# Get sign URL: https://docs.hanzo.ai/docs/openapi/esign/get-esign-o-by-org-sign-by-token > Opens a document you were asked to sign, using your signing link. `GET /v1/esign/o/{org}/sign/{token}` > [eSign →](https://docs.hanzo.ai/docs/openapi/esign) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides) | | | | ------------- | ---------------------------------------------------- | | **Address** | `https://api.hanzo.ai/v1/esign/o/{org}/sign/{token}` | | **Method** | `GET` | | **Operation** | `get_esign_o_by_org_sign_by_token` | | **Auth** | `Authorization: Bearer $HANZO_API_KEY` | Opens a document you were asked to sign, using your signing link. It answers the document, the recipient the link identifies, the fields THAT recipient must fill, and the PDF to display. The first open also marks the recipient as having opened it and records that on the audit trail, so this read has a side effect by design. This surface takes NO account: the signing token is the entire credential, and it names the recipient, so a signer sees only their own fields and never the other recipients' tokens. The token resolves to its owning tenant FIRST, before any per-tenant store is opened, and the org segment is only checked against that answer. An unknown or wrong-org token is one and the same 404, never a hint that some other document exists. ## Request 2 fields. | Field | In | Type | Required | Description | | ------- | ---- | ------ | -------- | ----------- | | `org` | path | string | yes | | | `token` | path | string | yes | | ## Response | Status | Body | Meaning | | --------- | ------------------ | ------- | | `200` | esign.esignSession | ok | | `default` | problem-details | refused | `200` body — 23 fields. | Field | In | Type | Always | Description | | ------------------------- | ---- | ------------------- | ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | `document` | body | esign.esignState | — | | | `document.id` | body | string | — | ID is the document id. | | `document.status` | body | string | — | Status is PENDING while it is out for signature. | | `document.title` | body | string | — | Title is the document's name. | | `fields` | body | esign.esignField\[] | — | Fields is only the fields this recipient must fill — never another party's, so the layout a signer sees cannot reveal what anyone else was asked for. | | `fields[].customText` | body | string | — | CustomText is the value a non-signature field was filled with, empty until it is. | | `fields[].fieldMeta` | body | any | — | FieldMeta is the caller's own metadata for this field, stored verbatim at placement and never interpreted. | | `fields[].height` | body | number (double) | — | Height is the field's height, -1 when the renderer is to choose one. | | `fields[].id` | body | string | — | ID is the field id. | | `fields[].inserted` | body | boolean | — | Inserted is whether this field has been filled in. | | `fields[].page` | body | number (double) | — | Page is the 1-based page the field sits on. | | `fields[].positionX` | body | number (double) | — | PositionX is the field's horizontal position on that page. | | `fields[].positionY` | body | number (double) | — | PositionY is the field's vertical position on that page. | | `fields[].recipientId` | body | string | — | RecipientID is who must fill this field. | | `fields[].type` | body | string | — | Type is what the field collects — SIGNATURE, DATE, NAME, EMAIL, TEXT and the rest. | | `fields[].width` | body | number (double) | — | Width is the field's width, -1 when the renderer is to choose one. | | `pdfBase64` | body | string | — | PdfBase64 is the PDF to display, base64-encoded. | | `recipient` | body | esign.esignSigner | — | | | `recipient.email` | body | string | — | Email is the address the link was issued to. | | `recipient.id` | body | string | — | ID is the recipient id. | | `recipient.name` | body | string | — | Name is the display name recorded for them, empty when none was given. | | `recipient.role` | body | string | — | Role is the role they were added with. | | `recipient.signingStatus` | body | string | — | SigningStatus is NOT\_SIGNED until they finish or decline. | Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors). ## Examples **CLI** ```bash hanzo esign o sign get ``` **SDK** **.ts** ```ts import { Configuration, EsignApi } from 'hanzoai'; const api = new EsignApi(new Configuration({ accessToken: process.env.HANZO_API_KEY })); const { data } = await api.getEsignOByOrgSignByToken({ org: 'org', token: 'token' }); ``` **.py** ```python from hanzoai.cloud import ApiClient, Configuration from hanzoai.cloud.api import EsignApi client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"])) result = EsignApi(client).get_esign_o_by_org_sign_by_token(org='org', token='token') ``` **.go** ```go cfg := hanzoai.NewConfiguration() cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY")) client := hanzoai.NewAPIClient(cfg) resp, _, err := client.EsignAPI.GetEsignOByOrgSignByToken(context.Background()).Execute() if err != nil { return err } ``` **.rs** ```rust use hanzo_client::apis::{configuration::Configuration, esign_api}; let mut cfg = Configuration::new(); cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok(); let result = esign_api::get_esign_o_by_org_sign_by_token(&cfg, Default::default()).await?; ``` **.java** ```java import ai.hanzo.cloud.ApiClient; import ai.hanzo.cloud.api.EsignApi; ApiClient client = new ApiClient(); client.setBearerToken(System.getenv("HANZO_API_KEY")); var result = new EsignApi(client).getEsignOByOrgSignByToken(); ``` The method above is the one at the current release of the document. `hanzoai@8.5.914` (PyPI) was generated from an earlier release, where this operation carried a different id, so it spells the method differently — regenerating the clients is what makes the two agree. [SDKs →](https://docs.hanzo.ai/docs/sdks) **HTTP** ```bash curl https://api.hanzo.ai/v1/esign/o//sign/ \ -H "Authorization: Bearer $HANZO_API_KEY" ``` **MCP** MCP reaches **esign** through the `esign` tool, which names its 9 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them: ```bash curl -X POST https://api.hanzo.ai/v1/mcp \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "describe", "arguments": { "op": "list_esign_documents" } } }' ``` --- [eSign API](https://docs.hanzo.ai/docs/openapi/esign) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)