> ## Documentation Index > Fetch the complete documentation index at: https://docs.spitshake.io/llms.txt > Use this file to discover all available pages before exploring further. # Validate template field assignments > Validates current or proposed field-to-submitter assignments without persisting any changes. Use this to catch automapping mistakes before sending documents. ## OpenAPI ````yaml post /api/templates/{id}/validate_assignments openapi: 3.0.3 info: title: SpitShake API version: 1.0.0 description: > SpitShake is a document signing and e-signature platform. This API allows you to manage templates, send documents for signing, track submissions, and integrate document signing into your applications. ## Authentication SpitShake supports the tenant authentication methods below plus an isolated partner credential: ### API Token (Recommended) Pass your API token in the `X-Auth-Token` header or as `Authorization: Bearer `. Generate tokens at **Settings > API** with granular scopes. ``` curl -H "X-Auth-Token: YOUR_TOKEN" https://your-instance.com/api/templates ``` ### OAuth 2.1 (Authorization Code + PKCE) For connector directories and third-party agents. Discover endpoints at `GET /.well-known/oauth-authorization-server`. PKCE is mandatory. ### Session Cookie Automatically set when logged into the web application. Used by the frontend. ### JWT Bearer Token (Embed API only) For embedded forms and builders. Generate via `POST /api/embed/token`. ``` curl -H "Authorization: Bearer JWT_TOKEN" https://your-instance.com/api/embed/submission/123 ``` ### Partner Bearer Key (`/api/partner/v1` only) Operator-issued `spk_` keys authenticate the reseller control plane. Partner keys and tenant credentials are mutually non-acceptable. ## Idempotency Create and send operations accept an `Idempotency-Key` header. A repeated request with the same key and body replays the original response without creating a duplicate. Keys expire after 24 hours. ## Versioning Tenant API responses include an `X-API-Version: v1` header. The tenant API is available at both `/api/*` and `/api/v1/*` (explicit pin). Partner responses include `X-API-Version: partner-v1`, and that control plane is separately pinned at `/api/partner/v1/*`. ## Pagination List endpoints use cursor-based pagination: | Parameter | Type | Description | |-----------|------|-------------| | `limit` | integer | Items per page (1-100, default 10) | | `after` | integer | Return items after this ID | | `before` | integer | Return items before this ID | Response includes a `pagination` object: ```json { "data": [...], "pagination": { "count": 10, "next": 456, "prev": 123 } } ``` Use `pagination.next` as the `after` parameter to get the next page. ## Rate Limits API requests are limited to 120 requests per minute per API token. Partner API requests are limited to 100 requests per minute per partner key. ## Errors All errors return a JSON object with an `error` field: ```json { "error": "Not found" } ``` | Status | Meaning | |--------|---------| | 400 | Bad request - invalid parameters | | 401 | Unauthorized - invalid or missing authentication | | 403 | Forbidden - insufficient permissions or plan limits exceeded | | 404 | Not found | | 422 | Unprocessable entity - validation errors | | 500 | Internal server error (includes `detail` field with exception message for debugging) | ## Plan Limits Some endpoints require specific subscription plans. If your plan doesn't support an endpoint, you'll receive a 403 response with an `upgrade_url` field. contact: name: SpitShake Support url: https://spitshake.io license: name: Proprietary servers: - url: / description: Current instance security: - ApiToken: [] - SessionCookie: [] tags: - name: Templates description: Manage document templates with fields, submitters, and documents - name: Submissions description: Create and manage document signing submissions - name: Submitters description: Manage individual submitters (signers) within submissions - name: Users description: Manage account users and team members - name: Access Tokens description: Manage API tokens for programmatic access (requires Pro plan) - name: Webhooks description: Configure webhook endpoints for event notifications (requires Pro plan) - name: Settings description: Account settings, SMTP, storage, certificates, and email configuration - name: Audit Events description: View audit log of account activities (requires Pro plan) - name: Subscriptions description: View current plan, usage, and manage billing - name: Plans description: List available subscription plans (public) - name: Payments description: Process payments within signing flows via Stripe - name: Verification description: SMS OTP phone verification for signing sessions - name: KBA description: Knowledge-Based Authentication for identity verification - name: AI description: AI-powered document analysis and field detection - name: Embed description: Embed signing forms and template builders in your application - name: Custom Domains description: >- Manage custom signing domains with automatic SSL provisioning via Cloudflare - name: Teams description: Team management and template access control - name: Health description: System health check endpoints (public) - name: MFA description: Multi-Factor Authentication setup, management, and verification - name: BAA description: Business Associate Agreement acceptance and management (HIPAA) - name: Security Events description: Security event monitoring and breach detection dashboard (admin only) - name: Thumbnails description: Template document thumbnail generation and retrieval - name: Partner API description: >- Versioned reseller control plane for provisioning and metering isolated tenant accounts paths: /api/templates/{id}/validate_assignments: post: tags: - Templates summary: Validate template field assignments description: > Validates current or proposed field-to-submitter assignments without persisting any changes. Use this to catch automapping mistakes before sending documents. operationId: validateTemplateAssignments parameters: - name: id in: path required: true schema: type: integer requestBody: required: false content: application/json: schema: type: object properties: field_assignments: type: array description: Optional proposed assignment overrides for validation items: $ref: '#/components/schemas/FieldAssignment' required_signature_submitter_uuids: type: array description: >- Optional submitter UUIDs that must have at least one signature or initials field items: type: string format: uuid responses: '200': description: Assignment validation passed content: application/json: schema: $ref: '#/components/schemas/TemplateAssignmentValidationResponse' '422': description: Assignment validation failed content: application/json: schema: $ref: '#/components/schemas/TemplateAssignmentValidationResponse' components: schemas: FieldAssignment: type: object required: - field_uuid - submitter_uuid properties: field_uuid: type: string format: uuid submitter_uuid: type: string format: uuid TemplateAssignmentValidationResponse: type: object properties: valid: type: boolean errors: type: array items: $ref: '#/components/schemas/TemplateAssignmentValidationIssue' warnings: type: array items: $ref: '#/components/schemas/TemplateAssignmentValidationIssue' summary: $ref: '#/components/schemas/TemplateAssignmentValidationSummary' TemplateAssignmentValidationIssue: type: object properties: code: type: string description: Machine-readable issue code message: type: string field_uuid: type: string format: uuid nullable: true submitter_uuid: type: string format: uuid nullable: true submitter_name: type: string nullable: true TemplateAssignmentValidationSummary: type: object properties: total_fields: type: integer total_submitters: type: integer assignment_count: type: integer submitters: type: array items: $ref: '#/components/schemas/TemplateAssignmentSubmitterSummary' TemplateAssignmentSubmitterSummary: type: object properties: submitter_uuid: type: string format: uuid submitter_name: type: string field_count: type: integer signature_field_count: type: integer securitySchemes: ApiToken: type: apiKey in: header name: X-Auth-Token description: API token generated at Settings > API SessionCookie: type: apiKey in: cookie name: _docutrust_session description: Session cookie (automatic when logged in) ````