Formify — AI Assisted E-Signing

Create a document and send it for electronic signature. Provide either templateId (from list_templates) or fileId (from upload_file) — not both. When using a template: call get_template to see signee slots and pre-configured signature settings, then get_template_fields for form fields. When using a file: call get_file_fields to discover form fields. Signature placement defaults to new_page unless explicitly configured via signatureBox. The document name is visible to signees and should be a clear, human-readable title, not the uploaded filename. If deriving it from a PDF filename, strip the file extension unless the user explicitly wants to keep it. BEFORE calling this tool, always ask the user: (1) invitation language, (2) optional personal message, (3) signature placement — only when using a file, not a template: new_page (default, recommended) or existing page with coordinates, (4) signature type — only if get_account_capabilities shows non-default types available and no template default applies; the choice only selects how the signer will verify on Formify's signing page, (5) AI assistant — only if get_account_capabilities confirms the aiAssistant capability. ALSO when using a file: ask the user whether they want a preview before sending. If yes, save the configuration as a draft via create_draft, share a one-time preview via get_draft_file_url, and send via send_draft after the user confirms — instead of calling create_document directly. Recommend a preview whenever signaturePlacement is 'existing' or when custom coordinates have been used.

Create a draft document without sending invitations. Provide EXACTLY ONE source: fileId (from upload_file) or templateId (from list_templates). Sending both, or neither, is an error. Using templateId is how you preview a template before sending it: the template's document and signature fields are copied into the draft, you review or adjust them, then send_draft. The template itself is never affected. Signee details, contact methods, signature type, and signature coordinates are optional while drafting. Full validation occurs only when send_draft is called. Call get_file_fields after upload_file if the PDF has form fields that should be pre-filled and saved in the draft. The draft name will become visible to signees when the draft is sent, so it should be a clear, human-readable title, not the uploaded filename. If deriving it from a PDF filename, strip the file extension unless the user explicitly wants to keep it. PREVIEW USE CASE: drafts are the recommended way to preview an uploaded document before sending. When the user wants to verify that signature fields, ID scan placeholders, or pre-filled values look correct, build the full configuration here, call get_draft_file_url to retrieve a one-time PDF preview, let the user verify (and adjust via update_draft if needed), then call send_draft to send.

Create a NEW reusable public signing link from a PDF already uploaded with upload_file. Nothing existing is changed or removed and Formify sends no invitations to anyone: the only effect is a new link in your account, live the moment this returns at a public URL that anyone on the internet who holds it can open and sign, until you call disable_link. Share the returned linkUrl yourself. With the AI assistant enabled the link starts as status processing with linkUrl null, and goes live once get_link reports status active. THIS COSTS CREDITS. On the credits pricing model every live link is a billed instance, charged pro rata for the rest of the current period and renewed each period while it stays active. ALWAYS confirm with the user before calling this. Insufficient credits returns 402 and creates nothing; a suspended subscription returns 403. Requires the publicLinksCreate capability. signeeDetails here describes SIGNATURE SLOTS, not people: there are no recipients, so no email, phone, delivery method or signing order. signatureBox is required for every slot placed on an existing page, because there is no template to inherit coordinates from. BEFORE calling, ask the user: (1) the language signers should see, (2) whether the AI assistant should be enabled — only if get_account_capabilities confirms aiAssistant, (3) confirmation that a billed link may be created.

Create a reusable template from a PDF already uploaded with upload_file. A template stores a document together with its signature fields, so a later create_document only has to supply the recipients. A template's signeeDetails describes ROLES, not people: fullName is normally a label such as 'Buyer', and contact details are optional — leave them out unless the same person signs every time. Nothing inside signeeDetails is required. Requires the templates capability; check get_account_capabilities first.

Permanently delete a document. Only documents with status 'completed' or 'revoked' can be deleted. This also deletes the associated file. Always call get_document first to confirm status, then ask the user for confirmation — deletion is irreversible.

Permanently delete a draft and its associated draft data. Both active and expired drafts can be deleted. Always call get_draft first, show the user a summary, and ask for confirmation — deletion is irreversible.

Delete a previously uploaded file. The file must not be attached to an active document — one whose status is created or awaiting_signatures.

