# BoldSign (slim)

> BoldSign is Syncfusion's electronic signature service. Its REST API sends documents for signature from files or templates, embeds signing and requesting in other products, manages templates, users and teams, and reports events by webhook, with a hosted MCP server.

- Full: https://www.anchorterminal.com/tools/boldsign.md (~10,150 tokens) · this version ~2,530 tokens · JSON https://www.anchorterminal.com/tools/boldsign.json · canonical https://www.anchorterminal.com/tools/boldsign
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-04 · pricing https://www.anchorterminal.com/tools/boldsign#pricing · reviews https://www.anchorterminal.com/tools/boldsign#reviews
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

**BB · 70.3/100 · rank #190 of 1349 · #2 in Contracts, proposals & e-signatures · agent-ready · confidence medium**


Assessment: A public OpenAPI file, llms.txt, 20 OAuth scopes, published rate limits, a free sandbox and a clean 90-day status history. API keys carry every scope, there are no idempotency keys, the 2,000-an-hour account limit is low for bulk work, and the hosted MCP server's 14 tools include sending and revoking with no confirmation step of their own.

## Facts

- Kind: HTTP API · vendor: Syncfusion, Inc. · category: Contracts, proposals & e-signatures · legal entity: Syncfusion, Inc. · provenance 95/100
- Endpoint: `https://api.boldsign.com/v1` (HTTP, Streamable HTTP)
- Auth: OAuth or key · pricing: Freemium · x402: no · licence: Proprietary hosted service under the BoldSign Terms of Use. The five official SDKs and the deprecated local MCP package on GitHub are MIT
- Probe metrics: not measured yet (probes haven't run)
- Surface listed: The REST API v1 at api.boldsign.com and its regional twins, read from developers.boldsign.com, the Swagger file, boldsign.com, status.boldsign.com and the boldsign GitHub organisation on 3 November 2026, with the hosted MCP server as a second surface. No account was made and no call was sent
- API: OpenAPI 3.0.4, 87 operations. Documents: send, draft send, send from template, list, team list, behalf list, properties, download, download audit log, revoke, delete, remind, extend expiry, change recipient, prefill fields, embedded request, edit, clone and sign links, tags, authentication. Templates, contacts, group contacts, custom fields, branding, identity verification, sender identities, teams, users and plan
- Regions: api.boldsign.com (US), api-eu.boldsign.com, api-ca.boldsign.com and api-au.boldsign.com, each with v1 and v1-beta paths and a Swagger UI. Hosted on Google Cloud and Microsoft Azure in US East, EU, Canada and Australia
- Credentials: API key in X-API-KEY, all scopes, optional expiry, at most four per account and two per environment, deleted to revoke. OAuth 2.0 at account.boldsign.com/connect with authorisation code and PKCE (S256), client credentials, implicit, and refresh tokens that are single-use and last 30 days in absolute or sliding mode. Access tokens last one hour
- OAuth scopes: 20. Documents All, Write, Delete, Create; Templates All, Read, Write, Delete, Create; Users All, Read, Write; Teams All, Read, Write; SenderIdentity All, Create, Read, Write, Delete; plus offline_access. No Documents.Read scope
- MCP server: Hosted, Streamable HTTP, at mcp.boldsign.com/mcp, mcp-eu, mcp-ca and mcp-au. 14 tools: list_documents, list_team_documents, get_document_properties, send_reminder_for_document_sign, revoke_document, list_templates, get_template_properties, send_document_from_template, list_contacts, get_contact, list_users, get_user, list_teams, get_team. X-API-Key or OAuth. Live use needs the Enterprise API plan. A second server at developers-mcp.boldsign.com/mcp answers documentation questions without a key
- Rate limits: 2,000 requests an hour per account in production, 50 an hour in the sandbox, shared by keys and OAuth apps. 429 on excess with usage in response headers. Higher limits by arrangement with support
- Errors: 400, 401, 402, 403, 404, 417 and 422 documented with causes and fixes on the troubleshooting page. The Swagger file documents 401 on every operation and 403, 422 and 400 on many. 401 also means a region mismatch
- Pagination: Page and PageSize on list calls (documents, templates, contacts, users, teams), with search, status, date and label filters on document lists
- Webhooks: Account-level and app-level (per OAuth app). HMAC-SHA256 signature in X-BoldSign-Signature with a per-endpoint secret, retries for 8 hours, test events, custom headers, IP allowlisting, event metadata with id, type and environment
- Embedding: Embedded signing links, embedded request creation, embedded edit and clone URLs for documents and templates, and embedded custom field creation
- Sandbox: Free developer sandbox account with full API access. Documents are watermarked and deleted after 14 days. Separate credentials from live
- SDKs: .NET (NuGet), Node.js (npm `boldsign` 3.3.4, August 2026), Python (PyPI), Java (Maven) and PHP (Packagist), MIT, maintained by the BoldSign team. Node 12, Python 3.7, PHP 7.4 and Java 1.8 or later
- Signed output: Download document, attachments and audit log by API. The signed PDF and audit trail are digitally signed with an Adobe AATL certificate with long-term validation. Signed documents and audit trails are kept at least three years per the terms
- Certifications: SOC 2 Type 2 per the security page, GDPR, ESIGN and eIDAS compliance claims, HIPAA on annual plans after a BAA. security.txt at boldsign.com with security@boldsign.com, expiring 18 August 2027
- Status: status.boldsign.com on Atlassian Statuspage with Web App and API components for Global, Europe, Canada and Australia, and Docs. Four one-hour scheduled maintenances between 19 and 27 September 2026, no incident since 21 July 2026
- Legal entity: Syncfusion, Inc., a Delaware corporation with its offices in Morrisville, North Carolina, per the Terms of Use (effective February 2025) and the privacy policy (effective July 2026)
- Prices: Enterprise API plan $30 per month (plan); Additional envelope, Enterprise API $0.75 per transaction; Bulk send or bulk link envelope $0.25 per transaction; SMS envelope $0.20 per message; ID verification $2 per transaction

