Formify

Switches a public link off PERMANENTLY. It stops accepting new signers and its url stops working. THIS CANNOT BE UNDONE — there is no way to switch a link back on; you would have to duplicate it, which is billed as a new link. Always confirm with the user first, naming the link. Documents the link already produced are unaffected and stay accessible, and someone who had already finished keeps their completed document. Someone part-way through signing is cut off immediately. This also releases the billed instance, with no refund for the current period, and it is the REQUIRED FIRST STEP before delete_link. Not owner-only: anyone on the account may switch off a link shared with the account.

disable_link

Copy a sent document's configuration — file, signature fields, signees, language, sharing and AI assistant — into a NEW DRAFT. The source document is untouched. This returns draftId, not documentId, and NOTHING IS SENT. That is deliberate: re-sending a contract to the same people on a single click is rarely what anyone wants, and a copy almost always needs an edit first. Review it, adjust with update_draft, then send with send_draft. Costs nothing here — the signature charge happens when the draft is sent, exactly as for any other draft. Signature progress is never copied: every field in the copy starts unsigned. Payment requirements on the source ARE carried over. A draft cannot be duplicated with this tool — use duplicate_draft.

duplicate_document

Copy a draft into a new draft, leaving the original untouched. Useful for building several similar documents from one prepared starting point. Costs nothing — nothing is sent until send_draft is called on the copy. Payment requirements on the source are carried over.

duplicate_draft

Create a NEW public link with the same document, signature slots, language, print setting and AI assistant configuration as an existing one. The copy is live at its OWN public URL that anyone holding it can open and sign; the source is untouched and keeps working, and nothing is sent to anyone. With the AI assistant enabled the copy starts as status processing with linkUrl null, and goes live once get_link reports status active. THIS COSTS CREDITS — a duplicate is billed exactly like create_link, allocating its own instance and charging pro rata for the rest of the period. ALWAYS confirm with the user before calling this. 402 if credits are insufficient, 403 if the subscription is suspended. This is also the way to bring back a link that was disabled, since disabling cannot be undone.

duplicate_link

Copy a template, leaving the original untouched. The copy belongs to whoever duplicated it, so this is also how you take your own private copy of a template a colleague shared with the account. Duplicating a template is free — unlike duplicating a public link.

duplicate_template

Check which features are enabled for the account (e.g. BankID, templates, AI assistant). The signature-method flags (signatureBankId, signatureIdScan, signatureFaceLiveness) only say which methods the account may select; the verification itself is performed by Formify's signing page, and no identity data passes through this API.

get_account_capabilities

List all users on the account, including pending invitations. Returns userId for each user, which can be passed to create_document's userId parameter to assign document ownership.

get_account_users

Get information about the currently authenticated user.

get_current_user

Get detailed status and metadata for a specific document, including per-signee signing status. The document `status` is exactly one of: `created` (created and ready), `processing` (the AI assistant is still preparing it), `error` (processing failed), `awaiting_signatures` (one or more signees have not signed yet), `completed` (all signees have signed), `revoked` (cancelled), `deleted`. Each entry in `signeeDetails` carries `signeeId`, `signatureStatus` (either `awaiting_signature` or `signed` — note the field is `signatureStatus`, not `status`), `reminders.reminderCooldown` (seconds left before another reminder may be sent, 0 when allowed now) and `updates.updateCooldown` (seconds left before contact details may be changed again, 0 when allowed now).

get_document

Retrieve the current values of all form fields in a document. Works on documents in any status. For field definitions and types, use get_document_fields instead.

get_document_field_values

Retrieve all form field definitions in a document. Each field has: name (use as key in API calls), label (display only), type (textField, checkbox, combobox, listbox, radioButton), required, readOnly (signee cannot edit), editable (API can update), options [{label, value}] for choice fields. Use this before calling set_document_field_values. For already filled values, use get_document_field_values instead. Value format rule: ONLY textField and radioButton take a plain string. ALL other types (checkbox, combobox, listbox) MUST be an array — even for a single value like ["Beginner"].

get_document_fields

Get full draft details, including saved signee details, signature placements, form field values, invitation settings, and AI assistant configuration. Always call this before update_draft, send_draft, or delete_draft.

get_draft

Get a PDF preview of the draft with signature fields rendered at their configured coordinates, returned as an embedded resource (base64 PDF) plus filename and size metadata. Use this when the MCP client can render PDFs inline in the conversation. If the client only supports clickable links, use get_draft_file_url instead. Fields without valid coordinates (page, x, y) are not rendered in the PDF but remain in the draft data. The draft must still have status draft and must not be expired. Authenticated via the session Bearer token.

