# BoldSign > BoldSign is Syncfusion's electronic signature service. Its REST API sends documents for signature from files or templates, embeds signing and requesting in other products, manages templates, users and teams, and reports events by webhook, with a hosted MCP server. - Canonical: https://www.anchorterminal.com/tools/boldsign - Pricing: https://www.anchorterminal.com/tools/boldsign#pricing - Reviews: https://www.anchorterminal.com/tools/boldsign#reviews - Markdown: https://www.anchorterminal.com/tools/boldsign.md (~10,150 tokens) - Slim: https://www.anchorterminal.com/tools/boldsign.min.md (~2,530 tokens, same facts, less prose, for token-sensitive contexts) - JSON: https://www.anchorterminal.com/tools/boldsign.json (this page as data, same URL with Accept: application/json) - Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key) - DNS: dig +short TXT boldsign.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.. and .vs.. under the zone, and the same under grade.letme.dev) - Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data) - Updated: 2026-11-04 ## Overview **Grade BB · 70.3/100 · rank #190 of 1349 · #2 in Contracts, proposals & e-signatures · agent-ready · confidence medium** ## Assessment A public OpenAPI file, llms.txt, 20 OAuth scopes, published rate limits, a free sandbox and a clean 90-day status history. API keys carry every scope, there are no idempotency keys, the 2,000-an-hour account limit is low for bulk work, and the hosted MCP server's 14 tools include sending and revoking with no confirmation step of their own. ## Facts | Field | Value | | --- | --- | | Vendor | Syncfusion, Inc. (https://boldsign.com) | | Kind | HTTP API | | Category | Contracts, proposals & e-signatures (https://www.anchorterminal.com/categories/e-signatures) | | Transport | HTTP, Streamable HTTP | | Endpoint | `https://api.boldsign.com/v1` | | Auth | OAuth or key · An API key in the X-API-KEY header, generated in the web app under API, API Key, with all scopes and an optional expiry date, at most four keys per account and two per environment (Live or Sandbox). Or OAuth 2.0 at account.boldsign.com with authorisation code and PKCE, client credentials and refresh tokens, and 20 scopes such as BoldSign.Documents.Create and BoldSign.Templates.Read. The hosted MCP server takes the same key as X-API-Key or OAuth sign-in from Claude Web and ChatGPT. Keys are self-serve; live API access needs the Enterprise API plan. | | Pricing | Freemium ($30 / mo) · The free sandbox gives full API access with no card. Documents are watermarked and deleted after 14 days. Live API access is the Enterprise API plan from $30 a month with 40 envelopes and $0.75 per additional envelope, with a 30-day trial and no card. Add-ons are priced per unit (bulk send $0.25 an envelope, SMS $0.20, ID verification $2, KBA $1.50 an attempt, QES $3 a signing attempt). Live MCP use needs the Enterprise API plan at the normal envelope charge (https://boldsign.com/electronic-signature-pricing/, checked 2026-11-03). | | x402 | No · No x402, MPP or L402 in the docs, the Swagger file, the pricing page or the MCP docs (checked 2026-11-03). Plans are paid by card through Stripe in the web app. | | Licence | Proprietary hosted service under the BoldSign Terms of Use. The five official SDKs and the deprecated local MCP package on GitHub are MIT | | Tools exposed | 14 | | Packages | npm: `boldsign`; pypi: `boldsign`; nuget: `BoldSign.Api` | | Source | https://github.com/boldsign/boldsign-node-sdk | | Docs | https://developers.boldsign.com/ | | llms.txt | https://developers.boldsign.com/llms.txt | | Last release | 2026-10-16 | | GitHub stars | 1 (as of 2026-11-03) | | Surface listed | The REST API v1 at api.boldsign.com and its regional twins, read from developers.boldsign.com, the Swagger file, boldsign.com, status.boldsign.com and the boldsign GitHub organisation on 3 November 2026, with the hosted MCP server as a second surface. No account was made and no call was sent | | API | OpenAPI 3.0.4, 87 operations. Documents: send, draft send, send from template, list, team list, behalf list, properties, download, download audit log, revoke, delete, remind, extend expiry, change recipient, prefill fields, embedded request, edit, clone and sign links, tags, authentication. Templates, contacts, group contacts, custom fields, branding, identity verification, sender identities, teams, users and plan | | Regions | api.boldsign.com (US), api-eu.boldsign.com, api-ca.boldsign.com and api-au.boldsign.com, each with v1 and v1-beta paths and a Swagger UI. Hosted on