> ## Documentation Index
> Fetch the complete documentation index at: https://developer.demand-iq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign a contract

> Submits a contract signature. Validates the typed signature against the customer name, resolves the template with variables, and creates an audit-trailed signed document. Requires an `x-presentation-token` scoped to this presentation, matching the sibling `events` and `appointment` routes. Obtain the token from `POST /api/presentations/{presentationId}/events-token`. Soft-deleted presentations are refused with `404` even when the caller holds a still-valid token minted before the delete. Client-supplied `variables` are filtered through an allow-list before storage. Non-whitelisted keys are dropped rather than persisted to `resolvedVariables`.



## OpenAPI

````yaml /openapi.json post /api/presentations/{presentationId}/sign-contract
openapi: 3.0.0
info:
  title: AI Presentations API
  version: 1.0.0
  description: >-
    REST API for AI Presentations — an AI-powered presentation platform with
    narrated slides, live Q&A, and deck management.


    **Authentication**: Most endpoints require a session cookie obtained from
    `POST /api/auth/login`. Presentation playback endpoints (`/api/qa`,
    `/api/narration/*`) also accept a `presentationId` for unauthenticated
    viewer access.
  contact:
    name: Demand IQ
    url: https://demand-iq.com
servers:
  - url: https://app.demand-iq.com
    description: Production
  - url: http://localhost:3000
    description: Local development
security: []
tags:
  - name: Decks
    description: Manage presentation decks
  - name: Slides
    description: Manage slides within a deck
  - name: FAQs
    description: Manage pre-built Q&A pairs
  - name: Branding
    description: Colors, logo, and call-to-action configuration
  - name: Q&A
    description: Live question answering and Q&A settings
  - name: Narration
    description: Text-to-speech synthesis
  - name: Presentations
    description: Create and manage personalized presentation instances
  - name: Generation
    description: AI-powered content generation from slide images
  - name: Images
    description: Image upload and management
  - name: Voices
    description: Available TTS voices
  - name: Utility
    description: Health check and diagnostics
  - name: Authentication
    description: Session-based login, logout, and identity
  - name: Company
    description: Organization contact info and knowledge base
  - name: Notifications
    description: Event subscriptions and delivery log
  - name: Contracts
    description: Contract template import and e-signature
  - name: Fonts
    description: Available Google Fonts for branding
  - name: Roof Measurements
    description: Request and track automated roof measurements
  - name: Actions
    description: Voice/text command detection for presentation control
  - name: Appointments
    description: Appointment scheduling for presentation viewers
  - name: Activity
    description: Recent presentation activity feed
  - name: Onboarding
    description: >-
      Per-user product onboarding milestones (ENG-641). Milestone endpoints are
      idempotent and are called by the app UI — they should not be treated as
      tenant-integration surface.
paths:
  /api/presentations/{presentationId}/sign-contract:
    post:
      tags:
        - Contracts
      summary: Sign a contract
      description: >-
        Submits a contract signature. Validates the typed signature against the
        customer name, resolves the template with variables, and creates an
        audit-trailed signed document. Requires an `x-presentation-token` scoped
        to this presentation, matching the sibling `events` and `appointment`
        routes. Obtain the token from `POST
        /api/presentations/{presentationId}/events-token`. Soft-deleted
        presentations are refused with `404` even when the caller holds a
        still-valid token minted before the delete. Client-supplied `variables`
        are filtered through an allow-list before storage. Non-whitelisted keys
        are dropped rather than persisted to `resolvedVariables`.
      parameters:
        - in: path
          name: presentationId
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - variables
                - signature
              properties:
                configId:
                  type: string
                  format: uuid
                variables:
                  type: object
                  description: >-
                    Variable values substituted into the template. Keys outside
                    the server-side allow-list are dropped before storage. The
                    allow-list covers customer fields (`first_name`,
                    `last_name`, `full_name`, `address`, `city`, `state`, `zip`,
                    `email`, `phone`), company fields (`company_name`,
                    `company_address`, `company_city`, `company_state`,
                    `company_zip`, `company_phone`, `company_email`,
                    `license_number`, `rep_name`), and date fields (`today`,
                    `month`, `year`, `date`, `signature_timestamp`). Non-string
                    values are also dropped.
                  required:
                    - full_name
                  properties:
                    full_name:
                      type: string
                    first_name:
                      type: string
                    last_name:
                      type: string
                  additionalProperties:
                    type: string
                signature:
                  type: string
                  description: Typed signature (must match the customer name)
                agreedToTerms:
                  type: boolean
      responses:
        '200':
          description: Contract signed
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  documentId:
                    type: string
                    format: uuid
                  signedAt:
                    type: string
                    format: date-time
                  message:
                    type: string
        '400':
          description: >-
            Bad request (signature mismatch, validation error, or a request body
            that is not valid JSON or not a JSON object)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Missing, malformed, or wrong-presentation `x-presentation-token`.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: >-
            Presentation not found, presentation soft-deleted, deck missing, or
            contract template not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - presentationToken: []
components:
  schemas:
    Error:
      type: object
      properties:
        error:
          type: string
      required:
        - error
  securitySchemes:
    presentationToken:
      type: apiKey
      in: header
      name: x-presentation-token
      description: >-
        HMAC-signed token scoped to a specific presentation. Obtained from `POST
        /api/presentations/{presentationId}/events-token`.

````