PERMANENTLY deletes a public link and everything only it was using: its generated PDFs, thumbnails and any AI assistant data. This cannot be undone — always confirm with the user first, naming the link. THE LINK MUST BE DISABLED FIRST. Call disable_link, then this; deleting a live link returns 409. That order exists because deleting does not close the link itself, so a live link that was deleted would keep serving with nothing left to stop it. Documents the link already produced are NOT deleted and stay fully accessible. Owner only — note that disabling is not, so a colleague may be able to disable a shared link but not delete it.

PERMANENTLY deletes a template and the files only it was using. This cannot be undone — always confirm with the user first, naming the template. Documents already created from the template are NOT affected, and a PDF still used by a document or another template is left in place. Owner only.

Delete a registered webhook. Event delivery stops immediately.

Switches a public link off PERMANENTLY. It stops accepting new signers and its url stops working. THIS CANNOT BE UNDONE — there is no way to switch a link back on; you would have to duplicate it, which is billed as a new link. Always confirm with the user first, naming the link. Documents the link already produced are unaffected and stay accessible, and someone who had already finished keeps their completed document. Someone part-way through signing is cut off immediately. This also releases the billed instance, with no refund for the current period, and it is the REQUIRED FIRST STEP before delete_link. Not owner-only: anyone on the account may switch off a link shared with the account.

Copy a sent document's configuration — file, signature fields, signees, language, sharing and AI assistant — into a NEW DRAFT. The source document is untouched. This returns draftId, not documentId, and NOTHING IS SENT. That is deliberate: re-sending a contract to the same people on a single click is rarely what anyone wants, and a copy almost always needs an edit first. Review it, adjust with update_draft, then send with send_draft. Costs nothing here — the signature charge happens when the draft is sent, exactly as for any other draft. Signature progress is never copied: every field in the copy starts unsigned. Payment requirements on the source ARE carried over. A draft cannot be duplicated with this tool — use duplicate_draft.

Copy a draft into a new draft, leaving the original untouched. Useful for building several similar documents from one prepared starting point. Costs nothing — nothing is sent until send_draft is called on the copy. Payment requirements on the source are carried over.

Create a NEW public link with the same document, signature slots, language, print setting and AI assistant configuration as an existing one. The copy is live at its OWN public URL that anyone holding it can open and sign; the source is untouched and keeps working, and nothing is sent to anyone. With the AI assistant enabled the copy starts as status processing with linkUrl null, and goes live once get_link reports status active. THIS COSTS CREDITS — a duplicate is billed exactly like create_link, allocating its own instance and charging pro rata for the rest of the period. ALWAYS confirm with the user before calling this. 402 if credits are insufficient, 403 if the subscription is suspended. This is also the way to bring back a link that was disabled, since disabling cannot be undone.

Copy a template, leaving the original untouched. The copy belongs to whoever duplicated it, so this is also how you take your own private copy of a template a colleague shared with the account. Duplicating a template is free — unlike duplicating a public link.

Check which features are enabled for the account (e.g. BankID, templates, AI assistant). The signature-method flags (signatureBankId, signatureIdScan, signatureFaceLiveness) only say which methods the account may select; the verification itself is performed by Formify's signing page, and no identity data passes through this API.

List all users on the account, including pending invitations. Returns userId for each user, which can be passed to create_document's userId parameter to assign document ownership.

Get information about the currently authenticated user.

Get detailed status and metadata for a specific document, including per-signee signing status. The document status is exactly one of: created (created and ready), processing (the AI assistant is still preparing it), error (processing failed), awaiting_signatures (one or more signees have not signed yet), completed (all signees have signed), revoked (cancelled), deleted. Each entry in signeeDetails carries signeeId, signatureStatus (either awaiting_signature or signed — note the field is signatureStatus, not status), reminders.reminderCooldown (seconds left before another reminder may be sent, 0 when allowed now) and updates.updateCooldown (seconds left before contact details may be changed again, 0 when allowed now).

Retrieve all form field definitions in a document. Each field has: name (use as key in API calls), label (display only), type (textField, checkbox, combobox, listbox, radioButton), required, readOnly (signee cannot edit), editable (API can update), options [{label, value}] for choice fields. Use this before calling set_document_field_values. For already filled values, use get_document_field_values instead. Value format rule: ONLY textField and radioButton take a plain string. ALL other types (checkbox, combobox, listbox) MUST be an array — even for a single value like ["Beginner"].

Retrieve the current values of all form fields in a document. Works on documents in any status. For field definitions and types, use get_document_fields instead.

Get full draft details, including saved signee details, signature placements, form field values, invitation settings, and AI assistant configuration. Always call this before update_draft, send_draft, or delete_draft.