Google Cloud and Microsoft Azure in US East, EU, Canada and Australia | | Credentials | API key in X-API-KEY, all scopes, optional expiry, at most four per account and two per environment, deleted to revoke. OAuth 2.0 at account.boldsign.com/connect with authorisation code and PKCE (S256), client credentials, implicit, and refresh tokens that are single-use and last 30 days in absolute or sliding mode. Access tokens last one hour | | OAuth scopes | 20. Documents All, Write, Delete, Create; Templates All, Read, Write, Delete, Create; Users All, Read, Write; Teams All, Read, Write; SenderIdentity All, Create, Read, Write, Delete; plus offline_access. No Documents.Read scope | | MCP server | Hosted, Streamable HTTP, at mcp.boldsign.com/mcp, mcp-eu, mcp-ca and mcp-au. 14 tools: list_documents, list_team_documents, get_document_properties, send_reminder_for_document_sign, revoke_document, list_templates, get_template_properties, send_document_from_template, list_contacts, get_contact, list_users, get_user, list_teams, get_team. X-API-Key or OAuth. Live use needs the Enterprise API plan. A second server at developers-mcp.boldsign.com/mcp answers documentation questions without a key | | Rate limits | 2,000 requests an hour per account in production, 50 an hour in the sandbox, shared by keys and OAuth apps. 429 on excess with usage in response headers. Higher limits by arrangement with support | | Errors | 400, 401, 402, 403, 404, 417 and 422 documented with causes and fixes on the troubleshooting page. The Swagger file documents 401 on every operation and 403, 422 and 400 on many. 401 also means a region mismatch | | Pagination | Page and PageSize on list calls (documents, templates, contacts, users, teams), with search, status, date and label filters on document lists | | Webhooks | Account-level and app-level (per OAuth app). HMAC-SHA256 signature in X-BoldSign-Signature with a per-endpoint secret, retries for 8 hours, test events, custom headers, IP allowlisting, event metadata with id, type and environment | | Embedding | Embedded signing links, embedded request creation, embedded edit and clone URLs for documents and templates, and embedded custom field creation | | Sandbox | Free developer sandbox account with full API access. Documents are watermarked and deleted after 14 days. Separate credentials from live | | SDKs | .NET (NuGet), Node.js (npm `boldsign` 3.3.4, August 2026), Python (PyPI), Java (Maven) and PHP (Packagist), MIT, maintained by the BoldSign team. Node 12, Python 3.7, PHP 7.4 and Java 1.8 or later | | Signed output | Download document, attachments and audit log by API. The signed PDF and audit trail are digitally signed with an Adobe AATL certificate with long-term validation. Signed documents and audit trails are kept at least three years per the terms | | Certifications | SOC 2 Type 2 per the security page, GDPR, ESIGN and eIDAS compliance claims, HIPAA on annual plans after a BAA. security.txt at boldsign.com with security@boldsign.com, expiring 18 August 2027 | | Status | status.boldsign.com on Atlassian Statuspage with Web App and API components for Global, Europe, Canada and Australia, and Docs. Four one-hour scheduled maintenances between 19 and 27 September 2026, no incident since 21 July 2026 | | Legal entity | Syncfusion, Inc., a Delaware corporation with its offices in Morrisville, North Carolina, per the Terms of Use (effective February 2025) and the privacy policy (effective July 2026) | | Capabilities | esign.send, esign.templates, esign.embed, esign.status | | Tags | official, hosted, closed-source, api-key, oauth, openapi, llms-txt, mcp, remote-mcp, webhooks, sandbox, free-tier, freemium, eu-region, status-page, security-txt, soc2, python, typescript, dotnet, java, php | | JSON | https://www.anchorterminal.com/api/v1/tools/boldsign.json | ## Score breakdown (methodology v0.7, October 2026 research run) Assessed 2026-11-03 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. "This run" is each category's share of the 100 points. | Category | Weight | This run | Score (0–100) | Points | | --- | --- | --- | --- | --- | | Reliability | 16% | 20 | 84 | 16.8 | | Performance | 10% | pending | pending | n/a | | Schema & documentation | 13% | 16.2 | 85 | 13.8 | | Agent ergonomics | 13% | 16.2 | 62 | 10.1 | | Security & auth | 14% | 17.5 | 63 | 11.0 | | Payments & pricing | 10% | 12.5 | 40 | 5.0 | | Task success | 10% | pending | pending | n/a | | Maintenance & community | 7% | 8.8 | 78 | 6.8 | | Transparency & trust (editorial 59, provenance 95) | 7% | 8.8 | 77 | 6.7 | | Negative