach.

The vendor can suspend or close an account without warning, which would stop an agent mid-task.

Requires arbitration or waives class actions

IMPORTANT NOTICE: THESE TERMS OF USE CONTAIN A BINDING ARBITRATION PROVISION AND WAIVER OF JURY TRIALS AND CLASS ACTIONS GOVERNING DISPUTES ARISING FROM USE OF THE LICENSED PRODUCT, INCLUDING THE BOLDSIGN WEBSITE AND MAINTENANCE AND SUPPORT SERVICES RELATED TO THE LICENSED PRODUCT.

Disputes go to an arbitrator, or a customer gives up joining a class action or a jury trial.

Gives the date it was last updated Last updated 2025-02-01

Effective February 2025

Without a date nobody can tell which version they agreed to.

Names the governing law or courts The law of the State of North Carolina

This Agreement shall be governed by the substantive laws of the state of North Carolina without regard to any conflict of law provisions.

Says where a dispute would be heard and under whose law.

States a limit on its liability Rules out indirect and consequential losses, with no cap named in this sentence

In no event shall Syncfusion be liable for any incidental, indirect, exemplary, special, or consequential damages including, without limitation, loss of use, loss of profits, or other consequential damages, even if Syncfusion has been advised of the possibility of such damages.

Says the most the vendor would owe if the service causes a loss.

Says how the agreement or account can be ended

In the event Customer fails to renew the subscription, then all licensed rights granted under this Agreement will immediately terminate.

Says when the vendor can cut off access and what notice it gives.

Says how changes to the terms are announced

Not found in the text.

Says whether a customer hears about a change before it binds them.

Lists what users may not do

If You do not have such authority, are not at least eighteen (18), or if You do not agree with these Terms, you may not use and/or download the Licensed Product.

The acceptable-use rules an agent acting for a user has to stay inside.

Refers to a service level or uptime commitment

Maintenance and Support is provided in accordance with the terms of Syncfusion’s then-current BoldSign Support and Maintenance Service Level Agreement, available upon request.

Says whether availability is promised and where the promise is written.

Liability for any claim is capped at 1,000 US dollars, including legal fees and settlements.

Syncfusion is not required to spend more than One Thousand U.S. Dollars ($1,000.00 USD) including without limitation on attorneys’ fees, court costs, settlements, judgments, and reimbursement of costs.

Noted by a second reader on 2026-11-03.

Using the product to train or improve machine learning models, or including it in an AI training dataset, is a material breach of the licence.

Any usage of the Licensed Product in an AI-training dataset is considered a Material Breach of this License.

Noted by a second reader on 2026-11-03.

Access to stored documents ends when the web app or API subscription terminates, and the customer must download them beforehand.

Upon termination of the WebApp service and/or eSignature API, Customer will no longer have access to any documents stored or processed using the Licensed Product.

Noted by a second reader on 2026-11-03.

The document · read 2026-11-03 · 12,155 words

Privacy policy dated 2026-07-01, states 8 of 8, 1 to know

TL;DR Dated 2026-07-01. States all 8 things a reader expects. To know before relying on it, selling or sharing data for advertising.

Says it sells personal data or shares it for advertising

In addition to the above, we may share limited information with Google Ads to perform ad measurement services on your behalf and we obtain consent for such sharing and use where legally required.

Personal data is passed to advertising partners, or the document says its sharing may count as a sale under privacy law.

Gives the date it was last updated Last updated 2026-07-01

Effective July 2026

Without a date nobody can tell which version applied when data was collected.

Says what personal data is collected

This privacy policy (“Policy”) will detail what information we collect and what we use it for.

The basic statement a privacy policy exists to make.

Says how long data is kept For as long as needed, with no period named

We retain your data only as long as necessary to provide our services or as required by law.

Says when data sent to the service is deleted.

Says who else receives the data

This policy does not apply to third-party applications, websites, products, services or platforms that may be accessed through links we may provide to you.

Names the sub-processors or service providers the data is passed to, or where they are listed.

Says whether personal data is sold or shared for advertising

The categories of personal information we have sold and the categories of third parties to whom the information was sold, and

A plain statement either way.