Get a PDF preview of the draft with signature fields rendered at their configured coordinates, returned as an embedded resource (base64 PDF) plus filename and size metadata. Use this when the MCP client can render PDFs inline in the conversation. If the client only supports clickable links, use get_draft_file_url instead. Fields without valid coordinates (page, x, y) are not rendered in the PDF but remain in the draft data. The draft must still have status draft and must not be expired. Authenticated via the session Bearer token.

Get a short-lived, one-time-use download URL for a PDF preview of the draft with signature fields rendered at their configured coordinates. Returns JSON with downloadUrl + fileName + mimeType + expiresInMinutes. The user opens the URL in a browser; no Authorization header is required. Use this when the MCP client should hand the user a clickable link. If the client can render PDFs inline, prefer get_draft_file (returns the PDF as an embedded resource via the session Bearer token). Typical preview flow: create_draft → get_draft_file_url (or get_draft_file) → user reviews PDF → (optional update_draft and re-fetch) → send_draft. Fields without valid coordinates (page, x, y) are not rendered in the PDF but remain in the draft data. The URL expires after 10 minutes and is consumed on successful download. The draft must still have status draft and must not be expired.

Retrieve all form fields in an uploaded PDF file before creating a document from it. Call this after upload_file to discover fields that can be pre-filled. Value format rule: ONLY textField and radioButton take a plain string. ALL other types (checkbox, combobox, listbox) MUST be an array — even for a single value like ["Beginner"]. Field names containing tink-scan-id (a scan trigger) or tink-scanned-id- (an image of part of the document) place an image of the signer's identity document in the signed document; a trigger combined with a tink-scanned-id-mrz- attribute on the same field only fills in text. Treat such fields like digital_ink_id_scan: tell the user that a copy of the ID document will be embedded in the signed document and get an explicit yes before the document is sent.

Get a public link's full configuration: name, language, status, its signature slots and the linkUrl to share. status is active, disabled or processing — a different vocabulary from a document's, because a link is a source of documents rather than a signature request. While processing (the AI assistant is still reading the document) linkUrl is null. ALWAYS call this before update_link, which is a full replace.

List the PDF form fields (AcroForm) in a public link's document, with the values the link is pre-filled with. Not the same as the link's signature slots — those are in get_link's signeeDetails. These values are the STARTING POINT every signer sees, not anyone's answers: a public link has no single set of answers, since everyone who opens it fills the form independently. To read what an individual signer actually entered, take a documentId from list_link_documents and call get_document_field_values. There is no tool for setting field values on a link.

Get unique, self-distributable signing links for a document — one per recipient — so the sender can hand out the links over any channel instead of relying on Formify's email/SMS/WhatsApp invitation. Use this for signees created with disableInvitationMessage: true (Formify did not invite them), or whenever the user wants to distribute a signing link themselves. SECURITY: every returned link is verification-locked. Opening one requires a one-time code that Formify sends to the recipient's contact method on file (the email/phone provided), never to a value the opener types in — so a leaked or forwarded link cannot be opened by anyone else. The lock is enforced automatically in the browser when the recipient opens the link; no extra calls are needed. Simply deliver the signingUrl. The response contains one entry per recipient signing share: signeeId, fullName, emailAddress/phoneNumber (contact on file), verificationChannel ('email' | 'sms' | 'whatsapp'), signingUrl, and requiresVerification (always true). A recipient given BOTH an email and a phone is returned as TWO entries (same signeeId, one per verificationChannel) — present both and let the user choose which to distribute. A recipient with no contact method on file cannot be verified, so they are omitted from the response entirely. This cannot be repaired on a sent document: update_signee can change an existing contact method but never add one. If a link is needed for such a recipient, revoke the document and send a new one with an email or phone number for them. Recipients created through the API always have at least one contact method, so this mainly affects documents created elsewhere. Calling this generates and persists the links on first use (idempotent on later calls). Only works on a sent document, not a draft.

Get a download URL for a completed (signed by all parties) document. The URL is valid for 10 minutes.

Get details for a specific template. Returns the template's name, number of signees, and each signee's pre-configured signature settings (signatureType, signaturePlacement, signatureBox). Always call get_template_fields immediately after this — before collecting signer details or creating the document. A signee whose signatureType is digital_ink_id_scan gets an image of their identity document placed in the signed document, so the same disclosure applies as when selecting that method yourself: tell the user and get an explicit yes before creating the document.

