Documents, from one API call.

curl -X POST "https://api.mezdoc.com/api/v1/templates/coi_v3/render?return=url" \
  -H "Authorization: Bearer $MEZDOC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "data": {
      "insured_name": "Harbor Point LLC",
      "each_occurrence": 1000000,
      "effective_date": "2026-06-01"
    },
    "idempotency_key": "coi-2026-00481"
  }'

const res = await fetch("https://api.mezdoc.com/api/v1/templates/coi_v3/render?return=url", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.MEZDOC_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    data: { insured_name: "Harbor Point LLC", each_occurrence: 1000000, effective_date: "2026-06-01" },
    idempotency_key: "coi-2026-00481",
  }),
});
if (!res.ok) throw new Error((await res.json()).message);
const { submission_id, pdf_url } = await res.json();

import os, requests

res = requests.post(
    "https://api.mezdoc.com/api/v1/templates/coi_v3/render",
    params={"return": "url"},
    headers={"Authorization": f"Bearer {os.environ['MEZDOC_API_KEY']}"},
    json={
        "data": {"insured_name": "Harbor Point LLC", "each_occurrence": 1000000, "effective_date": "2026-06-01"},
        "idempotency_key": "coi-2026-00481",
    },
    timeout=60,
)
res.raise_for_status()
print(res.json()["pdf_url"])

curl -X POST "https://api.mezdoc.com/api/v1/templates/coi_v3/render?async=true" \
  -H "Authorization: Bearer $MEZDOC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "data": { "insured_name": "Harbor Point LLC" } }'

# 202 Accepted
{
  "submission_id": "sub_8Kq2mR4tVx",
  "status": "processing",
  "poll_url": "https://api.mezdoc.com/api/v1/submissions/sub_8Kq2mR4tVx"
}

curl -X POST "https://api.mezdoc.com/api/v1/workflows/renewal_packet/runs" \
  -H "Authorization: Bearer $MEZDOC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "data": { "insured_name": "Harbor Point LLC", "state": "TX" } }'

# 200 OK
{
  "run_id": "run_4Tz9Lq2Wm",
  "status": "completed",
  "page_count": 9,
  "merged_pdf_url": "https://api.mezdoc.com/api/v1/workflows/runs/run_4Tz9Lq2Wm/pdf?doc=merged",
  "documents": [
    { "name": "Binder", "alias": "binder", "url": ".../pdf?doc=0" },
    { "name": "Certificate", "alias": "certificate", "url": ".../pdf?doc=1" }
  ],
  "document_pdf_urls": [ ".../pdf?doc=0", ".../pdf?doc=1" ]
}

{
  "id": "evt_3f9a1c2b7d8e4f60a1b2c3d4e5f60718",
  "type": "submission.completed",
  "created": 1790519400,
  "data": {
    "submission_id": "sub_8Kq2mR4tVx",
    "template_id": "utpl_2Hc7Qw",
    "kind": "dynamic",
    "environment": "production",
    "status": "completed",
    "page_count": 3,
    "sha256": "ee1922af94c5...",
    "error": null,
    "pdf_url": "https://app.mezdoc.com/api/v1/submissions/sub_8Kq2mR4tVx/pdf",
    "created_at": "2026-09-27T14:30:00.000Z",
    "completed_at": "2026-09-27T14:30:02.140Z"
  }
}

// Express. Hash the raw body, before any JSON parsing.
const crypto = require("crypto");

function verifyMezdoc(secret, rawBody, header, toleranceSec = 300) {
  const parts = {};
  for (const seg of header.split(",")) {
    const i = seg.indexOf("=");
    if (i > 0) parts[seg.slice(0, i).trim()] = seg.slice(i + 1).trim();
  }
  const t = Number(parts.t);
  if (!t || !parts.v1) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - t) > toleranceSec) return false;
  const expected = crypto.createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(parts.v1);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

app.post("/webhooks/mezdoc", express.raw({ type: "application/json" }), (req, res) => {
  const ok = verifyMezdoc(process.env.MEZDOC_WEBHOOK_SECRET, req.body.toString(), req.get("Mezdoc-Signature") || "");
  if (!ok) return res.status(400).send("bad signature");
  res.status(200).send("ok"); // respond fast, then process the event
});

import hmac, hashlib, time

def verify_mezdoc(secret, raw_body, header, tolerance=300):
    parts = dict(p.split("=", 1) for p in header.split(",") if "=" in p)
    t = int(parts.get("t", "0") or "0")
    if not t or "v1" not in parts:
        return False
    if abs(int(time.time()) - t) > tolerance:
        return False
    expected = hmac.new(secret.encode(), f"{t}.{raw_body}".encode(), hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts["v1"])

// app/api/webhooks/mezdoc/route.ts. Read the body with req.text(), never req.json().
import crypto from "node:crypto";

export async function POST(req: Request) {
  const rawBody = await req.text();
  const sig = req.headers.get("Mezdoc-Signature") ?? "";
  if (!verifyMezdoc(process.env.MEZDOC_WEBHOOK_SECRET!, rawBody, sig)) {
    return new Response("bad signature", { status: 400 });
  }
  const event = JSON.parse(rawBody);
  // event.data.submission_id, event.data.pdf_url ... respond fast, then process
  return new Response("ok", { status: 200 });
}

// verifyMezdoc: the same function as the Node tab.

# 400 Bad Request
{
  "code": "data_invalid",
  "message": "Field \"effective_date\" is required.",
  "errors": [{ "alias": "effective_date", "message": "Field \"effective_date\" is required." }]
}