DiliTrust APIs – Frequently Asked Questions (Board Portal, CLM, LEM, e-Signature and SCIM)

Want to connect DiliTrust to your ERP, your CRM, SharePoint or one of your internal tools? This FAQ answers the questions we hear most often about DiliTrust's public APIs. An API (Application Programming Interface) lets another system read or send data to DiliTrust automatically, without anyone having to copy it by hand.

The FAQ is organised by topic:

• Board Portal API: access, documents, synchronisation, security and operations
• Contract Lifecycle Management (CLM) API: authentication, tokens and main data
• Legal Entities Management (LEM) API: authentication, tokens, entities and documents
• e-Signature APIs: DiliTrust Sign and DiliSign (external signature providers)
• SCIM user provisioning: managing users automatically from your identity provider

---

⭐ General questions

Does DiliTrust offer public APIs?

Yes. DiliTrust offers public APIs that connect the platform to other systems, such as ERPs, CRMs, internal tools or customer data repositories.

Where can I find the API documentation?

All public API documentation is on the DiliTrust developer portal. For each module, you'll find guides (quick start, overviews and business use cases) and an API reference for detailed technical integration:

• Board Portal: guides
• Contract Lifecycle Management (CLM): guides
• Legal Entities Management (LEM): guides
• User provisioning (SCIM): guides
• DiliSign (external signatures): guides

Are the APIs available for every module?

Public APIs are documented for the Board Portal, Contract Lifecycle Management (CLM), Legal Entities Management (LEM), user provisioning (SCIM) and DiliSign (external signatures). Each module has its own REST API that uses JSON, and its own way of authenticating. What you can do depends on the module and on the endpoints documented for it, so check that module's documentation before you start an integration project.

Who can I contact if I need help with an integration?

Email support@dilitrust.com and put [API Integration] in the subject line.

---

⚡ Board Portal API: access and authentication

This section covers the Board Portal public API.

What data can I work with through the Board Portal API?

The Board Portal documentation covers:

• Documents and folders
• Meetings
• Votes and quorums
• Users
• Signatures
• User activity logs
• Security reports
• Tasks

Each topic has its own documentation page:

• Introduction
• Authentication
• Documents and folders
• Meetings
• User logs
• Security reports
• Signatures
• Tasks
• Changelog

For a step-by-step guide to tasks, see Tasks Public API – How to Integrate and Manage Your Tasks.

Which endpoint should I use for a Board Portal tenant hosted in the MEA region?

For a Board Portal tenant hosted in the MEA region, the production endpoint is https://api-mea1.dilitrust.com/api/v1.

Every request must include the header x-module: board_portal. Endpoints for meetings and user tokens also need the header X-Dt-Tenant-Id, set to your tenant ID.

Which authentication methods are available?

The Board Portal uses three types of token. Which one you need depends on the endpoint:

• API Token (Basic authentication): documents, folders, fields and signatures
• User Token (Bearer JWT): meetings, quorums, votes and users
• Client Token (Bearer JWT): security reports

Does the API respect DiliTrust permissions?

Yes. The API applies the rights of the account the token belongs to. Those rights come from the identity, role and data permissions set up in DiliTrust.

Can I create a read-only technical account?

Yes. For integrations, we recommend creating a dedicated read-only technical account. An API Token keeps working as long as it's active, and you can deactivate or delete it at any time.

How long are tokens valid?

• API Tokens don't expire automatically.
• JWTs are valid for 1 year and come with a refresh token.

---

❓ Board Portal API: documents and synchronisation

Can I retrieve all the documents in a tenant with a single request?

No. The Board Portal doesn't offer a global list of documents or a tenant-wide document search. You retrieve documents for one identified context at a time, using GET /documents with the contentType and contentId parameters. Both parameters are required.

Can I retrieve the full folder structure?

No. The API doesn't return the full folder tree and doesn't let you browse all folders. It does give you the name of each document's parent folder.

Is pagination available?

No. The Board Portal endpoints documented today don't support pagination.

Is there a bulk export?

No. There's no bulk export for documents. Your integration application needs to retrieve the documents within the scope it's allowed to access, then transfer them itself.

Is incremental synchronisation available?

No. There's no "delta" feed, no "last modified" filter and no "changed since" filter. To stay in sync, your integration application needs to re-read the relevant scope regularly and compare the results on its side.

Are webhooks available?

No. The Board Portal doesn't currently send webhooks when a document is created, modified or deleted. A webhook is an automatic notification that one system sends to another when something changes.

Can I retrieve the documents attached to a meeting?

Yes. You can find the documents linked to a meeting through the meetings endpoint, and you can filter by meeting status.

What document metadata is available?

A document can include:

• Its identifier
• Its name
• Its size
• Its file extension
• Its URL
• The name of its parent folder
• Any custom fields set up for it

The API doesn't return the creation date, the modification date or the document hash.

