Sign an agreement
People module
POST/agreements/{id}/signagreements.sign
The person the agreement names signs it with their typed name and the SHA-256 of the text they read. A signed agreement cannot be revoked or unsigned; a second signature, a changed text or an agreement that is not Sent is refused (422). Requires `Idempotency-Key`; a replay returns the original response. A rule that refuses the request returns 422 with `refusal` and `reason`.
- Requires the capability me.account.write.
- OAuth scopes: me.
- Send an Idempotency-Key header. A replay with the same key returns the original response.
- Error statuses: 400, 401, 404, 409, 422, 429. Errors are RFC 9457 problem details.
Path and query parameters
| Field | Type | Required | Description |
|---|---|---|---|
| id | string (uuid) | Yes | Identifier of the agreement. |
Request body: AgreementSignRequest
| Field | Type | Required | Description |
|---|---|---|---|
| signed_name | string | Yes | Name the signer types as their signature.Constraints: length 1 to 200 |
| body_sha256 | string | Yes | SHA-256 of the agreement text the signer read, lowercase hex.Constraints: pattern ^[0-9a-f]{64}$ |
{
"signed_name": "Alex Rivera",
"body_sha256": "9f2c4e1a7b3d5f6e8a0c2e4f6a8b0d2c4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4b"
}Response 200: Agreement
| Field | Type | Required | Description |
|---|---|---|---|
| id | string (uuid) | Yes | Identifier of the agreement. |
| org_id | string (uuid) | Yes | Identifier of the owning organization, derived from the parent row and never accepted from the caller. |
| created_at | string (date-time) | Yes | When the row was created. |
| created_by | string (uuid) | null | Yes | Identifier of the person who created the row; null when a seed, platform or system process created it. |
| updated_at | string (date-time) | Yes | When the row was last updated. |
| updated_by | string (uuid) | null | Yes | Identifier of the person who last updated the row; null when a seed, platform or system process updated it. |
| title | string | Yes | Agreement title.Constraints: length 1 to 300 |
| agreement_state | "Proposed" | "Sent" | "Signed" | "Superseded" | "Expired" | "Canceled" | Yes | Agreement state. |
| signed_at | string (date-time) | null | Yes | When the agreement was signed. |
| agreement_kind | "Offer Letter" | "Contractor Agreement" | "Master Services Agreement" | "Non-Disclosure Agreement" | Yes | Kind of agreement. |
| body | string | Yes | Full text the signer reads and signs; changes only while Proposed.Constraints: length 1 to 20000 |
| project_id | string (uuid) | null | Yes | Identifier of the project the agreement covers. |
| offer_id | string (uuid) | null | Yes | Identifier of the offer the agreement follows. |
| person_id | string (uuid) | null | Yes | Identifier of the person party to the agreement. |
| counterparty_id | string (uuid) | null | Yes | Identifier of the external organization party to the agreement. |
| token_expires_at | string (date-time) | null | Yes | When the signing link stops working. |
| signed_name | string | null | Yes | Name the signer typed as their signature.Constraints: length 1 to 300 |
| signed_body_sha256 | string | null | Yes | SHA-256 of the text that was signed, lowercase hex.Constraints: pattern ^[0-9a-f]{64}$ |
{
"id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
"org_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
"created_at": "2026-10-08T14:30:00Z",
"created_by": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
"updated_at": "2026-10-08T14:30:00Z",
"updated_by": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
"title": "Crew Agreement 2026",
"agreement_state": "Proposed",
"signed_at": "2026-10-08T14:30:00Z",
"agreement_kind": "Offer Letter",
"body": "The crew member agrees to the call times in the schedule.",
"project_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
"offer_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
"person_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
"counterparty_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
"token_expires_at": "2026-10-08T14:30:00Z",
"signed_name": "Alex Rivera",
"signed_body_sha256": "9f2c4e1a7b3d5f6e8a0c2e4f6a8b0d2c4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4b"
}Code samples
curl -X POST "$XOS_BASE_URL/agreements/0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f/sign" \
-H "Authorization: Bearer $XOS_API_KEY" \
-H "Idempotency-Key: $(uuidgen)" \
-H "Content-Type: application/json" \
-d '{"signed_name":"Alex Rivera","body_sha256":"9f2c4e1a7b3d5f6e8a0c2e4f6a8b0d2c4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4b"}'const { data } = await xos.agreements.sign("0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f", {
"signed_name": "Alex Rivera",
"body_sha256": "9f2c4e1a7b3d5f6e8a0c2e4f6a8b0d2c4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4b"
});response = xos.agreements.sign("0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f", {"signed_name": "Alex Rivera", "body_sha256": "9f2c4e1a7b3d5f6e8a0c2e4f6a8b0d2c4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4b"})xos agreements sign 0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f --data '{"signed_name":"Alex Rivera","body_sha256":"9f2c4e1a7b3d5f6e8a0c2e4f6a8b0d2c4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4b"}'