Always call this immediately after get_template — before collecting signer details. Reveals whether the template has form fields the user can pre-fill. Each field has: name (key for API calls), label (display only), type (textField, checkbox, combobox, listbox, radioButton), editable (can be pre-filled via API), readOnly (signee cannot edit), options [{label, value}] for choice fields. If any fields have editable: true, ask the user whether to pre-fill them now (values locked for signer) or leave for the signer. Value format rule: ONLY textField and radioButton take a plain string. ALL other types (checkbox, combobox, listbox) MUST be an array — even for a single value like ["Beginner"]. Never pass an empty string for text fields — omit the field instead. Field names containing tink-scan-id (a scan trigger) or tink-scanned-id- (an image of part of the document) place an image of the signer's identity document in the signed document; a trigger combined with a tink-scanned-id-mrz- attribute on the same field only fills in text. Treat such fields like digital_ink_id_scan: tell the user that a copy of the ID document will be embedded in the signed document and get an explicit yes before the document is sent.

List documents created by the user or shared within the account. PAGINATION: follow nextOffset until it is null. A page may return fewer items than limit and still not be the last — that is intended behaviour, so never stop at a short page.

List draft documents with pagination. Drafts are saved document configurations that have not been sent for signing yet. Use get_draft to inspect a draft before updating, sending, or deleting it. PAGINATION: follow nextOffset until it is null. A page may return fewer items than limit and still not be the last — that is intended behaviour, so never stop at a short page.

List the completed documents a public link has produced — one per person who opened it and signed. Each entry carries a documentId you can pass straight to get_document, get_signed_document_url and get_document_field_values. Only completed submissions appear: someone who opened the link and abandoned it half-filled is not listed. These documents are NOT part of list_documents, which lists documents you sent to named recipients. PAGINATION: follow nextOffset until it is null. A page may return fewer items than limit and still not be the last — that is intended behaviour, so never stop at a short page.

List the public links you own plus the ones shared with the account. A public link is ONE reusable signing link that anyone holding it can open and sign, producing a separate document per signer — not the per-recipient links of a document you already sent (those come from get_recipient_links). Present results as a short scannable list of link names and their status; hide IDs from the user. Requires the publicLinks capability. PAGINATION: follow nextOffset until it is null. A page may return fewer items than limit and still not be the last — that is intended behaviour, so never stop at a short page.

List all available signing templates. Present results as a short scannable list of template names only — hide IDs and metadata from the user. PAGINATION: follow nextOffset until it is null. A page may return fewer items than limit and still not be the last — that is intended behaviour, so never stop at a short page.

List all registered webhooks for this account.

Merge 2–8 previously uploaded PDF files into a single file. Returns a new fileId for the merged result. The original files are kept. The first fileId in the array appears first (topmost pages) in the merged document — order matters.

Register a new webhook to receive real-time document event notifications via HTTP POST.

Stage an upload for a PDF that is attached to the conversation, for clients that can execute shell commands but cannot pass the file to a tool directly. Returns a presigned upload URL plus a ready-made curlCommand that streams the file to it. Only use this tool if you are able to run that command; if you cannot, skip it and call upload_file directly with fileReference (a file reference supplied by the host application), url (a PDF reachable over HTTPS) or file (base64) plus fileName. After calling this tool, run the returned curlCommand to upload the file. CRITICAL: wait for it to complete and return HTTP 200 before calling upload_file — the staged entry holds no bytes until then, and upload_file will fail. The upload URL expires in 10 minutes. Once the upload has succeeded, call upload_file with the returned uploadId. ONE AT A TIME: only one staged upload can be pending per user. Finish the current file (curl, then upload_file) before requesting the next — do not request several upload URLs up front, not even for files that will be merged. A request made while another upload is pending is refused with an error that repeats the pending uploadId and, while its file has not arrived yet, its curl command so you can finish it; that refusal is expected, not a server fault. If the curl command fails with a network, DNS, or 'host not in allowlist' error, the client's code-execution sandbox is blocking outbound requests to this server — do not retry the same command. Report what blocked it, then either fall back to upload_file with file (base64), or, if the client lets the user allow outbound domains for code execution (the setting lives in the client's code-execution or sandbox preferences), tell the user how to allow this server's domain there and retry once they have done so.