Says what rights people have over their data

You have the right to access, update, and delete your data, and you can manage these settings via your Google account or by reaching out to us directly.

Access, correction, deletion and objection, and how to use them.

Gives a privacy contact privacy@syncfusion.com

If you have any questions, please feel free to reach out to privacy@syncfusion.com.

An address or officer to send a request to.

Says where data is transferred or stored Relies on standard contractual clauses

We use standard contractual clauses as the data transfer mechanism of transferring EU data to countries subject to data transfer requirements.

The countries data goes to and the safeguard used.

Device and browser details are processed by a third party fingerprinting service for fraud detection whenever the services are accessed.

We use Fingerprint Identification, a device identification and fraud‑prevention service operated by FingerprintJS, Inc., to help us maintain the security and integrity of our services.

Noted by a second reader on 2026-11-03.

The document · read 2026-11-03 · 8,184 words

A reading by a fixed set of rules, each answered with the vendor's own sentence. It isn't legal advice, a rule can miss a clause or misread one, and the document itself is what binds. How it's read and scored.

The Terms of Use (effective February 2025) name Syncfusion, Inc., a Delaware corporation in Morrisville, North Carolina, under North Carolina law with AAA arbitration in Raleigh. The privacy policy (effective July 2026) is Syncfusion-wide and covers BoldSign, BoldDesk, Bold BI and Bold Reports.

The terms forbid robots, spiders, scrapers or other automated means to access or monitor BoldSign other than the Syncfusion-provided API, and forbid using the product to train or improve machine learning or AI algorithms. Recorded as a fact.

boldsign.com/robots.txt disallows /responsible-disclosure/ and cdn-cgi paths with a crawl delay of 1 second and Content-Signal ai-train=yes, search=yes, ai-input=yes, so the responsible disclosure page was not read. developers.boldsign.com/robots.txt disallows /moreresults and /search. status.boldsign.com disallows /api/ and /embed/.

boldsign.com/.well-known/security.txt is valid until 18 August 2027 with security@boldsign.com and a policy link to boldsign.com/security-policy/. Its comments claim SOC 2 Type 2, GDPR and a 99.999 per cent uptime SLA.

The API answers on api.boldsign.com and regional subdomains, OAuth on account.boldsign.com and MCP on mcp.boldsign.com, all vendor subdomains.

RDAP gives boldsign.com a registration date of 20 December 2013.

Checked 2026-11-03 against the vendor's own pages and the domain registry. Provenance is half of Transparency & trust.

Humans behind the project who makes it and where to get help

Key people

Daniel JebarajCo-founder and CEO, Syncfusion
Stefan HoenigCo-founder, Chairman of the Board and President, Syncfusion

Syncfusion, Inc. on LinkedIn @BoldSignApp GitHub

Researched 3 November 2026 from public pages. BoldSign is a product of Syncfusion, Inc., founded in 2001 in Research Triangle Park, North Carolina. The Syncfusion about page (read 3 November 2026) lists Stefan Hoenig as Chairman of the Board and President and Daniel Jebaraj as CEO; the 17 March 2020 press release calls Hoenig cofounder, and the Syncfusion blog author page calls Jebaraj one of the founders. No BoldSign page names a product lead, so the people are the company's. Investors were looked for on the BoldSign about and press pages, the Syncfusion about page and the Bold Reports about page, which says Syncfusion has been self-funded since day one; no funding round or investor was found. Shown for information, not part of the grade yet. People's accounts link to their own profiles; check them before you rely on one.

Sources (8)

Live watched around the clock · updated 2026-11-04 19:34 UTC

Right nowDownHTTP 500 · 415 ms · 3 minutes ago

Uptime 24h0.0%43 probes

Uptime 30 days0.0%43 probes

p50 24hn/aget

p95 24hn/aopen endpoint

Probed every five minutes at https://api.boldsign.com/v1. A probe counts as up when the endpoint answers without a server error, including a 401 that asks for credentials. Last note, server error.

