> ## Documentation Index
> Fetch the complete documentation index at: https://docs.firma.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Replace or rename a signing request document

> Send exactly one of `document_id` (replace the document with a temporary upload from `POST /documents`: the same number of pages, every page the same size within 1 pt) or `label` (rename). Both, or neither, answers `400 VALIDATION_ERROR`. A document placed with anchor tags is replaced only when the anchors of the replacement resolve exactly as stored; otherwise `400 ANCHOR_MISMATCH`. A sent, finished, cancelled or declined signing request answers `409 DOCUMENT_SET_LOCKED`.

**Enablement required.** This operation is part of the multi-document contract (API 01.39.00). It is served only for companies enabled for multi-document documents; for any other company, and for a signing request or template the API key cannot see, it answers `404` with code `NOT_FOUND` ("Endpoint not found"), exactly as an unknown endpoint does.



## OpenAPI

````yaml api-reference/v01.39.01/openapi-v01.39.01.json patch /signing-requests/{id}/documents/{document_id}
openapi: 3.0.3
info:
  title: Firma Partner API
  description: >-
    RESTful API for document signing and template management.


    **Authentication**: All endpoints require API key authentication via the
    `Authorization` header. Use your API key directly without any prefix (e.g.,
    `your-api-key`). The Bearer prefix is optional but not required.


    **Security Features**:

    - Input validation using Zod schemas with detailed field-level error
    messages

    - RSA-256 signed JWT tokens for embedded template access


    **Rate Limiting**: Rate limits are tiered based on operation type:

    - Read operations (GET): 200 requests per minute

    - Write operations (POST/PUT/PATCH/DELETE): 120 requests per minute

    - Webhook CRUD operations: 60 requests per minute

    - Webhook test: 10 requests per minute

    - API key regeneration/expiration: 1 request per minute

    - Webhook secret rotation: 1 request per minute


    When rate limits are exceeded, the API returns a `429 Too Many Requests`
    response with headers:

    - `X-RateLimit-Limit`: Maximum requests per minute for this endpoint

    - `X-RateLimit-Remaining`: Requests remaining in current window

    - `X-RateLimit-Reset`: Unix timestamp when limit resets

    - `Retry-After`: Seconds until retry is allowed


    **Error Handling**: All errors return structured JSON responses with `error`
    (human-readable message), `code` (machine-readable identifier), and
    `details` (field-level validation errors when applicable).


    **Embedded Template Integration**: The Firma Template Editor can be embedded
    in your application using a standalone JavaScript library.


    ```html

    <!-- Load the Firma Template Editor library -->

    <script
    src="https://api.firma.dev/functions/v1/embed-proxy/template-editor.js"></script>


    <script>

    // Generate JWT token via API first

    fetch('https://api.firma.dev/functions/v1/signing-request-api/generate-template-token',
    {
      method: 'POST',
      headers: {
        'Authorization': 'YOUR_API_KEY',
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({
        companies_workspaces_templates_id: 'template-id'
      })
    })

    .then(res => res.json())

    .then(data => {
      // Initialize editor with JWT token
      window.FirmaTemplateEditor.init({
        container: '#firma-editor-container',
        jwt: data.token,
        templateId: 'template-id',
        theme: 'dark',
        readOnly: false,
        onSave: (savedData) => {
          console.log('Template saved:', savedData);
        },
        onError: (error) => {
          console.error('Editor error:', error);
        },
        onLoad: (template) => {
          console.log('Template loaded:', template);
        }
      });
    });

    ```


    **X-Firma-Deprecation Header**: Some seal creation and image update
    operations return an `X-Firma-Deprecation` response header when called on
    the edge gateway, indicating the operation should be performed on the
    primary API host instead.


    **Multi-document documents (API 01.39.00, enablement required)**: a template
    or signing request can hold up to 20 documents. The `/documents`
    sub-resource routes and the `documents`, `documents_version` and
    `documents_layout_version` keys are served only for companies enabled for
    multi-document documents; for any other company the routes answer `404
    NOT_FOUND` and the keys are absent.