get_draft_file

Get a short-lived, one-time-use download URL for a PDF preview of the draft with signature fields rendered at their configured coordinates. Returns JSON with downloadUrl + fileName + mimeType + expiresInMinutes. The user opens the URL in a browser; no Authorization header is required. Use this when the MCP client should hand the user a clickable link. If the client can render PDFs inline, prefer get_draft_file (returns the PDF as an embedded resource via the session Bearer token). Typical preview flow: create_draft → get_draft_file_url (or get_draft_file) → user reviews PDF → (optional update_draft and re-fetch) → send_draft. Fields without valid coordinates (page, x, y) are not rendered in the PDF but remain in the draft data. The URL expires after 10 minutes and is consumed on successful download. The draft must still have status draft and must not be expired.

get_draft_file_url

Retrieve all form fields in an uploaded PDF file before creating a document from it. Call this after upload_file to discover fields that can be pre-filled. Value format rule: ONLY textField and radioButton take a plain string. ALL other types (checkbox, combobox, listbox) MUST be an array — even for a single value like ["Beginner"]. Field names containing tink-scan-id (a scan trigger) or tink-scanned-id- (an image of part of the document) place an image of the signer's identity document in the signed document; a trigger combined with a tink-scanned-id-mrz- attribute on the same field only fills in text. Treat such fields like digital_ink_id_scan: tell the user that a copy of the ID document will be embedded in the signed document and get an explicit yes before the document is sent.

get_file_fields

Get a public link's full configuration: name, language, status, its signature slots and the linkUrl to share. status is active, disabled or processing — a different vocabulary from a document's, because a link is a source of documents rather than a signature request. While processing (the AI assistant is still reading the document) linkUrl is null. ALWAYS call this before update_link, which is a full replace.

get_link

List the PDF form fields (AcroForm) in a public link's document, with the values the link is pre-filled with. Not the same as the link's signature slots — those are in get_link's signeeDetails. These values are the STARTING POINT every signer sees, not anyone's answers: a public link has no single set of answers, since everyone who opens it fills the form independently. To read what an individual signer actually entered, take a documentId from list_link_documents and call get_document_field_values. There is no tool for setting field values on a link.

get_link_fields

Get unique, self-distributable signing links for a document — one per recipient — so the sender can hand out the links over any channel instead of relying on Formify's email/SMS/WhatsApp invitation. Use this for signees created with disableInvitationMessage: true (Formify did not invite them), or whenever the user wants to distribute a signing link themselves. SECURITY: every returned link is verification-locked. Opening one requires a one-time code that Formify sends to the recipient's contact method on file (the email/phone provided), never to a value the opener types in — so a leaked or forwarded link cannot be opened by anyone else. The lock is enforced automatically in the browser when the recipient opens the link; no extra calls are needed. Simply deliver the signingUrl. The response contains one entry per recipient signing share: signeeId, fullName, emailAddress/phoneNumber (contact on file), verificationChannel ('email' | 'sms' | 'whatsapp'), signingUrl, and requiresVerification (always true). A recipient given BOTH an email and a phone is returned as TWO entries (same signeeId, one per verificationChannel) — present both and let the user choose which to distribute. A recipient with no contact method on file cannot be verified, so they are omitted from the response entirely. This cannot be repaired on a sent document: update_signee can change an existing contact method but never add one. If a link is needed for such a recipient, revoke the document and send a new one with an email or phone number for them. Recipients created through the API always have at least one contact method, so this mainly affects documents created elsewhere. Calling this generates and persists the links on first use (idempotent on later calls). Only works on a sent document, not a draft.

get_recipient_links

Get a download URL for a completed (signed by all parties) document. The URL is valid for 10 minutes.

get_signed_document_url

Get details for a specific template. Returns the template's name, number of signees, and each signee's pre-configured signature settings (signatureType, signaturePlacement, signatureBox). Always call get_template_fields immediately after this — before collecting signer details or creating the document. A signee whose signatureType is digital_ink_id_scan gets an image of their identity document placed in the signed document, so the same disclosure applies as when selecting that method yourself: tell the user and get an explicit yes before creating the document.