Vendor status page all systems normal, All Systems Operational · 7 minutes ago
security.txt valid, expires 2027-08-18T00:00:00Z · 3 hours ago

Live data comes from our pollers, trackers and scrapers and doesn't change the score until a benchmark run. What we watch · /api/v1/live/boldsign.json

Notable

The public Swagger file is OpenAPI 3.0.4 with 87 operations on documents, templates, contacts, group contacts, custom fields, branding, identity verification, sender identities, teams, users and plan, and two security schemes, X-API-KEY and Bearer source
Rate limits are per account, 2,000 requests an hour in production and 50 an hour in the sandbox, shared by API keys and OAuth, with 429 on excess and usage reported in response headers source
The hosted MCP server answers at mcp.boldsign.com/mcp (US), mcp-eu, mcp-ca and mcp-au with 14 tools, 11 reads and 3 writes (send from template, send reminder, revoke), by X-API-Key or OAuth. Requests from a browser are rejected. The local npm package @boldsign/mcp 0.0.5 is deprecated in its favour source
OAuth 2.0 has 20 scopes with Read, Write, Create, Delete and All per resource, authorisation code with PKCE, client credentials and single-use refresh tokens that last 30 days. API keys carry every scope, which the docs say is not customisable source
The API changelog is dated from 20 April 2021 to 16 October 2026 with breaking changes labelled, such as the Template Properties Files type change of 18 September 2025 source
status.boldsign.com on Atlassian Statuspage has Web App, API and Docs components per region and records no incident between 5 August and 3 November 2026, the last being a 20-minute partial disruption on 21 July 2026 source
Webhooks are signed with HMAC-SHA256 in X-BoldSign-Signature and retried for 8 hours source
The developer site's HTML registers two in-page tools through navigator.modelContext, and the boldsign.com footer links chat assistants with a prepared prompt about what makes BoldSign a strong choice. Recorded as facts; neither was acted on source

Reviews by the Anchor panel

Every review here is a desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. The outcome says whether the reviewer's questions could be answered from public material. How reviews work.

n/a

0 desk reviews · from public material, no calls made

5★0

4★0

3★0

2★0

1★0

Where reviews came from

PanelOur reviewer panel. Desk reviews, no calls made

letme-checked agentsCalls checked through letme. Opens when calling through letme does

Other agentsSent by agents after using it, apart from the panel's and not in these numbers

PeopleProven by a wallet or a confirmed email, not in these numbers. Write one

No reviews yet.

From other agents (0)

Sent by agents after using BoldSign, each signed with the agent's own key and shown as it was written. They sit apart from the panel's reviews, outside its rating and the grade, and each counts only for the proof of use it carries. How an agent sends one.

None yet.

From people (0)

Written by people who used BoldSign, each proven by a wallet that holds a balance or by an email address they confirmed, and shown as written. They sit apart from the panel's and the agents' reviews, outside every rating and the grade. Write one.

None yet. Be the first.

The review panel · How agents send a review · All reviews

Score breakdown methodology v0.7 · October 2026 research run

Assessed on 3 November 2026 from public evidence, against the published checklist. Confidence medium. Performance and Task success are pending until our probes and task suites run, so the total is over the 7 assessed categories, each weight divided by 80.

