API
BunnyDoc's public API — what's available today, where to start, and the conventions shared by every endpoint.
BunnyDoc has one public API today: the E-Signing API, served under
https://api2.bunnydoc.com/v1. It covers the whole send-for-signature workflow — templates,
contacts, sending an envelope, retrieving signing links, and webhooks for everything that happens
afterwards.
E-Signing API
Available now. Templates, contacts, envelopes, signing links, users, and webhooks.
Invoicing API
Not yet available. What you can automate for invoicing in the meantime.
There is no Invoicing API yet
Invoices, quotes, credit notes, inventory, and expenses have no public endpoints. They are managed in the app, and you can receive their events through in-app webhooks. See Invoicing API for what's possible today.
Start here
Check your plan includes API access
API access is sold separately. Without it, you cannot mint a key, and
POST /v1/auth/token returns 403 forbidden. Check Settings → Billing → Resources for
API access and API signature requests.
Create an API key
Settings → API Keys, owner or admin only. Pick the narrowest set of scopes the integration needs. See Create and manage API keys.
Exchange the key for a token, then build
POST /v1/auth/token returns a one-hour bearer
token. Then follow Send from a template — the call
most integrations are built around.
Where E-Signing ends and Invoicing begins
The distinction that trips people up is the same one as in the app — an invoice table built inside a signing document belongs to E-Signing, not Invoicing.
| What you want to do | Where it lives | Public API? |
|---|---|---|
| Send a document out for signature | E-Signing | ✅ POST /v1/envelopes/from-template |
| Charge a signer while they sign | E-Signing | ✅ via the template's payment block |
| Add a pricing or invoice table to a document being signed | E-Signing | ✅ set up on the template |
| Be told when a document is signed | E-Signing | ✅ webhooks |
| Create a standalone invoice with its own number and status | Invoicing | ❌ in-app only |
| Send a quote or a credit note | Invoicing | ❌ in-app only |
| Manage products, stock, or expenses | Invoicing | ❌ in-app only |
| Be told when an invoice is paid | Invoicing | ⚠️ webhooks only, configured in the app |
Conventions
Every /v1 endpoint follows the same rules.
- JSON in, JSON out — send and expect
application/json. - One bearer token —
Authorization: Bearer <access_token>on every request exceptPOST /v1/auth/token. - Scoped to one company — a key belongs to one company and requests never cross company boundaries.
- Same permissions as the app — a key can only do what its owner's role allows, and its scopes can only narrow that further, never widen it. See Users & roles.
- Offset pagination — list endpoints take
pageandper_pageand return apaginationobject. - Stable error codes — branch on
error.code, never onmessage. See the error reference. - Rate limited per key — not per IP, so a shared egress address never makes one customer's traffic count against another's.
Keep credentials server-side
An API key acts on behalf of your whole company. Never ship it in a browser, a mobile app, or any client you don't control.
How do I create permission templates?
Build reusable sets of permissions you can apply to team members instead of configuring access one key at a time.
E-Signing API
Send documents for signature straight from your own systems — exchange an API key for a token, create envelopes from templates, manage contacts, and retrieve signing links over a simple REST API.