events | up to −15 | up to −15 | none recorded | 0 | | **Total** | | | | **70.3 → BB** | ### Why each score - Reliability 84 (checked 2026-11-03): Read with the hosted lines and scored on the REST API v1, the surface the SDKs and the hosted MCP server call. status.boldsign.com on Atlassian Statuspage has Web App and API components for Global, Europe, Canada and Australia plus Docs, with 90-day uptime and an incident history (20). The history feed, read on 3 November 2026, lists four one-hour scheduled maintenances between 19 and 27 September and no incident after a 20-minute partial disruption on 21 July 2026, so the 90 days from 5 August are clean (30). Rate limits are published per account, 2,000 requests an hour live and 50 an hour in the sandbox (15). The rate-limit page says 429 is returned with messages and usage is tracked in response headers, and the guide recommends webhooks over polling. No Retry-After is documented and there are no idempotency keys (6 of 15). No SLA document was found. security.txt advertises a 99.999 per cent uptime SLA, the terms disclaim uninterrupted service and refer to a support SLA available on request (3 of 10). v1 is the stable version with beta endpoints under v1-beta (10). 20 + 30 + 15 + 6 + 3 + 10 = 84. - Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes. - Schema & documentation 85 (checked 2026-11-03): A public Swagger file, OpenAPI 3.0.4, at api.boldsign.com/swagger/v1/swagger.json with 87 operations and two security schemes, X-API-KEY and Bearer, which the docs say generated the C# SDK (25). developers.boldsign.com serves llms.txt and a Markdown twin of every page (10). Every operation has a summary, but 64 of 87 are under 40 characters in the file, and the purpose and conditions of each call sit in the docs pages instead. The MCP docs say which tools read and which act (12 of 20). 186 enums and required fields in the schemas, with page and pageSize on lists (12 of 15). The Swagger file carries no examples. The docs pages carry curl and five SDK examples per call, and the troubleshooting page documents 400, 401, 402, 403, 404, 417 and 422 with causes and fixes, while the file documents 401 everywhere and 403, 422 and 400 on many operations (11 of 15). v1 in the path with v1-beta for previews, and a changelog dated from 20 April 2021 to 16 October 2026 that labels breaking changes (15). 25 + 10 + 12 + 12 + 11 + 15 = 85. - Agent ergonomics 62 (checked 2026-11-03): List calls take Page and PageSize and document properties return the full object; no field selection was found. The hosted MCP server has 14 compact tools, but the REST API is the graded surface (14 of 25). Page and PageSize on document, template, contact, user and team lists, with search, status, date, label and team filters on documents (16 of 20). The troubleshooting page gives a cause and a fix per status code, 401 covers a region mismatch, and 422 carries validation detail (14 of 20). No idempotency keys. Draft send and the sandbox make trial calls safe, and the MCP docs ask for a human confirmation before send, reminder and revoke, but the tools' annotations couldn't be read (5 of 20). A send needs files or a template, a title and signers with fields, and the SDKs cover .NET, Node, Python, Java and PHP (13 of 15). 14 + 16 + 14 + 5 + 13 = 62. - Security & auth 63 (checked 2026-11-03): OAuth 2.0 with authorisation code and PKCE S256, client credentials, implicit, and single-use refresh tokens that last 30 days, with 20 scopes split by resource and action. API keys carry every scope, which the docs say is not customisable, with an optional expiry, four per account and two per environment, deleted to revoke (28 of 30). OAuth apps can be limited to Templates, Users, Teams or SenderIdentity read scopes, though no Documents.Read scope exists, and the sandbox and draft send limit what a call does. The MCP docs recommend a human confirmation before send, reminder and revoke, and the API has no approval step (10 of 20). Signer names, field values and uploaded documents come back through the API, and no guidance on untrusted content was found (3 of 15). Each document has an audit log with user, IP address and timestamp, downloadable by API, and a document history API. No log of API calls or key use was found (8 of 15). security.txt is valid with security@boldsign.com and a policy link, SOC 2 Type 2 per the security page, HMAC-SHA256 signed webhooks with IP allowlisting, third-party code reviews and penetration tests. No bug bounty was found, and the responsible disclosure page is disallowed by robots.txt so it was not read (14 of 20). 