Legal
Package legal is the paperwork your company needs, drafted, signed and filed.
Package legal is the paperwork your company needs, drafted, signed and filed.
| Base URL | https://api.hanzo.ai |
| Operations | 11 |
| Auth | Authorization: Bearer $HANZO_API_KEY |
legal
POST /v1/legal/documents/{id}/sign/complete
Record that a generated document's signature request completed
Records completion of the signature request opened over a generated document and answers the document with a signed flag.
The e-sign provider's own status is consulted FIRST and is the default answer; an explicit signed field in the body overrides it. That override is the whole point: the default manual provider never self-completes, so a reviewer (or a real provider's webhook) is what moves the document. A completion flips the document to signed, stamps signedAt, and writes a legal.document.signed audit event; a provider still reporting incomplete answers 200 with the document unchanged, so the call is safe to repeat and never fabricates a signature.
Org-scoped and fails closed: a validated principal is required (403 without one), the document is read under the caller's OWN org so another tenant's id is a 404, a document with no open signature request is a 400, and a provider whose status call errors is a 502.
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string | yes |
POST /v1/legal/documents/{id}/sign
Opens an e-signature request over one document and moves it to out_for_signature, returning the provider's reference for the request.
The provider is whatever this deployment has wired. The honest default is "manual": the request is recorded and the org fulfils it out of band — nothing here fabricates a signature, and the stub never reports itself complete.
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string | yes | ID is the document to send for signature, from the path. |
Request body — application/json (required)
| Field | Type | Required | Description |
|---|---|---|---|
id | string | — | ID is the document to send for signature, from the path. |
signers | legalSigner[] | — | Signers are the people who must sign, by name and email. |
GET /v1/legal/documents/{id}
Returns one of the org's documents WITH its rendered body. 404 when the org has no document with that id — a document is never readable across orgs.
The response is marked no-store: the body is contract text, sealed at rest and returned only to the owning org, and must not sit in a shared cache.
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string | yes | ID is the document's server-minted handle, "doc_"-prefixed. |
GET /v1/legal/documents
Returns the org's generated documents, newest first, WITHOUT their rendered content — fetch one document to read its body.
The response is marked no-store: these records name the counterparties an org is contracting with, and must not sit in a shared cache.
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
limit | query | integer | — | Limit bounds the page. |
POST /v1/legal/documents
Renders a document from a template and the caller's own merge data, seals it in the org's store, and returns it with its rendered body.
The render is PURE and deterministic — no clock, no I/O — so the same template version and the same data always produce identical bytes, which is what makes a generated contract reproducible. It fails CLOSED on a missing merge field: there is no blank-filled contract, only a 400 naming the fields that were absent. When the template is counsel-review the rendered body opens with the counsel notice, which no caller can suppress.
The document is a DRAFT. Hanzo Legal manages documents; it does not give legal advice and does not determine that a document is valid or sufficient.
Request body — application/json (required)
| Field | Type | Required | Description |
|---|---|---|---|
data | object | — | Data supplies every merge field the template declares, keyed by field key. |
templateId | string | — | TemplateID is the template to render. |
GET /v1/legal/filings
Returns the org's filing records, newest first — which documents were filed where, through which provider, and what the filing's honest status is.
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
limit | query | integer | — | Limit bounds the page. |
POST /v1/legal/filings
Records a filing of one or more of the org's documents with a state or agency, and returns the tracking record.
It is a TRACKING record, not an autonomous filing. With no filing partner wired the honest status is "manual" and the note says so: the documents were generated for signature, and the org files them through its registered agent. Nothing here invents a filing id it does not have.
Every document id must belong to the caller's org; one that does not is a 404 naming it, so a filing can never reach across tenants.
Request body — application/json (required)
| Field | Type | Required | Description |
|---|---|---|---|
documentIds | string[] | — | DocumentIDs are the documents to file. At least one is required, and every one must belong to the caller's org — a… |
jurisdiction | string | — | Jurisdiction is the state or agency the filing is for, e.g. |
GET /v1/legal/health
Reports that the legal subsystem is serving and how many built-in templates its catalog carries. It reads no tenant, so a liveness prober that sends no principal is answered rather than refused.
GET /v1/legal/templates/{id}
Returns one template resolved for the caller's org — the org's own override if it has saved one, else the built-in — with its full text/template body and its declared merge fields. 404 when neither exists.
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string | yes | ID is the template's stable id, e.g. |
PUT /v1/legal/templates/{id}
Saves the org's own version of a template — a custom NDA, a house MSA — and returns it with its new version number. It takes effect for that org only; other orgs keep the built-in.
Two boundaries cannot be crossed here. Overriding a built-in INHERITS its category and its counsel-review posture, which can be raised but never dropped; and a formation or equity template is counsel-review whatever the caller sends, so no org can generate a securities-class document without the notice.
The body is validated on save, not at generation: a template that references an UNDECLARED merge field is refused with 400 rather than stored and rendered blank into a contract months later.
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string | yes | ID is the template to override, from the path. |
Request body — application/json (required)
| Field | Type | Required | Description |
|---|---|---|---|
body | string | — | Body is the text/template source. Required. |
category | string | — | Category groups the template: formation, equity, ops or sales. |
counselReview | boolean | — | CounselReview marks a template whose documents must carry the counsel notice. |
fields | Field[] | — | Fields declares the merge fields the body consumes. |
id | string | — | ID is the template to override, from the path. |
title | string | — | Title is the template's display name. |
GET /v1/legal/templates
Returns the org's effective template catalog: every built-in template, with any the org has overridden replaced by its own latest version.
The listing carries each template's metadata and its declared MERGE FIELDS — the keys a document generation must supply — but never the template bodies; fetch one template to get its body. Templates in the formation and equity categories are marked counselReview: every document rendered from them carries a counsel notice, and that posture cannot be dropped by an override.
How is this guide?