Are document versions or document history available?

No. The Board Portal doesn't have an endpoint for document versions or document history.

Can I retrieve only approved documents?

No. The Board Portal has no built-in approval or validation status for documents, so there's nothing to filter approved documents on.

---

⚖️ Board Portal API: security and audit

Are API actions recorded in the audit logs?

Logs can include the user, their email address, a timestamp and the action performed. Security reports are also available through the API, covering activity, groups and users.

Which endpoints return audit information?

• GET /user-logs
• GET /security_reports/activity
• GET /security_reports/groups
• GET /security_reports/users

How is data protected?

• Data in transit is sent over HTTPS with TLS 1.2 or higher.
• Data at rest is encrypted with AES-256.
• Documents cached offline on tablets are encrypted with AES-256.

Where is data hosted?

For a Board Portal tenant hosted in the MEA region, data is hosted in the MEA region, in the United Arab Emirates.

---

⏳ Board Portal API: technical details

Are there separate DEV and UAT environments?

No. The Board Portal doesn't currently provide separate DEV or UAT endpoints.

Which formats are supported?

Requests and responses can use JSON or XML. File uploads use multipart/form-data.

How long before a request times out?

Requests time out after 5 minutes.

Does DiliTrust retry failed requests?

No. Retries are up to the calling application, so build your own retry strategy into the integration.

Which HTTP status codes can the API return?

The most common codes are 200, 201, 204, 400, 401, 403, 404, 406, 422 and 500.

---

⚓ Contract Lifecycle Management (CLM) API

This section covers the CLM public API. For full details, see the CLM API guides.

What can I do with the CLM API?

The CLM API lets you manage contracts, documents, folders and repositories from your own applications. You can automate contract workflows, keep contract data and files in sync with your other systems, and set up custom exports of your data.

The main data you work with:

• Documents: a document is one contract together with all its appendices. It includes the file versions, metadata, summary sheet and workflow state. Documents can be linked to each other, for example as an amendment, a subcontract or a simple link.
• Folders: the folder structure that organises documents within a repository.
• Repositories: the top-level containers, each representing a separate contract database or business unit.

Is API access included in my CLM subscription?

Yes. Every CLM subscription includes access to the CLM API.

What is the CLM API address?

The base URL is https://api.dilitrust.com/api/clm/v2.

How does authentication work?

Every request must include a Bearer JWT token in the Authorization header, with Content-Type set to application/json. A token works on one tenant only and carries one set of permissions. A tenant is your organisation's own, fully separate DiliTrust environment.

Who can create CLM API tokens?

Administrators who have the Manage API tokens permission. They create, view and revoke tokens from the Token management tab in the CLM administration settings.

How do I create a token?

1. In the CLM administration settings, open the Token management tab.
2. Create a new token for the user it should act as.
3. Enter a description that explains what the token is for, and a validity date.
4. Copy the access token and the refresh token straight away and store them somewhere secure. They're shown only once, at creation.

The token list then shows each token's description, the user it was created for and its validity date.

What permissions does a CLM token have?

The same permissions as the user it was created for. API calls can only do what that user is allowed to do, and translated content (such as field labels) follows that user's language setting. For security and traceability, create a dedicated service account for API operations.

How long are CLM tokens valid?

Access tokens are valid for 12 hours. When one expires, use the refresh token to get a new access token and refresh token, without going back to the administration settings. Once the validity date set at creation has passed, refreshing no longer works, and an administrator has to create a new token.

What happens if I revoke a token?

The token, and every refresh token derived from it, stops giving access to the API immediately.

Can I retrieve the CLM folder structure?

Yes. Listing the folders of a tenant returns the IDs of the subfolders and of the documents each folder contains.

Can I use my CLM token for SCIM?

Yes. CLM tokens work for both the CLM API and the CLM SCIM API.

---

⛺ Legal Entities Management (LEM) API

This section covers the LEM public API. For full details, see the LEM API guides.

What can I do with the LEM API?

The LEM API lets you manage your legal entity data from your own applications, automate corporate governance workflows and keep entity data in sync with your other systems. It covers:

• Companies, including corporate structure, capital and governance
• Individuals involved in corporate governance
• Contracts, including parties and costs
• Litigations, including lifecycle tracking and costs
• Mandates, governance bodies (instances), representatives and delegations
• Shares and transactions
• Documents and folders linked to any entity
• Electronic signatures
• Tasks

What is the LEM API address?

The documented base URL is https://api-eu2.dilitrust.com/api/v1.

Which header do I need to include?

Every LEM request must include the x-module header. Its value depends on the data you're working with:

• entities: companies, individuals, mandates, instances, representatives, delegations, shares and transactions
• contracts: contracts and costs
• litigation: litigations

If the header is missing, the API returns a 404 error.