28 + 10 + 3 + 8 + 14 = 63. - Payments & pricing 40 (checked 2026-11-03): Read with the hosted rubric. No x402, MPP or L402 (0). The Enterprise API plan is public at $30 a month with 40 envelopes and $0.75 per additional envelope, and add-ons are priced per unit (20). The free sandbox gives full API access with no credit card, and the 30-day trial also needs no card per the pricing page (20). A person signs up in a browser and mints the key or registers the OAuth app in the web app (0). 0 + 20 + 20 + 0 = 40. - Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored. - Maintenance & community 78 (checked 2026-11-03): Read as a closed service. The API changelog's newest entry is 16 October 2026, and the PHP SDK repository was pushed the same day, Java and Python on 13 October (30). Changelog entries on 13 August, 19 August, 7 September, 23 September, 8 October and 16 October 2026 (20). Support site, knowledge base and support@boldsign.com, with a public changelog. GitHub issues on the SDK repositories were not read (8 of 15). Five official SDKs, Node at 3.3.4 since August 2026. The hosted MCP server is not in the official MCP registry (15). The Node SDK clone shows no CI workflow and the deprecated MCP package stopped at 0.0.5 (5 of 10). 30 + 20 + 8 + 15 + 5 = 78. - Transparency & trust 77 (checked 2026-11-03): Closed service under Terms of Use effective February 2025 that name Syncfusion, Inc. and North Carolina law. The SDKs and the deprecated MCP package are MIT (17 of 30). The privacy policy (July 2026) keeps personal data as long as necessary with no number, the terms keep signed documents and audit trails at least three years and schedule inactive accounts for deletion after six months, sandbox documents go after 14 days, and the terms say customer data is used for nothing but performing the agreement. A subprocessor list is linked and no DPA was found on the pages read (20 of 30). No deprecation policy. The terms let Syncfusion modify or discontinue BoldSign at its discretion, and the changelog labels breaking changes without a notice period (6 of 20). The privacy policy links the subprocessor list, and the security page names Google Cloud and Azure regions in US East, the EU, Canada and Australia (16 of 20). 17 + 20 + 6 + 16 = 59. Fix list, everything this grade says the listing lacks, the biggest gain first (19 items). What it covers is at https://www.anchorterminal.com/fixes/boldsign.md (JSON https://www.anchorterminal.com/fixes/boldsign.json). The whole list for a coding agent comes from `POST https://www.anchorterminal.com/api/v1/fix-list` with `{"listing": "boldsign", "plan": "read"}`, free while the beta runs ### What we couldn't check - unchecked: the hosted MCP server's tools/list, input schemas and annotations, which need a key. The 14 tools are from the docs page; the deprecated npm package's source has the same 14 with Zod schemas - unchecked: the exact rate-limit header names. The rate-limit page shows them in an image, and Syncfusion's blog and knowledge base spell them differently - unchecked: the responsible disclosure page at boldsign.com/responsible-disclosure/, which robots.txt disallows, and the Security Management Report PDF - unchecked: whether a DPA is published. None was linked from the terms, privacy or security pages read - unchecked: GitHub issues and CI on the SDK repositories, and npm, PyPI, NuGet, Maven and Packagist release dates and downloads. SDK versions come from the repositories - unchecked: the uptime history behind the 99.999 per cent SLA claim in security.txt. No SLA text was found, and the terms refer to a support SLA sent on request - The audit's lead named the official API. The hosted MCP server is documented at developers.boldsign.com and graded as a second surface; it is not in the official MCP registry - The developer site's HTML registers search_docs and another in-page tool through navigator.modelContext, and boldsign.com's footer links chat assistants with a prepared prompt asking what makes BoldSign a strong choice. Recorded as facts; neither was acted on - firstReleased is 20 April 2021, the earliest entry in the API changelog. The domain was registered in December 2013 - The terms forbid robots, scrapers or other automated access other than through the API, and forbid using the product to train AI models. Recorded as facts; the public pages were read under robots.txt, which allows them ### Sources - Swagger file, 87 operations: (seen 2026-11-03) - developer hub home: (seen 2026-11-03) - llms.txt: (seen 2026-11-03) - getting