Authorization of the API Access

Evia Sign API empowers organizations to create secure, streamlined digital signature workflows with ease. It provides the ability to upload documents, initiate signature requests using flexible methods such as templates, fixed positioning, or automated stamping, and manage signatories throughout the process. Additionally, it offers real-time tracking of signature progress via webhook notifications, helping teams stay informed and responsive every step of the way.

Base URL: https://evia.enadocapp.com/_apis/sign

Authentication: OAuth 2.0 (Authorization Code Flow)

Authentication & Authorization

Evia Sign uses OAuth 2.0 Authorization Code Flow to ensure secure access.

All API requests must include an Authorization: Bearer {access_token} header.

---

Step 1: Get OAuth 2.0 Authorization Code

Before interacting with the Evia Sign API, you must obtain an authorization code using OAuth 2.0 Authorization Code Flow. This code will be exchanged for an access token required to authenticate your API requests.

Authorization Request

GET /_apis/falcon/auth/oauth2/authorize

Example URL

https://evia.enadocapp.com/_apis/falcon/auth/oauth2/authorize?application_state=external&resource=RESOURCE_APPLICATION&client_id=YOUR_CLIENT_ID&scope=Sign%20Falcon%20Licensing&response_type=code

Query Parameters

application_state	Typically external
resource	API resource identifier (e.g., RESOURCE_APPLICATION)
client_id	Your application's client ID
scope	OAuth scope (Sign Falcon Licensing)
response_type	Must be code

Once authorized, the user is redirected to your callback URL with a query parameter

?code=received-auth-code

---

Step 2: Exchange Authorization Code for Access Token

Request

POST /_apis/falcon/auth/api/v2/token

Headers

Name	Value
Authorization	Basic base64(client_id:client_secret)
Content-Type	application/x-www-form-urlencoded

Body

{
  "grant_type": "authorization_code",
  "client_id": "your-client-id",
  "client_secret": "your-client-secret",
  "code": "received-auth-code"
}

Response

200

{
  "access_token": "abc123...",
  "token_type": "bearer",
  "expires_in": 3600
}

400

{
  "error": "Invalid request"
}

Use the access_token in the header for all subsequent API calls

Authorization: Bearer abc123...