Which authentication methods are available?

• API Token (Basic authentication): used for all entity management endpoints, including companies, individuals, contracts, litigations, governance, capital, documents, folders, fields, signatures, tasks, user logs and reports.
• Client Token (Bearer JWT): used only for security reports. It's generated from the Customer card in the Client admin interface.

How do I get an API token?

Token management first has to be turned on by DiliTrust Support. Once it's on:

1. Go to Configuration (gear icon) > Users, then open the Tokens management tab.
2. Click Create a new token and enter a name.
3. Use the status to activate or deactivate the token.
4. Click Confirm. The token value is displayed.
5. Copy the token value straight away and store it somewhere secure. It's shown only once and can't be retrieved later.

What is a pseudo user?

Each LEM API token has its own pseudo user: a technical user for API calls. Its login is the token name with api-users- in front. For example, the token my-token creates the pseudo user api-users-my-token.

• A pseudo user can't sign in to DiliTrust applications.
• You can give a pseudo user a role, add it to teams and grant it data permissions, just like any other user.
• Deleting the token deletes its pseudo user, and deleting the pseudo user deletes its token.

When you build the Basic authentication credentials, use the pseudo-user login (with the api-users- prefix) as the username. Without the prefix, the API returns a 403 error.

Which formats are supported?

Requests can use JSON, XML or multipart/form-data. Responses can be JSON or XML. The API is case-sensitive, so all parameters must use the correct case.

How do I find out which fields are available?

Use the fields endpoint to list the standard and custom fields for each content type, for example company, individual, contract, litigation or document. Custom fields start with c__ and lifecycle fields start with l__.

How do I retrieve the documents linked to an entity?

Use GET /documents with the contentType and contentId parameters. Both are required. A document can include its identifier, name, size, file extension, download URL, parent folder name, whether it has review tasks, and the IDs of the users who created and last updated it.

Can I track how a company's data changes over time?

Yes. You can create historization records that store past values of company fields, such as capital, with the date they took effect.

Which HTTP status codes can the LEM API return?

The most common codes are 200, 201, 204, 400, 401, 403, 404, 422 and 500. Validation errors (422) come back as a structured response that lists each field in error with its message.

---

✍ e-Signature APIs

DiliTrust offers two different e-signature options, each with its own setup:

• DiliTrust Sign: the electronic signature service built into the DiliTrust suite.
• DiliSign: a single API that connects DiliTrust modules to third-party signature providers.

What is DiliTrust Sign?

DiliTrust Sign is the electronic signature service of the DiliTrust suite. You use it to send PDF documents to recipients, who can be asked to sign, to approve or simply to receive a copy (carbon copy). Once everyone has acted, DiliTrust Sign returns the completed documents together with an audit trail certificate.

How does a DiliTrust Sign workflow work?

1. The DiliTrust product you're using creates an envelope. An envelope is a signature request bundling the documents, recipients, signature fields, signing order, deadline and reminders.
2. DiliTrust emails an invitation to each recipient.
3. Each recipient opens their personal link, gives their consent, then signs or approves the documents.
4. You can optionally require multi-factor authentication for any recipient.
5. When the workflow is complete, DiliTrust generates the signed PDFs and the audit trail certificate.
6. The sender and recipients get a completion notification, and the calling system can be notified through a webhook.

Can DiliTrust Sign be used through an API?

Yes. A DiliTrust product can create and manage signature workflows through the public API with a tenant API token.

Can signed documents and certificates be sent to another system?

Yes. You can build an interface on the DiliTrust API to send the signed document and its electronic signature certificate to another system.

What is DiliSign?

DiliSign brings all your electronic signature processes together behind a single API. Through it, you can request signatures on documents, track their status, retrieve signed documents and manage signature workflows, whichever supported provider you use. For full details, see the DiliSign guides.

Which external signature providers are supported?

• DocuSign
• Adobe Sign
• YouSign
• Universign
• Signaturit
• Connective
• Dropbox Sign
• Box Sign
• Generic: a custom connector you build for any other provider

What can I do with the DiliSign API?

• Authenticate with a signature provider
• Send documents for signature
• Check the status of signature requests
• Get a signing link for a specific signer
• Retrieve signed documents
• Cancel a pending signature request
• Resend a signature request to signers
• Retrieve the audit trail certificate
• List what a provider supports, including its features and signature field types

How does DiliSign authentication work?

You first authenticate with your chosen provider through DiliSign. You then send the resulting token as a Bearer JWT in the Authorization header of each request.

Which signature levels are available?

The levels available depend on the provider:

• Standard: basic electronic signature
• Advanced: signature with SMS verification
• Advanced with SMS: enhanced signature with an SMS one-time code
• ID verification: signature with an identity document check
• Advanced with ID: enhanced signature with an identity check

How do I know when a signature request changes status?

DiliSign uses webhooks. When a signature request is created, DiliSign gives the provider a webhook address. Each time something changes, for example a signer signs or declines, the provider notifies DiliSign, which updates the status in the DiliTrust module. Notifications cover these statuses: sent, completed, declined, cancelled, expired and email delivery failed. You can also check the latest status at any time through the API.

If you build a Generic connector, your connector must send these notifications to DiliSign itself.

Can I connect a provider that isn't listed?

Yes. If a provider isn't listed in the DiliStore, you can connect it through the generic API connector, as long as the provider offers the API features and authentication details it needs. The generic provider documentation is available at sign.dilitrust.com.

What do I need to connect an external provider?

• The provider's endpoint URL
• The provider's authentication token or credentials
• The external signature feature turned on
• The provider set up in the relevant DiliTrust module

The activation process differs from module to module. Contact DiliTrust Support for help with your module.

Who sets up the provider?

• Board Portal and Legal Entity Management: each user connects their own provider account.
• Contract Lifecycle Management (CLM): a tenant administrator sets up the providers for the whole tenant. Up to 2 providers can be active at the same time, and which one is used depends on the user who starts the signature.

Who handles the signing: DiliTrust or the external provider?

With DiliTrust Sign, DiliTrust handles signing and sealing the document. With an external provider, DiliTrust sends the request to the provider you've set up, and the provider handles the signing.

---

✅ SCIM user provisioning (DiliTrust CLM)

This section covers automatic user and group management between your identity provider and DiliTrust CLM.

What is SCIM?

SCIM (System for Cross-domain Identity Management) is an open standard for automatically creating, updating and removing users and groups across identity systems and applications. DiliTrust supports SCIM 2.0.

Why use SCIM with DiliTrust CLM?

SCIM lets you manage DiliTrust CLM users from your identity provider instead of by hand. It helps you:

• Give users access automatically when they join your organisation
• Remove access automatically when they leave
• Assign and update user roles
• Create and delete CLM groups
• Add users to specific groups
• Avoid orphaned accounts, meaning accounts left active after someone has left

Which identity provider is documented?

The documented setup uses Microsoft Entra ID (formerly Azure AD). For the technical reference, see the SCIM API guides. For setup instructions, see SCIM Connection Setup – Azure (Microsoft Entra) | DiliTrust CLM.

What do I need to set up SCIM?

• Administrator rights on your DiliTrust CLM organisation
• Access to the Microsoft Entra admin center, with permission to manage Enterprise Applications
• The SCIM endpoint: https://api.dilitrust.com/api/scim/v2/
• A Bearer token, generated in DiliTrust CLM under Configuration > Token Management
• The role UUIDs (unique identifiers) for your organisation, which you retrieve through the SCIM API

Which account should the SCIM token belong to?

The SCIM Bearer token is linked to a user account in your CLM tenant. Create a dedicated technical account with Administrator rights for SCIM rather than using someone's personal account. That way, the integration keeps working even if that person's access changes.

What happens if a token is compromised?

Go to Configuration > Token Management in DiliTrust CLM, revoke the token, then generate a new one. Treat the token as confidential, because it gives full provisioning access to your CLM organisation.

Can I provision groups?

Yes. If you provision users through a group, the group is created in DiliTrust CLM with its members. Groups created directly in DiliTrust CLM can't be pushed back to Microsoft Entra ID, so build your group structure in Entra ID first and keep it as your single source of truth.

Can a user have more than one role?

No. Each user has a single role in DiliTrust CLM: Administrator, Editor, Contributor, Validator or Reader.

Can I use SCIM and SSO together?

Yes. They work together: SCIM manages the user lifecycle (creating, removing and assigning roles), while SSO manages how users sign in. You can set up both on the same Microsoft Entra Enterprise Application.

Are deprovisioned users permanently deleted?

No. Deleting a user through SCIM deactivates the account instead of removing it. The audit history is kept, and you can reactivate the user later. Deactivating a user removes all their access. Removing a group only removes the group memberships: its members keep their own access.

---

✨ Tips and best practices

• Use a dedicated technical account for each integration. Read-only is enough for Board Portal data retrieval, and SCIM needs Administrator rights. In LEM, give the token's pseudo user only the role and data permissions it needs.
• Copy tokens as soon as they're created. CLM and LEM tokens are shown only once.
• Store API and SCIM tokens securely, and deactivate or revoke any token you no longer need.
• For SCIM, start with a single test user before rolling it out to your whole organisation.
• For Board Portal synchronisation, plan for regular re-reads and your own retry strategy, because there are no webhooks, no incremental filters and no automatic retries.