Revoke a document that has been sent for signing (only possible if not yet fully signed). Always call get_document first to confirm status, then show the user a summary and ask for confirmation — revoking is irreversible.

Rotate the HMAC signing secret for a webhook. Returns the new secret. Update your webhook verification logic immediately after rotating.

Convert a draft into a live document and send invitations. Always call get_draft first, verify every signee has fullName plus at least one contact method, verify required coordinates for existing placement and digital_ink_id_scan, show a summary, and ask for confirmation before calling this tool. If validation fails, the draft remains unsent.

Send a signing reminder to one or more signees who have not yet signed. Always call get_document first. Two conditions decide who can be reminded: (1) the document status must be awaiting_signatures — any other status returns 403; (2) include only signees whose signatureStatus is awaiting_signature, never one whose signatureStatus is signed. Show who will be reminded and ask for confirmation before sending. Rate limit: max 2 reminders per signee per 60-minute rolling window, after which the API returns 429. signeeDetails[].reminders.reminderCooldown from get_document is the number of seconds left before the next reminder is allowed — check it before calling, and tell the user how long is left instead of retrying.

Update form field values on an already-created document. Only use this when values need to be added or corrected after the document was created — if you have the values upfront, pass them via create_document's fields parameter instead. Only works on editable fields before anyone has signed.

Update an existing draft. The draft must still have status draft. This is a full draft configuration update: include the complete signeeDetails list you want to keep, because signees not included may be removed. fileId is optional; if omitted, the draft keeps its current file.

Overwrite the configuration of a LIVE public link. THIS IS A FULL REPLACE — the previous configuration is not kept, anything you leave out is lost, and everyone who opens the same public URL from now on sees the new document and signature slots (with the AI assistant enabled, once the document has been processed and get_link reports status active). ALWAYS call get_link first and send back the complete configuration with your changes applied; every property round-trips, so nothing is lost by doing it that way. fileId is the one exception: omit it to keep the link's current document. The public URL survives an edit, so anyone already holding the link keeps a working one, and editing is NOT billed again. A disabled link cannot be edited and returns 409 — duplicate it instead. Owner only: a colleague can read and disable a shared link but not edit it.

Update contact details for one or more signees who have not yet signed (e.g. fix a wrong email). A new signing invitation is sent to each updated signee, and links already sent to the old contact details are revoked. Always call get_document first to read signeeId and signatureStatus. Constraints, all of which return 403 when broken: (1) the signee's signatureStatus must be awaiting_signature — a signee who has signed cannot be changed, and neither can a completed document; (2) an existing contact method can only be CHANGED, never added — updating the email of a signee who only has a phone number (or vice versa) is rejected; (3) a signee's contact details can be updated at most twice, after which a 60-minute cooldown applies. signeeDetails[].updates.updateCooldown from get_document is the number of seconds left — check it before calling and tell the user how long is left instead of retrying. Note that a successful update generates a NEW signeeId for that signee, so any previously read ID is stale afterwards; call get_document again before acting on the signee a second time.

Replace a template's configuration. THIS IS A FULL REPLACE — anything you leave out is lost, so call get_template first and send back the complete configuration with your changes applied. fileId is the one exception: omit it to keep the template's current document. Documents already created from the template are unaffected; they took a copy when they were created. Owner only — a colleague can use a shared template but not edit it.

Upload a PDF file to Formify. Returns a fileId for use with create_document, create_draft or create_link. Provide exactly ONE of these inputs: (1) fileReference — a file reference that the host application supplies when the user attaches a file and the host supports passing files to tools. Pass it exactly as provided; the server downloads the bytes itself. Never construct one by hand and never put a local path in it. (2) url — a PDF reachable over HTTPS. Works in every client; use it whenever a URL is available. (3) uploadId — for an attached file when the host does not pass file references but you can execute shell commands: call request_file_upload_url first, run its curlCommand, then pass the uploadId here. (4) file — the file's bytes as base64 together with fileName, for an attached file when none of the above is possible. Practical ceiling is roughly 30–50 kB of PDF: base64 is a third larger than the file, and a 300 kB PDF would take more output than a model can emit in one message. IMPORTANT: Do NOT use base64 unless you can guarantee you are passing the complete, untruncated file content. AI assistants routinely truncate large strings, which silently corrupts the file and causes upload failures. If the user attached a file but no fileReference reached this tool, retry the call once before choosing another path. Max size: 50 MB. The PDF must not be password-protected or contain digital signatures from other services.