    **Template seals on create (API 01.39.01)**: creating a signing request from
    a template with `POST /signing-requests` or `POST
    /signing-requests/create-and-send` now inherits the template's seal
    participants, and the template fields that belong to them, when
    `seal_participants` is absent or `null`. This changes the behaviour of v1
    without a version bump; send `seal_participants: []` to create the request
    with no seals. `POST /templates/{id}/duplicate` also carries the template's
    seal participants over; see that operation for how it differs for companies
    enabled for multi-document documents. `GET /templates/{id}` returns
    `seal_participants`, and `POST /templates` answers `warnings` when its body
    contains keys it ignores.
  version: 01.39.01
  contact:
    name: API Support
    url: https://firma.com/support
servers:
  - url: https://api.firma.dev/functions/v1/signing-request-api
    description: Production API - Recommended (Current)
  - url: https://api.firma.dev/api/v1
    description: Production API - Planned
security:
  - ApiKeyAuth: []
tags:
  - name: Company
    description: Company information and settings
  - name: Workspaces
    description: Workspace management operations
  - name: Templates
    description: Template management operations
  - name: Signing Requests
    description: Document signing request operations
  - name: Custom Fields
    description: >-
      Custom field definition management for workspaces, templates, and signing
      requests
  - name: Webhooks
    description: Webhook configuration and management
  - name: JWT Management
    description: JWT token generation and revocation for embedded templates
  - name: Workspace Settings
    description: Workspace configuration and settings
  - name: Email Domains
    description: >-
      Email domain setup and verification for sending signing request emails
      from custom domains
  - name: Email Templates
    description: >-
      Email template management for workspace and company-level customization of
      signing request notifications
  - name: Organization Seals
    description: >-
      Organization seal management: create, update, revoke, and erase seals
      applied to signing requests
  - name: Signer Terms
    description: >-
      Custom signer terms-of-service / consent statements, company-level with
      per-language workspace overrides
paths:
  /signing-requests/{id}/documents/{document_id}:
    patch:
      tags:
        - Signing Requests
      summary: Replace or rename a signing request document
      description: >-
        Send exactly one of `document_id` (replace the document with a temporary
        upload from `POST /documents`: the same number of pages, every page the
        same size within 1 pt) or `label` (rename). Both, or neither, answers
        `400 VALIDATION_ERROR`. A document placed with anchor tags is replaced
        only when the anchors of the replacement resolve exactly as stored;
        otherwise `400 ANCHOR_MISMATCH`. A sent, finished, cancelled or declined
        signing request answers `409 DOCUMENT_SET_LOCKED`.


        **Enablement required.** This operation is part of the multi-document
        contract (API 01.39.00). It is served only for companies enabled for
        multi-document documents; for any other company, and for a signing
        request or template the API key cannot see, it answers `404` with code
        `NOT_FOUND` ("Endpoint not found"), exactly as an unknown endpoint does.
      operationId: updateSigningRequestDocument
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
            format: uuid
          description: Signing request ID
        - name: document_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
          description: The document id (`documents[].document_id`)
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                document_id:
                  type: string
                  format: uuid
                  description: >-
                    Temporary upload id from POST /documents: the replacement
                    PDF.
                label:
                  type: string
                  nullable: true
                  maxLength: 200
                  description: The new display name (null clears it).
