Developer FAQ
Quick answers to common technical questions about building on the SpotDraft public API. For questions about your plan, security certifications, or legal terms, contact your SpotDraft account team or the Trust Center.
API and webhook integration scope
Can external systems integrate with SpotDraft?
Yes. SpotDraft supports API and webhook based integrations for common CLM flows such as creating contracts from upstream systems, updating contract metadata, importing executed contracts, receiving lifecycle events, and syncing contract status or documents back to downstream systems.
Typical source systems include CRM, CPQ, ERP, procurement, HRMS, intake, and custom business applications. Typical downstream systems include data warehouses, document storage, reporting tools, finance systems, and operational workflow tools.
Can SpotDraft integrate with Salesforce, SAP, HRMS, or custom applications?
Yes, provided the use case is compatible with the enabled SpotDraft product capabilities and public API surface. These are standard business-system integrations — you can implement them through a native integration, the public APIs and webhooks, a partner-built integration, or your own middleware.
Not every field, workflow setting, or admin action is API-configurable, so validate endpoint coverage before you commit to a specific requirement.
Do standard integrations create a performance concern?
Standard integrations with business systems such as CRM, ERP, HRMS, CPQ, procurement, or reporting tools are expected integration patterns. The concern is usually unapproved automation that harms service performance, such as scraping tools, custom bots, or clients that make excessive API calls without rate-limit handling.
Should you build an integration or use an existing one?
Start by checking whether an existing SpotDraft integration already covers the use case. Build with public APIs and webhooks when you have a custom source system, a custom data model, a non-standard workflow, or a downstream sync requirement that is not covered by a native integration.
Technology partners who want to build a reusable integration can use the partner interest form.
Can SpotDraft be embedded into another product?
Some SpotDraft experiences are built for embedding, such as Clickwrap SDK. Do not assume the full SpotDraft CLM application can be embedded into another product unless that specific path has been validated.
Common integration flows
What integration pattern do most teams use?
The most common pattern is:
- The source system sends commercial context, counterparties, signatories, source identifiers, and contract data to SpotDraft.
- SpotDraft manages the contract lifecycle across creation, review, approvals, signature, execution, and storage.
- SpotDraft sends webhook events when important lifecycle changes occur.
- The integration fetches fresh contract, metadata, or document state from the API when downstream systems need more detail.
Use Platform 101 and Data Model for the full orientation.
Can integrations create contracts from another system?
Yes. Public APIs can support flows that create contracts from templates, upload third-party paper for review or signature, import externally executed contracts, and attach source-system identifiers for lookup and reconciliation. The exact endpoint depends on the contract type and workflow pattern.
Can an integration upload third-party paper for review or signature?
Yes, where the workflow is supported by the public API and the workspace is configured for that contract process. The integration should send the file, choose the correct contract type or workflow path, pass required metadata, and then rely on SpotDraft to manage review, approval, signature, and repository storage.
Can externally signed contracts be imported into SpotDraft?
Yes. A common repository integration pattern is to bring externally executed agreements into SpotDraft with the executed document, contract metadata, counterparty details, source-system ids, and any searchable fields needed for reporting or later lookup.
Can SpotDraft sync status, metadata, and documents back to downstream systems?
Yes. The recommended approach is event-driven. Subscribe to relevant webhook events, dedupe each event in your receiver, and then fetch the latest contract state or documents from the API before updating downstream systems.
Should downstream systems rely only on webhook payloads?
No. Treat webhooks as lifecycle signals. If the downstream system needs a complete or authoritative view, use the event to trigger a fresh API read, then sync the current contract, metadata, document, or status into the downstream system.
Can an integration keep source-system ids on contracts?
Yes. Store stable source-system identifiers in external metadata or another supported structured field. This allows lookup, reconciliation, and downstream sync without relying on contract names or human-readable values that may change.
Environments and rollout
Should implementation start in QA or production?
Start in a QA workspace whenever possible. Ask your SpotDraft CSM for a QA workspace, implement and test the API and webhook integration there, then repeat the setup in production after the behavior is stable.
This avoids disrupting production templates, contracts, counterparties, metadata, approval routing, and workflow settings.
Are QA and production interchangeable?
No. Treat them as separate systems. Credentials, webhook registrations, contract type ids, template ids, metadata keys, users, roles, entities, and workflow settings can differ between environments.
What should be validated before production rollout?
Validate the regional API host, API credentials, webhook endpoint URL, subscribed event types, contract types, templates, questionnaire or intake fields, user and role access, entity setup, signing behavior, metadata mappings, retry behavior, and reconciliation plan.
Can production configuration be copied directly from QA?
Do not copy identifiers blindly. A template, contract type, entity, role, metadata key, or webhook id from QA may not exist in production. Use environment-specific configuration and promote the mapping intentionally.
Authentication, regions, and limits
How are API calls authenticated?
Server-to-server API calls use client-id and client-secret headers. Some endpoints may also support user-email when the request must act in the context of an active workspace user.
Use Authentication and Regions for regional base URLs and request header details.
Are there different regional API hosts?
Yes. Use the API base URL for the region where the workspace is provisioned. Keep API calls, webhook setup, and embedded flows aligned to the same workspace region.
What is the public API rate limit?
SpotDraft applies a public API rate limit of 10 requests per second per workspace.