- Scores: Reliability 84, Performance pending, Schema & documentation 85, Agent ergonomics 62, Security & auth 63, Payments & pricing 40, Task success pending, Maintenance & community 78, Transparency & trust 77 · total over the 7 assessed categories
- Why: Reliability, Read with the hosted lines and scored on the REST API v1, the surface the SDKs and the hosted MCP server call. · Schema & documentation, A public Swagger file, OpenAPI 3.0.4, at api.boldsign.com/swagger/v1/swagger.json with 87 operations and two security schemes, X-API-KEY and… · Agent ergonomics, List calls take Page and PageSize and document properties return the full object; no field selection was found. · Security & auth, OAuth 2.0 with authorisation code and PKCE S256, client credentials, implicit, and single-use refresh tokens that last 30 days, with 20 scop… · Payments & pricing, Read with the hosted rubric. · Maintenance & community, Read as a closed service. · Transparency & trust, Closed service under Terms of Use effective February 2025 that name Syncfusion, Inc.
- Sources: 36, open questions: 10, both in the full twin
- Capabilities: esign.send, esign.templates, esign.embed, esign.status
- JSON: https://www.anchorterminal.com/api/v1/tools/boldsign.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/boldsign.svg` or a link to https://www.anchorterminal.com/tools/boldsign from a page on boldsign.com or one of its subdomains, or the README at the root of github.com/boldsign/boldsign-node-sdk, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.
- Support: support@boldsign.com; https://support.boldsign.com/; https://developers.boldsign.com/; more in the full twin

## Before you call it

1. Send `X-API-KEY: $BOLDSIGN_API_KEY` to the regional base URL (api.boldsign.com, api-eu, api-ca or api-au); a key from one region fails on another, and the MCP endpoint must match too
2. Build against a Sandbox key first. Sandbox documents are watermarked and deleted after 14 days, and the sandbox allows only 50 requests an hour
3. Stay under 2,000 requests an hour per account in production and use webhooks instead of polling `document/properties`; on a 429 wait for the window to reset
4. Don't retry a timed-out `document/send` blindly. There is no idempotency key, so list documents by title or search before sending again
5. Verify `X-BoldSign-Signature` (HMAC-SHA256 with the endpoint secret) on every webhook before acting on its payload
6. On the MCP server, start with `list_templates` and `get_document_properties`, and confirm with the person before `send_document_from_template`, `send_reminder_for_document_sign` or `revoke_document`

## Connect

```bash
npm install boldsign
```

```bash
curl -H "X-API-KEY: $BOLDSIGN_API_KEY" "https://api.boldsign.com/v1/document/list?Page=1&PageSize=10"
```

```bash
claude mcp add boldsign --transport http https://mcp.boldsign.com/mcp --header "X-API-Key: $BOLDSIGN_API_KEY"
```
Full config and headless snippets are in the full page. Through letme (picks today, calling later): https://letme.dev/boldsign

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| Youtrust | BB | 70.4 | esign.send, esign.templates, esign.embed, esign.status | https://www.anchorterminal.com/tools/youtrust.min.md |
| airSlate SignNow | B | 66.3 | esign.send, esign.templates, esign.embed, esign.status | https://www.anchorterminal.com/tools/signnow.min.md |
| Docusign | B | 64.4 | esign.send, esign.templates, esign.embed, esign.status | https://www.anchorterminal.com/tools/docusign.min.md |
| Dropbox Sign | B | 64 | esign.send, esign.templates, esign.embed, esign.status | https://www.anchorterminal.com/tools/dropbox-sign.min.md |
| PandaDoc | B | 63.1 | esign.send, esign.templates, esign.embed, esign.status | https://www.anchorterminal.com/tools/pandadoc.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)