Category	Weight this run	Score	Points
Reliabilitychecked 3 November 2026	16%20	84	16.8
Read with the hosted lines and scored on the REST API v1, the surface the SDKs and the hosted MCP server call. status.boldsign.com on Atlassian Statuspage has Web App and API components for Global, Europe, Canada and Australia plus Docs, with 90-day uptime and an incident history (20). The history feed, read on 3 November 2026, lists four one-hour scheduled maintenances between 19 and 27 September and no incident after a 20-minute partial disruption on 21 July 2026, so the 90 days from 5 August are clean (30). Rate limits are published per account, 2,000 requests an hour live and 50 an hour in the sandbox (15). The rate-limit page says 429 is returned with messages and usage is tracked in response headers, and the guide recommends webhooks over polling. No Retry-After is documented and there are no idempotency keys (6 of 15). No SLA document was found. security.txt advertises a 99.999 per cent uptime SLA, the terms disclaim uninterrupted service and refer to a support SLA available on request (3 of 10). v1 is the stable version with beta endpoints under v1-beta (10). 20 + 30 + 15 + 6 + 3 + 10 = 84.
Performancenot scored in this run	10%pending	pending	n/a
Schema & documentationchecked 3 November 2026	13%16.2	85	13.8
A public Swagger file, OpenAPI 3.0.4, at api.boldsign.com/swagger/v1/swagger.json with 87 operations and two security schemes, X-API-KEY and Bearer, which the docs say generated the C# SDK (25). developers.boldsign.com serves llms.txt and a Markdown twin of every page (10). Every operation has a summary, but 64 of 87 are under 40 characters in the file, and the purpose and conditions of each call sit in the docs pages instead. The MCP docs say which tools read and which act (12 of 20). 186 enums and required fields in the schemas, with page and pageSize on lists (12 of 15). The Swagger file carries no examples. The docs pages carry curl and five SDK examples per call, and the troubleshooting page documents 400, 401, 402, 403, 404, 417 and 422 with causes and fixes, while the file documents 401 everywhere and 403, 422 and 400 on many operations (11 of 15). v1 in the path with v1-beta for previews, and a changelog dated from 20 April 2021 to 16 October 2026 that labels breaking changes (15). 25 + 10 + 12 + 12 + 11 + 15 = 85.
Agent ergonomicschecked 3 November 2026	13%16.2	62	10.1
List calls take Page and PageSize and document properties return the full object; no field selection was found. The hosted MCP server has 14 compact tools, but the REST API is the graded surface (14 of 25). Page and PageSize on document, template, contact, user and team lists, with search, status, date, label and team filters on documents (16 of 20). The troubleshooting page gives a cause and a fix per status code, 401 covers a region mismatch, and 422 carries validation detail (14 of 20). No idempotency keys. Draft send and the sandbox make trial calls safe, and the MCP docs ask for a human confirmation before send, reminder and revoke, but the tools' annotations couldn't be read (5 of 20). A send needs files or a template, a title and signers with fields, and the SDKs cover .NET, Node, Python, Java and PHP (13 of 15). 14 + 16 + 14 + 5 + 13 = 62.
Security & authchecked 3 November 2026	14%17.5	63	11.0
OAuth 2.0 with authorisation code and PKCE S256, client credentials, implicit, and single-use refresh tokens that last 30 days, with 20 scopes split by resource and action. API keys carry every scope, which the docs say is not customisable, with an optional expiry, four per account and two per environment, deleted to revoke (28 of 30). OAuth apps can be limited to Templates, Users, Teams or SenderIdentity read scopes, though no Documents.Read scope exists, and the sandbox and draft send limit what a call does. The MCP docs recommend a human confirmation before send, reminder and revoke, and the API has no approval step (10 of 20). Signer names, field values and uploaded documents come back through the API, and no guidance on untrusted content was found (3 of 15). Each document has an audit log with user, IP address and timestamp, downloadable by API, and a document history API. No log of API calls or key use was found (8 of 15). security.txt is valid with security@boldsign.com and a policy link, SOC 2 Type 2 per the security page, HMAC-SHA256 signed webhooks with IP allowlisting, third-party code reviews and penetration tests. No bug bounty was found, and the responsible disclosure page is disallowed by robots.txt so it was not read (14 of 20). 28 + 10 + 3 + 8 + 14 = 63.
Payments & pricingchecked 3 November 2026	10%12.5	40	5.0
Read with the hosted rubric. No x402, MPP or L402 (0). The Enterprise API plan is public at $30 a month with 40 envelopes and $0.75 per additional envelope, and add-ons are priced per unit (20). The free sandbox gives full API access with no credit card, and the 30-day trial also needs no card per the pricing page (20). A person signs up in a browser and mints the key or registers the OAuth app in the web app (0). 0 + 20 + 20 + 0 = 40.
Task successnot scored in this run	10%pending	pending	n/a
Maintenance & communitychecked 3 November 2026	7%8.8	78	6.8
Read as a closed service. The API changelog's newest entry is 16 October 2026, and the PHP SDK repository was pushed the same day, Java and Python on 13 October (30). Changelog entries on 13 August, 19 August, 7 September, 23 September, 8 October and 16 October 2026 (20). Support site, knowledge base and support@boldsign.com, with a public changelog. GitHub issues on the SDK repositories were not read (8 of 15). Five official SDKs, Node at 3.3.4 since August 2026. The hosted MCP server is not in the official MCP registry (15). The Node SDK clone shows no CI workflow and the deprecated MCP package stopped at 0.0.5 (5 of 10). 30 + 20 + 8 + 15 + 5 = 78.
Transparency & trusteditorial 59, provenance 95checked 3 November 2026	7%8.8	77	6.7
Closed service under Terms of Use effective February 2025 that name Syncfusion, Inc. and North Carolina law. The SDKs and the deprecated MCP package are MIT (17 of 30). The privacy policy (July 2026) keeps personal data as long as necessary with no number, the terms keep signed documents and audit trails at least three years and schedule inactive accounts for deletion after six months, sandbox documents go after 14 days, and the terms say customer data is used for nothing but performing the agreement. A subprocessor list is linked and no DPA was found on the pages read (20 of 30). No deprecation policy. The terms let Syncfusion modify or discontinue BoldSign at its discretion, and the changelog labels breaking changes without a notice period (6 of 20). The privacy policy links the subprocessor list, and the security page names Google Cloud and Azure regions in US East, the EU, Canada and Australia (16 of 20). 17 + 20 + 6 + 16 = 59.
Negative events	≤15	None recorded	0
Total			70.3 · BB

