Send a filled-in document for signature by API

1. In the form editor, turn on הפעלת סבב חתימות and add the steps with הוספת שלב.
2. For the step that should reach the person you name in the request, set מי הנמען to לפי תשובה בטופס and choose an email field as its שדה המייל. Formy writes the request's email into that field, so the invitation goes there and nowhere else.
3. A step with כתובת קבועה still goes to its own address. That is how you add your own countersignature after the client's.
4. Save the form. Read its current definition_revision from GET /open/forms/{form}; you send it as expected_form_revision.
5. Create a token with forms-write, as a member who can edit the form. Find the field IDs under אוטומציה ו-API on the form's אינטגרציות tab: its שליחת מסמך ממולא לחתימה section prints a ready request with your own field IDs.

curl -X POST https://formy.co.il/api/external/forms/service-agreement/signing-requests \
  -H "Authorization: Bearer $FORMY_TOKEN" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{
    "expected_form_revision": 2,
    "email": "client@example.com",
    "data": {
      "8a1d4e2b-5c3f-4a6e-b7d8-9e0f1a2b3c4d": "Package 2",
      "c4b3a2d1-6e5f-4d7c-8b9a-0f1e2d3c4b5a": 13000
    }
  }'

{form} is the form's ID or slug. Any other field in the body is ignored; a recipient name, for example, is not used.

Keys and values are checked, not dropped

A key that names no field on the form is refused with 422, and so is a value Formy cannot put on the document (an object sent to a text field, say). Silently dropping either would send a contract with an empty price, discovered only when it comes back signed.

{
  "message": "המפתחות הבאים אינם מזהים שדה בטופס הזה: pakcage. ניתן להעתיק מזהה שדה מלוח הגדרות השדה בעורך הטופס.",
  "errors": {
    "data": ["המפתחות הבאים אינם מזהים שדה בטופס הזה: pakcage. ניתן להעתיק מזהה שדה מלוח הגדרות השדה בעורך הטופס."]
  }
}

What a caller cannot set

• Who signs. A value you send for the email field a step reads its recipient from is overwritten with email, so a request cannot redirect someone else's document.
• A phone number. Any field a step reads a phone number from is cleared, because this endpoint takes none, so that signer is invited by email.
• The verification code. Whether a step asks for a one-time code is the form's setting; the request cannot switch it.

{
  "id": 2,
  "status": "in_progress",
  "form_slug": "service-agreement",
  "email": "client@example.com",
  "data": {
    "8a1d4e2b-5c3f-4a6e-b7d8-9e0f1a2b3c4d": "Package 2",
    "c4b3a2d1-6e5f-4d7c-8b9a-0f1e2d3c4b5a": 13000
  },
  "form_id": 1,
  "form_revision": 2,
  "submission_revision": 2,
  "etag": "\"submission-1-2-v2\""
}

id is the response Formy created, status its signing status (in_progress until the round ends), and data the values as stored. Formy sends the invitation before it answers: a 201 means the first signer was emailed. If the invitation cannot be sent, nothing is created and the call fails. There is no state in which a document counts as sent while nobody was asked to sign it.

From there the round runs as any other: the signer gets reminders every 72 hours, up to three, and the link expires after the step's expiry, 14 days by default. When the document is signed, both the response and its signed PDF are in Formy. Neither the request nor the signatures that follow trigger the form's webhooks or other integrations, so follow the document's status in the form's responses.

The plans and their prices are on the pricing page.

• It does not issue a certified or qualified electronic signature. Formy is not a certification authority; the signed PDF carries an electronic signature with an evidence trail. See digital signature.
• It does not verify who the signer is. An optional one-time code proves access to a mailbox, not identity.
• It takes no phone number, so a request cannot route a signer to SMS.
• It does not report back by webhook when the document is signed.
• It does not create the form: build the form and its signing round in the editor first.