Webhook deliveries from SpotDraft are excluded from this API request limit. If your integration receives 429 Too Many Requests, slow down with bounded exponential backoff and jitter rather than retrying in a tight loop.
Does SpotDraft provide read-only APIs for security audits?
The public APIs are primarily for CLM integration workflows, not a blanket replacement for security-audit exports or SIEM integrations. Validate the exact endpoint, permission model, and workspace access before designing an audit-style export.
Metadata and data model
What data should an integration send to SpotDraft?
Send the data SpotDraft needs to create, route, review, sign, store, and report on the contract. This often includes source-system ids, counterparty details, signatories, commercial fields, contract type, template choice, intake answers, questionnaire responses, and metadata needed for downstream reporting.
What is external metadata used for?
External metadata stores identifiers and integration-owned values that help connect a SpotDraft contract to records in other systems. Common examples include CRM opportunity ids, ERP vendor ids, procurement request ids, CPQ quote ids, and external workflow ids.
Use stable identifiers from the source system. Avoid storing secrets, tokens, or sensitive operational logs as metadata.
What is the difference between contract data, metadata, and external metadata?
Contract data is the structured data used to generate, route, or describe a contract in SpotDraft. Metadata is structured information used for repository organization, reporting, filtering, and workflow context. External metadata is integration-owned data used to connect SpotDraft records to records in other systems.
Can metadata be updated after contract creation?
Yes, where supported by the public API and workspace configuration. Design updates carefully: a downstream system should know whether it owns a field, mirrors a field, or only reads it from SpotDraft.
How should field ownership be modeled?
Use a clear ownership model. The source system usually owns upstream commercial data. SpotDraft owns CLM lifecycle state and contract workflow state. Downstream systems should store derived or synced copies and reconcile from SpotDraft when lifecycle state changes.
Webhooks and operational debugging
What are webhooks used for?
Webhooks notify your integration about lifecycle changes so downstream systems do not need to poll continuously. Your receiver should verify the webhook signature, return a fast 2xx, enqueue slow work, and process events idempotently.
Use Webhooks for receiver setup and signature verification.
Are webhooks guaranteed to be delivered exactly once?
Design webhook receivers as if duplicate or delayed events can happen. Store a dedupe key, make downstream writes idempotent, and fetch fresh API state before making high-impact updates.
Do webhook deliveries retry if the endpoint fails or times out?
Yes. The first delivery is immediate. Failed deliveries retry at 5, 10, 20, 40, 80, then 160 minutes. Every failed POST, including the first attempt, increments a consecutive-failure counter on the subscription. After 6 consecutive failures SpotDraft disables the webhook and skips remaining retries, so an always-failing endpoint receives 6 POSTs, not 7. Use Webhooks for timeouts and receiver design.
Does SpotDraft expose API or webhook logs in the product?
SpotDraft shows webhook logs in the app. API logs are not exposed. Your integration should still keep its own logs for outbound API requests, inbound webhook deliveries, signature verification, queue jobs, retries, and downstream processing results.
What should developers log?
Log the HTTP method, regional host, path, environment, response status, internal request id, retry count, webhook event type, contract id, delivery id or payload hash, signature result, queue job id, and downstream sync result.
Do not log client-secret, bearer tokens, signed document URLs, or sensitive contract content.
How should teams debug webhook failures?
Start with the receiver. Confirm the endpoint is public, uses HTTPS, accepts POST, verifies signatures from the raw request body, responds quickly with 2xx, and records delivery attempts in the integration's own logs. If downstream state is stale, reconcile by fetching fresh contract state from the API.
Should integrations poll instead of using webhooks?
Use webhooks as the primary lifecycle signal. Polling can be used as a repair or reconciliation strategy, but it should not replace webhook-driven design for normal operation.
Security, access, and compliance
Does SpotDraft support role-based access controls?
SpotDraft workspaces support role-based access and product-level permissions. API behavior can also depend on the credential context and, when used, the active workspace user passed through user-email.
Can SpotDraft support SSO, SCIM, and MFA?
SpotDraft supports enterprise identity and access patterns through product-level configuration. Whether SSO, SCIM, MFA, or a specific identity-provider setup is available depends on your workspace configuration and plan. Confirm the exact requirement with your SpotDraft account team.
Are user actions auditable?
SpotDraft exposes contract activity in the product for contract lifecycle actions. API-accessible audit or activity data depends on the public API surface available for your workspace and use case.
For security certifications, audit reports, disaster-recovery and backup evidence, data retention and deletion terms, provisioning and deprovisioning, real-time security-event alerting, and AI governance, contact your SpotDraft account team or the Trust Center.
Data, privacy, and resilience
What customer data can appear in an integration?
Depending on the workflow, integrations may process contract documents, contract metadata, counterparty information, signatory information, intake answers, questionnaire responses, workflow status, comments or task context, and source-system identifiers. Only send fields that are needed for the integration.
Can SpotDraft back up data directly into your environment?
Customer-managed backup is not a standard public API capability. If you need downstream document or metadata sync, design an integration that exports supported contract data or documents into your storage system. For legal backup ownership, contact your SpotDraft account team.
How is PII in logs handled?
Your integration owns its logs. Avoid logging secrets, tokens, signed URLs, or sensitive contract content.