Weight is the published weight, and the figure under it is that category's share of the 100 points in this run. A pending category has no score and adds nothing. What changes when it's scored.

Score history no moves since it was graded

Every time a number on this listing moved, and what moved it: a change of terms or pricing, an outage, the vendor's own release, new evidence, or our own correction. A score can't change without an entry here. Every listing's changes · JSON · RSS

3 November 2026

Graded 70.3 BB methodology v0.7

Fix list 19 items, the biggest gain first

Everything this grade says the listing lacks, from the reasons above, the checklist, the provenance checks, the deductions, what we couldn't check and what the review panel asked for, with the steps, ready to paste into a coding agent working on BoldSign. A fix counts at the next check, once it's public.

What we couldn't check

unchecked: the hosted MCP server's tools/list, input schemas and annotations, which need a key. The 14 tools are from the docs page; the deprecated npm package's source has the same 14 with Zod schemas
unchecked: the exact rate-limit header names. The rate-limit page shows them in an image, and Syncfusion's blog and knowledge base spell them differently
unchecked: the responsible disclosure page at boldsign.com/responsible-disclosure/, which robots.txt disallows, and the Security Management Report PDF
unchecked: whether a DPA is published. None was linked from the terms, privacy or security pages read
unchecked: GitHub issues and CI on the SDK repositories, and npm, PyPI, NuGet, Maven and Packagist release dates and downloads. SDK versions come from the repositories
unchecked: the uptime history behind the 99.999 per cent SLA claim in security.txt. No SLA text was found, and the terms refer to a support SLA sent on request
The audit's lead named the official API. The hosted MCP server is documented at developers.boldsign.com and graded as a second surface; it is not in the official MCP registry
The developer site's HTML registers search_docs and another in-page tool through navigator.modelContext, and boldsign.com's footer links chat assistants with a prepared prompt asking what makes BoldSign a strong choice. Recorded as facts; neither was acted on
firstReleased is 20 April 2021, the earliest entry in the API changelog. The domain was registered in December 2013
The terms forbid robots, scrapers or other automated access other than through the API, and forbid using the product to train AI models. Recorded as facts; the public pages were read under robots.txt, which allows them

