Developers

Getting started

From nothing to a working request in a few minutes.

1. Get a key

If you are a customer, an owner or admin opens Settings, Integrations and presses Create key. Pick only the permissions the system needs. They can also invite their developer to the account so you can create it yourself. The key is shown once, so store it like a password, on your server and never in a browser or an app.

If you are a partner, apply for partner access. Once approved, each customer connects their account to your product and you receive a key for that one business.

Keys start with wp_live_ and carry the permissions they were created with:

Permission	Allows
`signings:read`	Read signed waivers and download their PDFs
`signings:read_health`	Also read health answers (only with read signed waivers)
`customers:read`	Look up customers and check if they have a waiver on file
`signing_links:write`	Create personal signing links
`webhooks:manage`	Add and change webhook endpoints

API access is included on the Growth plan and above. See pricing.

2. Authenticate

Send the key as a bearer token on every request. The base URL is https://app.onlinewaiversoftware.com/api/v1. A key works only on this address.

Authorization: Bearer wp_live_your_key

3. Make your first call

curl https://app.onlinewaiversoftware.com/api/v1/signings?per_page=5 \
  -H "Authorization: Bearer wp_live_your_key"

Lists come back in one shape. Ask for more with page and per_page (at most 100):

{ "object": "list", "data": [ ... ], "page": 1, "per_page": 5, "total": 42, "has_more": true }

Dates are ISO 8601 in UTC, dates of birth are YYYY-MM-DD, and ids are UUIDs. The API reference lists every endpoint.

Rate limit

Each key may make 120 requests a minute. Every answer carries RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset (seconds). Past the limit you get a 429 with Retry-After; wait that long and retry.

Errors

Every error is a JSON problem document with a stable code and a fix that says what to do next:

HTTP/1.1 403
{ "status": 403, "code": "scope-missing", "title": "This key cannot do that",
  "detail": "This API key does not have the customers:read permission.",
  "fix": "Create a key with that permission in Settings, Integrations, and use it instead." }

Common statuses: 400 for a bad request, 401 for a missing or revoked key, 403 for a missing permission, 404 when something does not exist, and 429 for the rate limit. Revoke a key the moment it may have leaked.