get_template

Always call this immediately after get_template — before collecting signer details. Reveals whether the template has form fields the user can pre-fill. Each field has: name (key for API calls), label (display only), type (textField, checkbox, combobox, listbox, radioButton), editable (can be pre-filled via API), readOnly (signee cannot edit), options [{label, value}] for choice fields. If any fields have editable: true, ask the user whether to pre-fill them now (values locked for signer) or leave for the signer. Value format rule: ONLY textField and radioButton take a plain string. ALL other types (checkbox, combobox, listbox) MUST be an array — even for a single value like ["Beginner"]. Never pass an empty string for text fields — omit the field instead. Field names containing tink-scan-id (a scan trigger) or tink-scanned-id- (an image of part of the document) place an image of the signer's identity document in the signed document; a trigger combined with a tink-scanned-id-mrz- attribute on the same field only fills in text. Treat such fields like digital_ink_id_scan: tell the user that a copy of the ID document will be embedded in the signed document and get an explicit yes before the document is sent.

get_template_fields

List documents created by the user or shared within the account. PAGINATION: follow nextOffset until it is null. A page may return fewer items than limit and still not be the last — that is intended behaviour, so never stop at a short page.

list_documents

List draft documents with pagination. Drafts are saved document configurations that have not been sent for signing yet. Use get_draft to inspect a draft before updating, sending, or deleting it. PAGINATION: follow nextOffset until it is null. A page may return fewer items than limit and still not be the last — that is intended behaviour, so never stop at a short page.

list_drafts

List the completed documents a public link has produced — one per person who opened it and signed. Each entry carries a documentId you can pass straight to get_document, get_signed_document_url and get_document_field_values. Only completed submissions appear: someone who opened the link and abandoned it half-filled is not listed. These documents are NOT part of list_documents, which lists documents you sent to named recipients. PAGINATION: follow nextOffset until it is null. A page may return fewer items than limit and still not be the last — that is intended behaviour, so never stop at a short page.

list_link_documents

List the public links you own plus the ones shared with the account. A public link is ONE reusable signing link that anyone holding it can open and sign, producing a separate document per signer — not the per-recipient links of a document you already sent (those come from get_recipient_links). Present results as a short scannable list of link names and their status; hide IDs from the user. Requires the publicLinks capability. PAGINATION: follow nextOffset until it is null. A page may return fewer items than limit and still not be the last — that is intended behaviour, so never stop at a short page.

list_links

List all available signing templates. Present results as a short scannable list of template names only — hide IDs and metadata from the user. PAGINATION: follow nextOffset until it is null. A page may return fewer items than limit and still not be the last — that is intended behaviour, so never stop at a short page.

list_templates

List all registered webhooks for this account.

list_webhooks

Merge 2–8 previously uploaded PDF files into a single file. Returns a new fileId for the merged result. The original files are kept. The first fileId in the array appears first (topmost pages) in the merged document — order matters.

merge_files

Register a new webhook to receive real-time document event notifications via HTTP POST.

register_webhook

Stage an upload for a PDF that is attached to the conversation, for clients that can execute shell commands but cannot pass the file to a tool directly. Returns a presigned upload URL plus a ready-made curlCommand that streams the file to it. Only use this tool if you are able to run that command; if you cannot, skip it and call upload_file directly with `fileReference` (a file reference supplied by the host application), `url` (a PDF reachable over HTTPS) or `file` (base64) plus `fileName`. After calling this tool, run the returned curlCommand to upload the file. CRITICAL: wait for it to complete and return HTTP 200 before calling upload_file — the staged entry holds no bytes until then, and upload_file will fail. The upload URL expires in 10 minutes. Once the upload has succeeded, call upload_file with the returned uploadId. ONE AT A TIME: only one staged upload can be pending per user. Finish the current file (curl, then upload_file) before requesting the next — do not request several upload URLs up front, not even for files that will be merged. A request made while another upload is pending is refused with an error that repeats the pending uploadId and, while its file has not arrived yet, its curl command so you can finish it; that refusal is expected, not a server fault. If the curl command fails with a network, DNS, or 'host not in allowlist' error, the client's code-execution sandbox is blocking outbound requests to this server — do not retry the same command. Report what blocked it, then either fall back to upload_file with `file` (base64), or, if the client lets the user allow outbound domains for code execution (the setting lives in the client's code-execution or sandbox preferences), tell the user how to allow this server's domain there and retry once they have done so.

request_file_upload_url

Revoke a document that has been sent for signing (only possible if not yet fully signed). Always call get_document first to confirm status, then show the user a summary and ask for confirmation — revoking is irreversible.