started: (seen 2026-11-03) - API key authentication: (seen 2026-11-03) - OAuth 2.0: (seen 2026-11-03) - authentication introduction, scopes, rate limits: (seen 2026-11-03) - rate limit: (seen 2026-11-03) - managing rate limits guide: (seen 2026-11-03) - versioning: (seen 2026-11-03) - Open API specification page: (seen 2026-11-03) - client libraries: (seen 2026-11-03) - API explorer: (seen 2026-11-03) - developer sandbox account: (seen 2026-11-03) - possible errors and solutions: (seen 2026-11-03) - API changelog: (seen 2026-11-03) - webhooks introduction: (seen 2026-11-03) - verify webhook events: (seen 2026-11-03) - hosted MCP server overview: (seen 2026-11-03) - hosted MCP server authentication: (seen 2026-11-03) - hosted MCP server, Claude Code setup: (seen 2026-11-03) - deprecated local MCP package, cloned: (seen 2026-11-03) - Node SDK, cloned, 3.3.4: (seen 2026-11-03) - GitHub organisation repositories: (seen 2026-11-03) - pricing: (seen 2026-11-03) - SDK page: (seen 2026-11-03) - security page: (seen 2026-11-03) - security policy page: (seen 2026-11-03) - security.txt: (seen 2026-11-03) - terms of use: (seen 2026-11-03) - privacy policy: (seen 2026-11-03) - status page: (seen 2026-11-03) - status history feed: (seen 2026-11-03) - robots.txt: (seen 2026-11-03) - official MCP registry search: (seen 2026-11-03) - RDAP record: (seen 2026-11-03) ## Score history Every move of a score since the listing was graded, newest first, with its cause. A score can't move without an entry here. JSON: https://www.anchorterminal.com/api/v1/tools/boldsign/history.json - 2026-11-03: graded 70.3 BB (methodology 0.7) ## Who's behind it (provenance 95/100, checked 2026-11-03) | Check | Finding | Points | | --- | --- | --- | | Legal entity named | Syncfusion, Inc. | 20/20 | | Domain age | boldsign.com, registered 2013-12-20 (12 years) | 15/15 | | Endpoint on the vendor's domain | api.boldsign.com | 15/15 | | Terms of service | read, states 6 of the 7 things a reader expects, and has 2 clauses that cost points | 5.1/10 | | Privacy policy | read, states 8 of the 8 things a reader expects | 10/10 | | Status page | status.boldsign.com | 10/10 | | Changelog | published | 10/10 | | security.txt | valid | 10/10 | | People named | 2 named with their role, none with a public profile | 7/10 | | Support route | a support address, help pages, a community | 5/5 | The Terms of Use (effective February 2025) name Syncfusion, Inc., a Delaware corporation in Morrisville, North Carolina, under North Carolina law with AAA arbitration in Raleigh. The privacy policy (effective July 2026) is Syncfusion-wide and covers BoldSign, BoldDesk, Bold BI and Bold Reports. The terms forbid robots, spiders, scrapers or other automated means to access or monitor BoldSign other than the Syncfusion-provided API, and forbid using the product to train or improve machine learning or AI algorithms. Recorded as a fact. boldsign.com/robots.txt disallows /responsible-disclosure/ and cdn-cgi paths with a crawl delay of 1 second and Content-Signal ai-train=yes, search=yes, ai-input=yes, so the responsible disclosure page was not read. developers.boldsign.com/robots.txt disallows /moreresults and /search. status.boldsign.com disallows /api/ and /embed/. boldsign.com/.well-known/security.txt is valid until 18 August 2027 with security@boldsign.com and a policy link to boldsign.com/security-policy/. Its comments claim SOC 2 Type 2, GDPR and a 99.999 per cent uptime SLA. The API answers on api.boldsign.com and regional subdomains, OAuth on account.boldsign.com and MCP on mcp.boldsign.com, all vendor subdomains. RDAP gives boldsign.com a registration date of 20 December 2013. ### Terms and privacy, as read A reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice. **Terms of service** (https://boldsign.com/terms-of-use/), read 2026-11-03, dated 2025-02-01, states 6 of the 7 things a reader expects. - To know. Restricts automated access (costs points). "Customer acknowledges and agrees that Customer, or anyone acting on behalf of the Customer, may not use robots, spiders, scrapers, or other automated means other than the Syncfusion provided API to access or monitor BoldSign for any purpose." - To know. Restricts benchmarking or competitive use (costs points). "You may not access and use the Licensed Product if You are a competitor of Syncfusion or BoldSign." - To know. Says access can be ended without notice or for any reason. "Licenses may be immediately terminated for Material Breach and Syncfusion is not required to give any notice to terminate licenses in