API Terms

These terms cover the KovaPDF API: the keys, the endpoints under /api/v1 and the webhooks we send. They add to our Terms of Use and Privacy Policy, which apply to the API as they do to the website. Where the two differ on something about the API, these terms win.

A key acts as the account that made it. You are responsible for everything done with your keys, by you or by anyone you let use them.

Use the API to send your own documents for signature, to sign documents you have the right to sign, to check signed PDFs, and to run KovaPDF tools on files you have the right to use. In particular:

• Send a signature request only to people who expect it from you, about a real document between you and them.
• Sign with a certificate only when it is yours, or when you are allowed to sign with it.
• Upload only files you have the right to share with us for this purpose.
• Tell the people whose documents pass through your software that you use a service like ours to handle them, as your own privacy rules require.

• Spam. No signature requests to lists of people, to addresses you bought or collected, or to anyone who has not asked for the document. A signature request is not a way to send marketing.
• Unlawful use. Nothing that breaks the law where you or the signers are: no fraud, no forged signatures, no documents meant to deceive, no harassment.
• Pretending to be someone else. No requests that look as if they come from a company or person you are not.
• Harm to the service. No attempts to get around limits, scopes or IP allow lists, to reach other people’s data, or to slow the service down for others. Security research is welcome within the rules on our Security page.
• Reselling the API as it is. You may build it into your own product. You may not resell plain access to it, or hand your keys to others, unless we agree in writing.

• A test key starts with kova_test_. You make it in your account once your email address is verified, and you can hold one at a time.
• It runs 10 tasks within 14 days of your first test key. A task is one signature request made, one verification or one digital signing. Then it stops working.
• Every email a test request sends goes only to the verified address on your account, whatever addresses the request names. Every file it makes is marked TEST.
• Test documents are not for real agreements. Signature requests made with a test key are deleted 7 days after they were made.
• Do not make several accounts to get more test tasks. If you need more to finish an integration, ask us.

A live key starts with kova_live_ and works only once we have turned API access on for your account. We do that after you have asked on the request form and accepted our written offer. The offer says what is included, the price, and when access starts and ends. If anything in the offer differs from these terms, the offer wins for that point.

We may decline a request for live access, for example when what you describe does not fit these terms.

• Each key may make 60 calls a minute and send 30 signature requests an hour, and has a daily cap shown in your account.
• Live access has a monthly task limit or a pack of tasks, as your offer says. At the limit, calls stop with a clear answer. We do not charge anything on top.
• The limits of your account on the website still apply to the API.
• Build your software to handle a refused call: wait for the time in the Retry-After header, and send the same Idempotency-Key when you try again.

The API reference lists every limit and the answer you get at each one.

Automatic pause. A key pauses itself when it runs far more tasks in 10 minutes than an integration normally does, or when too many of the signing emails its requests send in a day bounce. A paused key gets 403 key_paused. We tell you by email, look at what happened with you, and turn the key back on when the use is real. This protects the people your requests reach, and the service for everyone else.

Apps and tools. We may pause one of our apps or one tool for apps; a paused call gets 403 integration_paused or tool_paused with a plain message. Plain API key calls to the signing and verify API keep working as usual.

Suspension. We may pause a key or your API access, without notice when we must act at once, if you break these terms, if your use puts other people or the service at risk, or if the law requires it. When we can, we tell you first and give you time to fix the problem. Write to support@kovapdf.com if you think we got it wrong.

• Signature requests and their documents are deleted 30 days after the request is finished (signed, declined, expired or cancelled). Test requests are deleted 7 days after they were made.
• Files you upload with the tools API, and the results of jobs, can be used for one hour at most and are then deleted. Download links last 15 minutes.
• PDFs you send to sign or verify are processed and not kept, except when you send them as a tools API job, as described above. One more exception: when a POST carries an Idempotency-Key, its answer is kept for 24 hours so that a retry gets it back. For digital signing that answer is the signed PDF.
• Certificates and their passwords are used once, in memory, and never stored or logged.
• Download what you need to keep. KovaPDF is not an archive.

• Keep keys on your server. Never put one in a web page, a mobile app or a public code repository.
• We keep only a hash of each key and show the full key once. If a key may have leaked, revoke it in your account straight away; it stops working on the next call.
• Give each key only the scopes it needs, an end date if you can, and an IP allow list for your servers.
• Check the KovaPDF-Signature header of every webhook before you act on it.
• Tell us at support@kovapdf.com if you find a security problem.

We may change the API and these terms. New fields, new endpoints and new error codes can appear at any time, so write your code to ignore what it does not know.

The changelog lists what changed and when. If you keep using the API after a change to these terms, the new terms apply. If you do not accept them, stop using the API and revoke your keys.

Questions about these terms, or about your API access: support@kovapdf.com.