Changelog

Newest first. Additive changes are listed for information; breaking changes are announced ahead of time (see Versioning & changes).

2026-10 — Member invitations

• Changed: the locale of the body of POST /v1/orgs/:orgId/members is optional; when omitted, a new member gets the default language of the provider (it used to default to fr).
• New: the member views carry invitationResentAt (date of the last resend of a pending invitation). Invitation emails now come from the platform with a stable link; Webhooks are unchanged.

2026-10 — Signature approval removed

• Removed (breaking): the internal approval of signature requests. The approve and reject operations of a signature request no longer exist; the statuses pending_approval and rejected, the fields approval and canApprove of a request, the toApprove filter of the list and approvalRequired of the options are gone. A request is sent to the signers as soon as it is created.
• Existing requests: pending_approval became draft (send it again from the app), rejected became canceled.
• Removed webhook event signature.rejected (taken out of the subscriptions) and error codes signature_request_pending_approval, signature_request_not_pending_approval, signature_request_rejected, self_approval_forbidden.

2026-10 — Test mode

• New: test mode. An organization can enable a free test twin with its own API keys and webhooks, simulated or sandboxed vendors, watermarked documents and [TEST] emails, purged after 90 days of inactivity.
• Webhook events carry a livemode field and an X-MLT-Livemode header (false for the events of a test organization).
• New error codes: test_mode_not_available, test_mode_root_only, test_mode_disabled, test_mode_daily_email_cap, confirm_name_mismatch.

2026-10 — Delegated OAuth

• New: delegated OAuth. Connected apps act for signed-in people with tokens of the identity provider of the MyCLM provider (authorization code + PKCE, private_key_jwt), after the consent of the person on the MyCLM authorize page. Organization administrators approve the application and may consent on behalf of all members.
• Removed: the X-Act-As header and the act_as scope (replaced by delegated OAuth). Partner machine credentials (client_credentials) are limited to provisioning and administration scopes.
• The API only accepts tokens of registered OAuth clients (401 unknown_client).
• Access tokens are valid for 10 minutes (was up to 12 hours).
• Provisioned roles are bounded by the role of the application grant (403 role_escalation).

2026-10 — Public API documentation

• New developer documentation site: guides in four languages (curl, Node.js, Python, PHP) and an interactive API reference.
• The public OpenAPI 3.1 document is served by the API at GET /openapi.json (public, cacheable). It contains only the public operations, with examples and error codes for each.
• 429 rate_limited responses now carry Retry-After and the RateLimit-* headers.
• The CORS configuration exposes the RateLimit-*, Retry-After and Content-Disposition headers to browsers.
• The former /docs/getting-started page redirects to this site.

Initial release

• Signature requests, registered mail (LRE) and sender accounts, contacts, tasks.
• Organization structure and members.
• API keys (client credentials), partner applications, provisioning by externalId, OAuth consent for connected apps and user delegation (since replaced by delegated OAuth).
• Outbound webhooks signed with HMAC-SHA256, with retries, automatic deactivation and replay.