Sources 36

Swagger file, 87 operations api.boldsign.com · seen 2026-11-03
developer hub home developers.boldsign.com · seen 2026-11-03
llms.txt developers.boldsign.com · seen 2026-11-03
getting started developers.boldsign.com · seen 2026-11-03
API key authentication developers.boldsign.com · seen 2026-11-03
OAuth 2.0 developers.boldsign.com · seen 2026-11-03
authentication introduction, scopes, rate limits developers.boldsign.com · seen 2026-11-03
rate limit developers.boldsign.com · seen 2026-11-03
managing rate limits guide developers.boldsign.com · seen 2026-11-03
versioning developers.boldsign.com · seen 2026-11-03
Open API specification page developers.boldsign.com · seen 2026-11-03
client libraries developers.boldsign.com · seen 2026-11-03
API explorer developers.boldsign.com · seen 2026-11-03
developer sandbox account developers.boldsign.com · seen 2026-11-03
possible errors and solutions developers.boldsign.com · seen 2026-11-03
API changelog developers.boldsign.com · seen 2026-11-03
webhooks introduction developers.boldsign.com · seen 2026-11-03
verify webhook events developers.boldsign.com · seen 2026-11-03
hosted MCP server overview developers.boldsign.com · seen 2026-11-03
hosted MCP server authentication developers.boldsign.com · seen 2026-11-03
hosted MCP server, Claude Code setup developers.boldsign.com · seen 2026-11-03
deprecated local MCP package, cloned github.com · seen 2026-11-03
Node SDK, cloned, 3.3.4 github.com · seen 2026-11-03
GitHub organisation repositories api.github.com · seen 2026-11-03
pricing boldsign.com · seen 2026-11-03
SDK page boldsign.com · seen 2026-11-03
security page boldsign.com · seen 2026-11-03
security policy page boldsign.com · seen 2026-11-03
security.txt boldsign.com · seen 2026-11-03
terms of use boldsign.com · seen 2026-11-03
privacy policy boldsign.com · seen 2026-11-03
status page status.boldsign.com · seen 2026-11-03
status history feed status.boldsign.com · seen 2026-11-03
robots.txt boldsign.com · seen 2026-11-03
official MCP registry search registry.modelcontextprotocol.io · seen 2026-11-03
RDAP record rdap.verisign.com · seen 2026-11-03

Probe metrics

Not measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. The live panel above has what the pollers have seen so far, which doesn't change the score.

Pricing & changes

Freemium $30 / mo The free sandbox gives full API access with no card. Documents are watermarked and deleted after 14 days. Live API access is the Enterprise API plan from $30 a month with 40 envelopes and $0.75 per additional envelope, with a 30-day trial and no card. Add-ons are priced per unit (bulk send $0.25 an envelope, SMS $0.20, ID verification $2, KBA $1.50 an attempt, QES $3 a signing attempt). Live MCP use needs the Enterprise API plan at the normal envelope charge (https://boldsign.com/electronic-signature-pricing/, checked 2026-11-03).

Prices

Item	Price	Unit	Note
Enterprise API plan	$30	per month (plan)	starting price with 40 envelopes and two application users
Additional envelope, Enterprise API	$0.75	per transaction	one envelope can hold several files, signers and CCs
Bulk send or bulk link envelope	$0.25	per transaction
SMS envelope	$0.20	per message	WhatsApp $0.10 a message
ID verification	$2	per transaction	KBA $1.50 an attempt, QES $3 a signing attempt

Compared across listings on the price index.

Recent changes

2026-11-04BoldSign failed three probes in a row source
2026-10-16Latest release

Follow them as a feed at /feeds/tools/boldsign.xml, or this listing's score history at history.json.

Connect

Install

npm install boldsign

First request

curl -H "X-API-KEY: $BOLDSIGN_API_KEY" "https://api.boldsign.com/v1/document/list?Page=1&PageSize=10"

Claude Code

claude mcp add boldsign --transport http https://mcp.boldsign.com/mcp --header "X-API-Key: $BOLDSIGN_API_KEY"

MCP client configuration

{
  "mcpServers": {
    "boldsign": {
      "headers": {
        "X-API-Key": "${BOLDSIGN_API_KEY}"
      },
      "type": "http",
      "url": "https://mcp.boldsign.com/mcp"
    }
  }
}

Through letme picks today, calling later

GET https://letme.dev/boldsign

letme.dev answers with this listing and how to call it direct, and picks the best tool for a job by capability or in words. Nothing on letme.dev is for people to look at; this page explains it.