revoke_document

Rotate the HMAC signing secret for a webhook. Returns the new secret. Update your webhook verification logic immediately after rotating.

rotate_webhook_secret

Convert a draft into a live document and send invitations. Always call get_draft first, verify every signee has fullName plus at least one contact method, verify required coordinates for existing placement and digital_ink_id_scan, show a summary, and ask for confirmation before calling this tool. If validation fails, the draft remains unsent.

send_draft

Send a signing reminder to one or more signees who have not yet signed. Always call get_document first. Two conditions decide who can be reminded: (1) the document `status` must be `awaiting_signatures` — any other status returns 403; (2) include only signees whose `signatureStatus` is `awaiting_signature`, never one whose `signatureStatus` is `signed`. Show who will be reminded and ask for confirmation before sending. Rate limit: max 2 reminders per signee per 60-minute rolling window, after which the API returns 429. `signeeDetails[].reminders.reminderCooldown` from get_document is the number of seconds left before the next reminder is allowed — check it before calling, and tell the user how long is left instead of retrying.

send_reminder

Update form field values on an already-created document. Only use this when values need to be added or corrected after the document was created — if you have the values upfront, pass them via create_document's fields parameter instead. Only works on editable fields before anyone has signed.

set_document_field_values

Update an existing draft. The draft must still have status draft. This is a full draft configuration update: include the complete signeeDetails list you want to keep, because signees not included may be removed. fileId is optional; if omitted, the draft keeps its current file.

update_draft

Overwrite the configuration of a LIVE public link. THIS IS A FULL REPLACE — the previous configuration is not kept, anything you leave out is lost, and everyone who opens the same public URL from now on sees the new document and signature slots (with the AI assistant enabled, once the document has been processed and get_link reports status active). ALWAYS call get_link first and send back the complete configuration with your changes applied; every property round-trips, so nothing is lost by doing it that way. fileId is the one exception: omit it to keep the link's current document. The public URL survives an edit, so anyone already holding the link keeps a working one, and editing is NOT billed again. A disabled link cannot be edited and returns 409 — duplicate it instead. Owner only: a colleague can read and disable a shared link but not edit it.

update_link

Update contact details for one or more signees who have not yet signed (e.g. fix a wrong email). A new signing invitation is sent to each updated signee, and links already sent to the old contact details are revoked. Always call get_document first to read `signeeId` and `signatureStatus`. Constraints, all of which return 403 when broken: (1) the signee's `signatureStatus` must be `awaiting_signature` — a signee who has signed cannot be changed, and neither can a completed document; (2) an existing contact method can only be CHANGED, never added — updating the email of a signee who only has a phone number (or vice versa) is rejected; (3) a signee's contact details can be updated at most twice, after which a 60-minute cooldown applies. `signeeDetails[].updates.updateCooldown` from get_document is the number of seconds left — check it before calling and tell the user how long is left instead of retrying. Note that a successful update generates a NEW `signeeId` for that signee, so any previously read ID is stale afterwards; call get_document again before acting on the signee a second time.

update_signee

Replace a template's configuration. THIS IS A FULL REPLACE — anything you leave out is lost, so call get_template first and send back the complete configuration with your changes applied. fileId is the one exception: omit it to keep the template's current document. Documents already created from the template are unaffected; they took a copy when they were created. Owner only — a colleague can use a shared template but not edit it.

update_template

Upload a PDF file to Formify. Returns a fileId for use with create_document, create_draft or create_link. Provide exactly ONE of these inputs: (1) `fileReference` — a file reference that the host application supplies when the user attaches a file and the host supports passing files to tools. Pass it exactly as provided; the server downloads the bytes itself. Never construct one by hand and never put a local path in it. (2) `url` — a PDF reachable over HTTPS. Works in every client; use it whenever a URL is available. (3) `uploadId` — for an attached file when the host does not pass file references but you can execute shell commands: call request_file_upload_url first, run its curlCommand, then pass the uploadId here. (4) `file` — the file's bytes as base64 together with fileName, for an attached file when none of the above is possible. Practical ceiling is roughly 30–50 kB of PDF: base64 is a third larger than the file, and a 300 kB PDF would take more output than a model can emit in one message. IMPORTANT: Do NOT use base64 unless you can guarantee you are passing the complete, untruncated file content. AI assistants routinely truncate large strings, which silently corrupts the file and causes upload failures. If the user attached a file but no fileReference reached this tool, retry the call once before choosing another path. Max size: 50 MB. The PDF must not be password-protected or contain digital signatures from other services.

upload_file