      responses:
        '200':
          description: Document replaced or renamed; the full document set after the change
          headers:
            X-RateLimit-Limit:
              schema:
                type: integer
            X-RateLimit-Remaining:
              schema:
                type: integer
            X-RateLimit-Reset:
              schema:
                type: integer
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DocumentSetMutationResponse'
        '400':
          description: >-
            Bad request: `VALIDATION_ERROR`, `DOCUMENT_UPLOAD_NOT_FOUND`,
            `PAGE_COUNT_MISMATCH`, `DIMENSION_MISMATCH`, `ANCHOR_MISMATCH`
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MultiDocumentError'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '404':
          description: >-
            NOT_FOUND: the endpoint is not enabled for this company, or the
            signing request is absent, deleted or not visible to this API key
            ("Endpoint not found"). DOCUMENT_NOT_FOUND: no document with this id
            in this signing request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MultiDocumentError'
        '409':
          description: >-
            Conflict: `MULTI_DOCUMENT_READ_ONLY`, `DOCUMENT_SET_LOCKED`,
            `SEND_IN_PROGRESS`, `DOCUMENT_SET_VERSION_CONFLICT`,
            `DOCUMENT_SET_BUSY`, `DOCUMENT_SET_DISPATCH_STALE`,
            `DOCUMENT_CANDIDATE_EXPIRED`, `DOCUMENT_SET_INCONSISTENT`
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MultiDocumentError'
        '413':
          description: >-
            DOCUMENT_SET_TOO_LARGE: the document set would exceed 104,857,600
            bytes
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MultiDocumentError'
        '429':
          $ref: '#/components/responses/RateLimitError'
        '500':
          description: Internal error (code `INTERNAL`)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - ApiKeyAuth: []
components:
  schemas:
    DocumentSetMutationResponse:
      type: object
      description: >-
        Answer of every /documents mutation: the full document set after the
        change and its two versions.
      required:
        - documents
        - documents_version
        - documents_layout_version
      properties:
        documents:
          type: array
          items:
            $ref: '#/components/schemas/DocumentSummary'
        documents_version:
          type: integer
        documents_layout_version:
          type: integer
    MultiDocumentError:
      description: An error answered by a multi-document route.
      allOf:
        - $ref: '#/components/schemas/Error'
        - type: object
          required:
            - error
            - code
          properties:
            code:
              $ref: '#/components/schemas/MultiDocumentErrorCode'
    Error:
      type: object
      properties:
        error:
          type: string
          description: Human-readable error message
        code:
          type: string
          description: >-
            Machine-readable error code Seal-related codes: SEALS_DISABLED,
            SEAL_ALREADY_REVOKED, SEAL_CREATION_DISABLED_EDGE,
            SEAL_ERASE_NOT_ELIGIBLE, SEAL_IMAGE_INVALID,
            SEAL_MUTATION_NOT_ALLOWED, SEAL_NOT_FOUND, SEAL_NO_IMAGE_FIELD,
            SEAL_ORDER_COLLISION, SEAL_PAUSED, SEAL_SCOPE_FORBIDDEN,
            SEAL_UNAVAILABLE Multi-document codes: see MultiDocumentErrorCode
            (41 codes).
        errors:
          type: array
          description: >-
            All validation errors when multiple failures are reported together.
            The top-level error repeats the first item for backward
            compatibility.
          items:
            type: object
            required:
              - message
            properties:
              message:
                type: string
        message:
          type: string
          description: Detailed error description
        details:
          type: object
          description: Additional error details
          additionalProperties: true
      required:
        - error
      description: >-


        Organization Seal error codes: SEALS_DISABLED, SEAL_ALREADY_REVOKED,
        SEAL_CREATION_DISABLED_EDGE, SEAL_ERASE_NOT_ELIGIBLE,
        SEAL_IMAGE_INVALID, SEAL_MUTATION_NOT_ALLOWED, SEAL_NOT_FOUND,
        SEAL_NO_IMAGE_FIELD, SEAL_ORDER_COLLISION, SEAL_PAUSED,
        SEAL_SCOPE_FORBIDDEN, SEAL_UNAVAILABLE
    DocumentSummary:
      type: object
      description: One document of a template or signing request.
      required:
        - document_id
        - position
        - label
        - original_filename
        - page_count
        - document_url_kind
      properties:
        document_id:
          type: string
          format: uuid
          nullable: true
          description: >-
            Id of the document. null only for the one document of a signing
            request or template whose document set has never been changed (see
            the example).
        position:
          type: integer
          minimum: 1
          description: 1-based position in the set.
        label:
          type: string
          nullable: true
          maxLength: 200
          description: Display name, or null.
        original_filename:
          type: string
          nullable: true
          maxLength: 255
          description: File name recorded at upload, or null.
        page_count:
          type: integer
          nullable: true
          description: Number of pages of this document.
        document_url:
          type: string
          nullable: true
          description: >-
            Signed URL (1 hour) of the file `document_url_kind` names. Absent on
            list responses.