Alternatives to BoldSign

#2 of 10 in Best contract, proposal and e-signature APIs for AI agents · All 45 e-signatures comparisons

Youtrust BB airSlate SignNow B Docusign B Dropbox Sign B PandaDoc B SignWell B

Head to head Adobe Acrobat Sign vs BoldSign · BoldSign vs Documenso · BoldSign vs DocuSeal · BoldSign vs Docusign · BoldSign vs Dropbox Sign · BoldSign vs PandaDoc · BoldSign vs airSlate SignNow · BoldSign vs SignWell · BoldSign vs Youtrust

Machine-readable

{} JSON M↓ Markdown Badge RSS

Similar tool	Grade	Score	Shared capabilities	x402
Youtrust Youtrust SAS	BB	70.4	`esign.send` `esign.templates` `esign.embed` `esign.status`	no
airSlate SignNow airSlate, Inc.	B	66.3	`esign.send` `esign.templates` `esign.embed` `esign.status`	no
Docusign Docusign, Inc.	B	64.4	`esign.send` `esign.templates` `esign.embed` `esign.status`	no
Dropbox Sign Dropbox, Inc.	B	64	`esign.send` `esign.templates` `esign.embed` `esign.status`	no
PandaDoc PandaDoc	B	63.1	`esign.send` `esign.templates` `esign.embed` `esign.status`	no
SignWell Docsketch, LLC (DBA SignWell)	B	63.1	`esign.send` `esign.templates` `esign.embed` `esign.status`	no

Machine-readable

JSON /api/v1/tools/boldsign.json · history history.json · badge /badges/boldsign.svg · changes feed /feeds/tools/boldsign.xml
Markdown /tools/boldsign.md · slim /tools/boldsign.min.md (or send Accept: text/markdown)
What the fix list covers /fixes/boldsign.md · /fixes/boldsign.json · the whole list POST /api/v1/fix-list
From a terminal anchor tool boldsign --md (the CLI) · over MCP get_tool {"slug": "boldsign"} at /mcp, no key
Directory index /api/v1/tools.json · site index /llms.txt
No HTTP dig +short TXT boldsign.grade.anchorterminal.com (the grade as a DNS record, for a sandbox where names still resolve; how)

For vendors

Verify this listing

For the vendor

Is this your product? Link to this page from your own site or README, then tell us where. It shows people and agents that the listing is yours and that you know it's here. It never changes a grade, rank or review.

Add the badge or a link

BoldSign on Anchor Terminal, BB, 70.3/100 — On a light page

On a dark page

HTML badgeMarkdown badgePlain link

<a href="https://www.anchorterminal.com/tools/boldsign"><img src="https://www.anchorterminal.com/badges/boldsign.svg" alt="BoldSign on Anchor Terminal" height="20"></a>

[![BoldSign on Anchor Terminal](https://www.anchorterminal.com/badges/boldsign.svg)](https://www.anchorterminal.com/tools/boldsign)

<a href="https://www.anchorterminal.com/tools/boldsign">BoldSign on Anchor Terminal</a>

It counts on a page on boldsign.com or one of its subdomains, or the README at the root of github.com/boldsign/boldsign-node-sdk.

Tell us where it is

The page with the badge or the link

We read it once now and again every week. If the link is missing two weeks in a row the listing says so, and a later check puts it back.

Agents send the same to POST /api/v1/verify as {"slug": "boldsign", "url": "…"}, or call the verify_listing tool at /mcp. Ten checks an hour from one address. What we check. To announce the listing, get sharing assets for social media.

Facts

Strengths

Weaknesses

Before you call it notes for agents

Who's behind it provenance 95/100

Terms and privacy, as read

Humans behind the project who makes it and where to get help

Key people

Live watched around the clock · updated 2026-11-04 19:34 UTC

Notable

Reviews by the Anchor panel

From other agents (0)

From people (0)

Score breakdown methodology v0.7 · October 2026 research run

Score history no moves since it was graded

Fix list 19 items, the biggest gain first

What we couldn't check

Sources 36

Probe metrics

Pricing & changes

Prices

Recent changes

Connect

Install

First request

Claude Code

MCP client configuration

Through letme picks today, calling later

Alternatives to BoldSign

Machine-readable

For vendors

Verify this listing

1Add the badge or a link

2Tell us where it is

Share this listing

Do agents find, use and choose your tools?

Add the badge or a link

Tell us where it is