the event of a Material Breach." - To know. Requires arbitration or waives class actions. "IMPORTANT NOTICE: THESE TERMS OF USE CONTAIN A BINDING ARBITRATION PROVISION AND WAIVER OF JURY TRIALS AND CLASS ACTIONS GOVERNING DISPUTES ARISING FROM USE OF THE LICENSED PRODUCT, INCLUDING THE BOLDSIGN WEBSITE AND MAINTENANCE AND SUPPORT SERVICES RELATED TO THE LICENSED PRODUCT." - Gives the date it was last updated. Last updated 2025-02-01. - Names the governing law or courts. The law of the State of North Carolina. - States a limit on its liability. Rules out indirect and consequential losses, with no cap named in this sentence. - Not found in the text. Says how changes to the terms are announced. - Also in the text (2026-11-03). Liability for any claim is capped at 1,000 US dollars, including legal fees and settlements. "Syncfusion is not required to spend more than One Thousand U.S. Dollars ($1,000.00 USD) including without limitation on attorneys’ fees, court costs, settlements, judgments, and reimbursement of costs." - Also in the text (2026-11-03). Using the product to train or improve machine learning models, or including it in an AI training dataset, is a material breach of the licence. "Any usage of the Licensed Product in an AI-training dataset is considered a Material Breach of this License." - Also in the text (2026-11-03). Access to stored documents ends when the web app or API subscription terminates, and the customer must download them beforehand. "Upon termination of the WebApp service and/or eSignature API, Customer will no longer have access to any documents stored or processed using the Licensed Product." **Privacy policy** (https://boldsign.com/privacy-policy/), read 2026-11-03, dated 2026-07-01, states 8 of the 8 things a reader expects. - To know. Says it sells personal data or shares it for advertising. "In addition to the above, we may share limited information with Google Ads to perform ad measurement services on your behalf and we obtain consent for such sharing and use where legally required." - Gives the date it was last updated. Last updated 2026-07-01. - Says how long data is kept. For as long as needed, with no period named. - Gives a privacy contact. privacy@syncfusion.com. - Says where data is transferred or stored. Relies on standard contractual clauses. - Also in the text (2026-11-03). Device and browser details are processed by a third party fingerprinting service for fraud detection whenever the services are accessed. "We use Fingerprint Identification, a device identification and fraud‑prevention service operated by FingerprintJS, Inc., to help us maintain the security and integrity of our services." ## Humans behind the project (researched 2026-11-03 from public pages, not part of the grade) ### Key people - Daniel Jebaraj, Co-founder and CEO, Syncfusion - Stefan Hoenig, Co-founder, Chairman of the Board and President, Syncfusion - Note: BoldSign is a product of Syncfusion, Inc., founded in 2001 in Research Triangle Park, North Carolina. The Syncfusion about page (read 3 November 2026) lists Stefan Hoenig as Chairman of the Board and President and Daniel Jebaraj as CEO; the 17 March 2020 press release calls Hoenig cofounder, and the Syncfusion blog author page calls Jebaraj one of the founders. No BoldSign page names a product lead, so the people are the company's. Investors were looked for on the BoldSign about and press pages, the Syncfusion about page and the Bold Reports about page, which says Syncfusion has been self-funded since day one; no funding round or investor was found. - Syncfusion, Inc.: LinkedIn https://www.linkedin.com/showcase/bold-sign-app X https://x.com/BoldSignApp GitHub https://github.com/boldsign ### Getting support - Support email: support@boldsign.com - Help: https://support.boldsign.com/ - Help: https://developers.boldsign.com/ - Community (BoldSign GitHub): https://github.com/boldsign - Sources: https://boldsign.com/about-us/, https://www.syncfusion.com/company/about-us, https://www.syncfusion.com/blogs/author/danielj, https://boldsign.com/press-releases/syncfusion-elevates-daniel-jebaraj-to-ceo-as-company-continues-growth-trajectory/, https://www.boldreports.com/about-us/, https://boldsign.com/terms-of-use/, https://boldsign.com/.well-known/security.txt, https://developers.boldsign.com/api-overview/developer-sandbox-account.md ## Live (updated 2026-11-04 20:04 UTC) - Right now: down, HTTP 500, 175 ms, checked 2026-11-04 20:04 UTC (get on `https://api.boldsign.com/v1`) - Uptime 24h 0.0% (48 probes) · 30 days 0.0% (48 probes) · p50 n/a · p95 n/a - Vendor status page: none, All Systems Operational - npm `boldsign` 3.3.4 - pypi `boldsign` 3.3.4, released 2026-10-16 - security.txt: valid, expires 2027-08-18T00:00:00Z - Always current: https://www.anchorterminal.com/api/v1/live/boldsign.json ## Probe metrics Not measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score. ## Prices | Item | Price | Unit | Note | | --- | --- | --- | --- | | Enterprise API plan | $30 | per month (plan) | starting price with 40 envelopes and two application users | | Additional envelope, Enterprise API | $0.75 | per transaction | one envelope can hold several files, signers and CCs | | Bulk send or bulk link envelope | $0.25 | per transaction | | | SMS envelope | $0.20 | per message | WhatsApp $0.10 a message | | ID verification | $2 | per transaction | KBA $1.50 an attempt, QES $3 a signing attempt | Across all listings: https://www.anchorterminal.com/prices/index.md ## Strengths - OpenAPI 3.0.4 file with 87 operations, llms.txt and a Markdown twin of every docs page - OAuth 2.0 with authorisation code and PKCE, client credentials, single-use refresh tokens and 20 scopes split by resource and action - Rate limits published per account, 2,000 requests an hour live and 50 in the sandbox, with usage headers - Free sandbox with full API access and no card, and live API from $30 a month with $0.75 per extra envelope - No incident on status.boldsign.com between 5 August and 3 November 2026, with components per region - Dated API changelog since April 2021 with breaking changes labelled, and five official SDKs updated in August to October 2026 ## Weaknesses - API keys carry every scope and the docs say that is not customisable; only OAuth apps get narrower scopes, and there is no Documents.Read scope - No idempotency keys, and no Retry-After documented for the 429 - 64 of the 87 operation descriptions in the Swagger file are under 40 characters, and the file carries no examples - The hosted MCP server's tool schemas are not published, it sends, reminds and revokes with no built-in confirmation, and it is not in the official MCP registry - No SLA document was found. security.txt advertises a 99.999 per cent uptime SLA and the terms disclaim uninterrupted service ## Before you call it (notes for agents) 1. Send `X-API-KEY: $BOLDSIGN_API_KEY` to the regional base URL (api.boldsign.com, api-eu, api-ca or api-au); a key from one region fails on another, and the MCP endpoint must match too 2. Build against a Sandbox key first. Sandbox documents are watermarked and deleted after 14 days, and the sandbox allows only 50 requests an hour 3. Stay under 2,000 requests an hour per account in production and use webhooks instead of polling `document/properties`; on a 429 wait for the window to reset 4. Don't retry a timed-out `document/send` blindly. There is no idempotency key, so list documents by title or search before sending again 5. Verify `X-BoldSign-Signature` (HMAC-SHA256 with the endpoint secret) on every webhook before acting on its payload 6. On the MCP server, start with `list_templates` and `get_document_properties`, and confirm with the person before `send_document_from_template`, `send_reminder_for_document_sign` or `revoke_document` ## Connect Install: ```bash npm install boldsign ``` First request: ```bash curl -H "X-API-KEY: $BOLDSIGN_API_KEY" "https://api.boldsign.com/v1/document/list?Page=1&PageSize=10" ``` Claude Code: ```bash claude mcp add boldsign --transport http https://mcp.boldsign.com/mcp --header "X-API-Key: $BOLDSIGN_API_KEY" ``` MCP client configuration: ```json { "mcpServers": { "boldsign": { "headers": { "X-API-Key": "${BOLDSIGN_API_KEY}" }, "type": "http", "url": "https://mcp.boldsign.com/mcp" } } } ``` Through letme: https://letme.dev/boldsign. letme answers with the pick and how to call it direct. How it works: https://www.anchorterminal.com/letme/index.md ## Similar tools Ranked by shared capabilities, then score. Same-category tools with no shared capability key are listed last. | Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown | | --- | --- | --- | --- | --- | --- | --- | | Youtrust | BB | 70.4 | 183 | esign.send, esign.templates, esign.embed, esign.status | no | https://www.anchorterminal.com/tools/youtrust.md | | airSlate SignNow | B | 66.3 | 333 | esign.send, esign.templates, esign.embed, esign.status | no | https://www.anchorterminal.com/tools/signnow.md | | Docusign | B | 64.4 | 407 | esign.send, esign.templates, esign.embed, esign.status | no | https://www.anchorterminal.com/tools/docusign.md | | Dropbox Sign | B | 64 | 421 | esign.send, esign.templates, esign.embed, esign.status | no | https://www.anchorterminal.com/tools/dropbox-sign.md | | PandaDoc | B | 63.1 | 450 | esign.send, esign.templates, esign.embed, esign.status | no | https://www.anchorterminal.com/tools/pandadoc.md | | SignWell | B | 63.1 | 451 | esign.send, esign.templates, esign.embed, esign.status | no | https://www.anchorterminal.com/tools/signwell.md | ## Panel reviews (0) Reviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): . Desk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md ## Notable - The public Swagger file is OpenAPI 3.0.4 with 87 operations on documents, templates, contacts, group contacts, custom fields, branding, identity verification, sender identities, teams, users and plan, and two security schemes, X-API-KEY and Bearer (source: ) - Rate limits are per account, 2,000 requests an hour in production and 50 an hour in the sandbox, shared by API keys and OAuth, with 429 on excess and usage reported in response headers (source: ) - The hosted MCP server answers at mcp.boldsign.com/mcp (US), mcp-eu, mcp-ca and mcp-au with 14 tools, 11 reads and 3 writes (send from template, send reminder, revoke), by X-API-Key or OAuth. Requests from a browser are rejected. The local npm package @boldsign/mcp 0.0.5 is deprecated in its favour (source: ) - OAuth 2.0 has 20 scopes with Read, Write, Create, Delete and All per resource, authorisation code with PKCE, client credentials and single-use refresh tokens that last 30 days. API keys carry every scope, which the docs say is not customisable (source: ) - The API changelog is dated from 20 April 2021 to 16 October 2026 with breaking changes labelled, such as the Template Properties Files type change of 18 September 2025 (source: ) - status.boldsign.com on Atlassian Statuspage has Web App, API and Docs components per region and records no incident between 5 August and 3 November 2026, the last being a 20-minute partial disruption on 21 July 2026 (source: ) - Webhooks are signed with HMAC-SHA256 in X-BoldSign-Signature and retried for 8 hours (source: ) - The developer site's HTML registers two in-page tools through navigator.modelContext, and the boldsign.com footer links chat assistants with a prepared prompt about what makes BoldSign a strong choice. Recorded as facts; neither was acted on (source: ) - #2 of 10 in Best contract, proposal and e-signature APIs for AI agents: https://www.anchorterminal.com/best/e-signatures/index.md - All 45 e-signatures comparisons: https://www.anchorterminal.com/compare/e-signatures/index.md ## Compare - [Adobe Acrobat Sign vs BoldSign](https://www.anchorterminal.com/compare/adobe-acrobat-sign-vs-boldsign.md): D 52.7 vs BB 70.3 - [BoldSign vs Documenso](https://www.anchorterminal.com/compare/boldsign-vs-documenso.md): BB 70.3 vs C 59.8 - [BoldSign vs DocuSeal](https://www.anchorterminal.com/compare/boldsign-vs-docuseal.md): BB 70.3 vs B 62.5 - [BoldSign vs Docusign](https://www.anchorterminal.com/compare/boldsign-vs-docusign.md): BB 70.3 vs B 64.4 - [BoldSign vs Dropbox Sign](https://www.anchorterminal.com/compare/boldsign-vs-dropbox-sign.md): BB 70.3 vs B 64 - [BoldSign vs PandaDoc](https://www.anchorterminal.com/compare/boldsign-vs-pandadoc.md): BB 70.3 vs B 63.1 - [BoldSign vs airSlate SignNow](https://www.anchorterminal.com/compare/boldsign-vs-signnow.md): BB 70.3 vs B 66.3 - [BoldSign vs SignWell](https://www.anchorterminal.com/compare/boldsign-vs-signwell.md): BB 70.3 vs B 63.1 - [BoldSign vs Youtrust](https://www.anchorterminal.com/compare/boldsign-vs-youtrust.md): BB 70.3 vs BB 70.4 ## Verify this listing For the vendor. The badge or a plain link to this page verifies the listing, from a page on boldsign.com or one of its subdomains, or the README at the root of github.com/boldsign/boldsign-node-sdk. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{"slug": "boldsign", "url": "…"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify HTML badge: ```html BoldSign on Anchor Terminal ``` Markdown badge, for a README: ```markdown [![BoldSign on Anchor Terminal](https://www.anchorterminal.com/badges/boldsign.svg)](https://www.anchorterminal.com/tools/boldsign) ``` Plain link: ```html BoldSign on Anchor Terminal ``` ## Share this listing For the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say BoldSign is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score. - Dark: https://www.anchorterminal.com/assets/share/boldsign-dark.png - Light: https://www.anchorterminal.com/assets/share/boldsign-light.png --- Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp