# AgentContract Docs

Canonical: https://agentcontract.to/docs
Machine-readable source: https://agentcontract.to/docs.md
Human HTML page: https://agentcontract.to/docs
Product: Contract signing API and CLI for AI agents.
Current CLI version: 0.1.13

AgentContract lets AI agent workflows send approved NDAs, privacy acknowledgements, contractor agreements, and onboarding packets. Agents send approved packets only. Humans review and sign in the browser. The system returns signed PDFs, SHA-256 hashes, status, webhooks, and audit trails.

## Boundaries

- Use AgentContract for sending approved contract templates from agent workflows.
- Do not use AgentContract to let agents draft legal terms or sign contracts.
- Do not send an agreement until a human operator has approved the recipient, template, and dry-run output.
- Do not include secrets, API keys, raw private contract text, or unrelated personal data in session events or feedback messages.

## Safe Agent Workflow

1. Install the CLI.
2. Authenticate with an email code.
3. Run `agentcontract skill` and follow its instructions.
4. List available templates.
5. Read the selected template before sending.
6. Run the send command with `--dry-run --json`.
7. Show the dry-run JSON to the human operator.
8. Wait for explicit approval.
9. Send the agreement.
10. Return the agreement id, signing URL, and status.
11. Track status or wait for a webhook.

## Commands

```sh
curl -fsSL https://agentcontract.to/cli/install.sh | bash
agentcontract login --email you@example.com --api-url https://agentcontract.to
agentcontract doctor --json
agentcontract skill
```

```sh
agentcontract templates --json
agentcontract template read privacy-policy --json
agentcontract marketplace-onboard --to jane@example.com --name "Jane Contributor" --dry-run --json
agentcontract marketplace-onboard --to jane@example.com --name "Jane Contributor" --json
agentcontract agreement status agr_123 --json
agentcontract agreement download agr_123 --out ./signed.pdf
```

## Sessions

Use sessions to record agent workflow progress without leaking secrets or private contract language.

```sh
agentcontract session start --tool codex --repo agentink --json
agentcontract session event --session-id sess_123 --kind progress --message "Read template and prepared dry run" --json
agentcontract session end --session-id sess_123 --status completed --json
```

Good session events include template selection, dry-run review, human approval, send result, reminder attempts, cancellation, and failure details.

## API

Use the API when the sending workflow lives in your backend instead of a local CLI process. Store the returned agreement id for status polling or webhook correlation.

```http
POST /v1/agreements
Authorization: Bearer ac_live_...
Content-Type: application/json

{
  "template_id": "privacy-policy",
  "recipient": {
    "email": "jane@example.com",
    "name": "Jane Contributor"
  },
  "variables": {
    "company_name": "Acme"
  },
  "metadata": {
    "source": "agent-workflow"
  }
}
```

```http
GET /v1/agreements/agr_123
GET /v1/agreements/agr_123/pdf
POST /v1/agreements/agr_123/remind
POST /v1/agreements/agr_123/cancel
```

## Templates

- `mutual-nda`: two-way confidentiality packet for counterparties that exchange confidential information.
- `one-way-nda`: one-way confidentiality packet for vendors, reviewers, and external collaborators.
- `privacy-policy`: website and app privacy policy acknowledgement for controlled onboarding flows.

Public previews:

- https://agentcontract.to/templates/mutual-nda
- https://agentcontract.to/templates/one-way-nda
- https://agentcontract.to/templates/privacy-policy

## Webhooks

Treat webhook handlers as idempotent. Verify signatures, deduplicate events, fetch the agreement record, and store the signed PDF hash with your own record.

```json
{
  "type": "agreement.completed",
  "agreement_id": "agr_123",
  "status": "completed",
  "signed_pdf_url": "https://agentcontract.to/v1/agreements/agr_123/pdf",
  "signed_pdf_sha256": "..."
}
```

## Deployment

Production uses Supabase/Postgres-backed storage. Keep secrets in the deployment environment and run migrations with the production database URL.

```sh
DATABASE_URL="postgres://..." npm run migrate -- --status
DATABASE_URL="postgres://..." npm run migrate
```

Release checks:

- `/healthz` exposes current service and CLI version metadata.
- `/cli/install.sh` installs the hosted tarball.
- `/sitemap.xml`, `/llms.txt`, and `/docs.md` expose public docs only.
- Private dashboards, signing URLs, auth routes, and `/v1/` remain non-indexed.

## Troubleshooting

Use `agentcontract feedback` when a user reports install failures, stale versions, missing commands, HTTP 404s, or confusing output.

```sh
agentcontract feedback --area sending --priority high --message "specific-privacy returned HTTP 404"
agentcontract feedback --area install --message "update reports success but active CLI stayed old" --json
```

Common fixes:

- If update reports success but the version stays old, check which `agentcontract` binary is first on `PATH`.
- If a hosted update fails checksum validation, reinstall from https://agentcontract.to/cli/install.sh.
- If a send route returns HTTP 404, run `agentcontract templates --json` and confirm the template id is approved.
- If docs mention a missing command, run `agentcontract update` and then `agentcontract --version --json`.

## Agent Response Contract

When an agent sends or prepares an agreement, return:

- Agreement id.
- Template id.
- Recipient email and name.
- Whether the command was a dry run or real send.
- Signing URL when available.
- Current status.
- Any next step that needs human approval.