        document_url_kind:
          type: string
          nullable: true
          enum:
            - stored
            - signed
            - null
          description: >-
            `stored`: the document as stored; `signed`: the individually sealed
            document. Always `stored` on templates; null on signing-request list
            entries.
        document_only_hash:
          type: string
          nullable: true
          description: >-
            SHA-256 (hex) of the individually sealed document, null before the
            certificate is bound. Signing requests only.
      example:
        document_id: null
        position: 1
        label: null
        original_filename: null
        page_count: 3
        document_url: >-
          https://api.firma.dev/storage/v1/object/sign/signing-request-documents/example.pdf?token=example
        document_url_kind: stored
        document_only_hash: null
    MultiDocumentErrorCode:
      type: string
      enum:
        - ALREADY_CANCELLED
        - ALREADY_FINISHED
        - ALREADY_SENT
        - ANCHOR_DOCUMENT_REQUIRED
        - ANCHOR_MISMATCH
        - CONFLICTING_DOCUMENT_SOURCE
        - DIMENSION_MISMATCH
        - DOCUMENTS_LAYOUT_VERSION_REQUIRED
        - DOCUMENT_CANDIDATE_EXPIRED
        - DOCUMENT_NOT_FOUND
        - DOCUMENT_ORIGINAL_NOT_AVAILABLE
        - DOCUMENT_SET_BUSY
        - DOCUMENT_SET_DISPATCH_STALE
        - DOCUMENT_SET_INCONSISTENT
        - DOCUMENT_SET_LOCKED
        - DOCUMENT_SET_TOO_LARGE
        - DOCUMENT_SET_VERSION_CONFLICT
        - DOCUMENT_SIGNED_NOT_AVAILABLE
        - DOCUMENT_UPLOAD_NOT_FOUND
        - DUPLICATE_DOCUMENT_ID
        - FENCE_COLUMN_PROTECTED
        - INSUFFICIENT_CREDITS
        - INTERNAL
        - INTERNAL_ERROR
        - INVALID_DOCUMENT_ORDER
        - INVALID_SIGNING_ORDER
        - MAX_DOCUMENTS_EXCEEDED
        - MIN_DOCUMENTS_REQUIRED
        - MULTI_DOCUMENT_READ_ONLY
        - MULTI_DOCUMENT_REPLACE_UNSUPPORTED
        - NOT_FOUND
        - PAGE_COUNT_MISMATCH
        - PARTICIPANTS_CHANGED
        - RATE_LIMIT_EXCEEDED
        - SEAL_MUTATION_NOT_ALLOWED
        - SEND_EFFECTS_EXIST
        - SEND_IN_PROGRESS
        - SIGNED_DATA_IMMUTABLE
        - SIGNING_ORDER_LOCKED_APPLIED
        - SIGNING_ORDER_LOCKED_SENDING
        - SIGNING_ORDER_LOCKED_SENT
        - VALIDATION_ERROR
      description: >-
        Error codes of the multi-document contract and of the routes it changes
        (generated from the error matrix's API-surfaced rows). A genuine server
        fault answers 500 with INTERNAL_ERROR on the legacy routes and INTERNAL
        on the shared HttpError paths (multi-document dispatch, the RPC status
        map, document-set routes); neither carries detail.
  responses:
    UnauthorizedError:
      description: Unauthorized - Invalid or missing API key
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error: Unauthorized
            message: Invalid API key
    RateLimitError:
      description: Too Many Requests - Rate limit exceeded
      headers:
        X-RateLimit-Limit:
          schema:
            type: integer
          description: Maximum requests per minute
        X-RateLimit-Remaining:
          schema:
            type: integer
          description: Requests remaining
        X-RateLimit-Reset:
          schema:
            type: integer
          description: Unix timestamp of reset
        Retry-After:
          schema:
            type: integer
          description: Seconds until retry allowed
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error: Rate Limit Exceeded
            message: Too many requests. Please wait before retrying.
            details:
              retry_after: 45
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: Authorization
      description: >-
        API key for authentication. Use your API key directly without any prefix
        (e.g., 'your-api-key'). Bearer prefix is optional but not required.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.