DraftRight API
AI-powered legal document generation, audio transcription, file conversion, contract analysis, and agreement building. One API key, one integration.
Base URL: https://draftright.co.uk/api
Authentication
API Key (Business)
Include your key in the x-api-key header.
curl -H "x-api-key: dr_your_api_key_here" \
https://draftright.co.uk/api/invoice/scan \
-F "file=@invoice.pdf"
Bearer Token (Consumer)
From /api/auth/login.
curl -H "Authorization: Bearer eyJhbG..." \
https://draftright.co.uk/api/documents/generate \
-d '{"templateId":"nda","answers":{...}}'
dr_.Plans & Pricing
Consumer
Free
- 1 document/mo (watermarked)
- 3 transcriptions/day (10min)
- File conversion (100MB)
- Agreement preview only
- No diarise/summarise
Pro
- Unlimited documents
- 120 AI credits/month
- 20 transcriptions/day (60min)
- 500MB uploads
- Diarise, summarise, translate
- PDF & DOCX downloads
Elite
- Everything in Pro
- 300 AI credits/month
- 50 transcriptions/day (2hr)
- 1GB uploads
- Priority AI models
Business API
Starter
- 200 calls/month
- Invoice scanning
- Bulk conversion
- No contract analysis
- No agreements
Growth
- 1,000 calls/month
- 10 agreements/month
- Contract analysis
- Transcription API
- Company search
Scale
- 5,000 calls/month
- 50 agreements/month
- Expense scanning
- Company monitoring
- HR packs
Enterprise
- 15,000 calls/month
- 200 agreements/month
- Custom integrations
- Dedicated support
- Custom SLA on request
Enterprise+
- Above 15,000 API calls/month
- White-label / on-prem deployment
- Dedicated account manager & engineer
- Custom SLA & uptime guarantees
- Bespoke integrations / custom endpoints
Enterprise Premium — Compliance Signals
Compliance Signals
- Continuous UK regulatory monitoring (gov.uk, HMRC, ICO, HSE, ACAS, Parliament, Companies House)
- AI-matched to your SIC codes, sectors, jurisdiction & data posture
- Director personal-liability radar
- AI intelligence reports with actionable task lists
- Pre-drafted compliance documents & email alerts
- Quarterly board pack PDF generation
- Slack webhook integration
Quick Start
1. Get your API key
POST /api/business/onboard
Authorization: Bearer YOUR_TOKEN
Content-Type: application/json
{ "companyName": "Acme Ltd", "email": "dev@acme.com" }
2. Scan an invoice
curl -X POST https://draftright.co.uk/api/invoice/scan \
-H "x-api-key: dr_your_key" \
-F "file=@invoice.pdf"
3. Check usage
curl https://draftright.co.uk/api/biz-dashboard \
-H "Authorization: Bearer YOUR_TOKEN"
Errors
All errors return JSON with an error field.
{ "error": "Monthly API limit reached", "used": 200, "limit": 200, "upgrade": true }
| Code | Meaning | Action |
|---|---|---|
400 | Bad request | Check required params |
401 | Invalid auth | Check API key or token |
402 | Payment required | Feature gated to a paid tier. Response includes upgradeRequired:true. Used by Case Chat (Pro+) and similar gated features. |
403 | Feature not on plan | Upgrade |
410 | Gone | Endpoint or template withdrawn. tenancy/section21 on Free tier (RRA 2025 transition); loan_agreement/nda/employment_contract/parking_appeal all tiers (legal audit gate). Response: {gated:true, upgradeRequired:true}. |
429 | Rate limit hit | Wait or upgrade |
500 | Server error | Retry or contact support |
Refresh Tokens & 2FA
Access tokens expire after 15 minutes. Use the refresh token (rotated on every refresh, family-tracked for theft detection) to mint a new access token without re-prompting the user.
Accepts the refresh token from either the dr_refresh httpOnly cookie (SameSite=Strict, path=/api/auth) or the JSON body. Returns a new access + refresh token pair; the old refresh token is invalidated.
curl -X POST https://draftright.co.uk/api/auth/refresh \
-H "Content-Type: application/json" \
--cookie "dr_refresh=YOUR_REFRESH_TOKEN" \
--cookie-jar cookies.txt
{
"token": "eyJhbG...",
"refreshToken": "eyJrZWY..."
}
Two-factor authentication (TOTP)
Returns a base32 secret + an otpauth:// URL for QR code rendering. Bearer auth required.
curl -X POST https://draftright.co.uk/api/auth/2fa/setup \
-H "Authorization: Bearer TOKEN"
{
"secret": "JBSWY3DPEHPK3PXP",
"qrUrl": "otpauth://totp/DraftRight:user@x?secret=...&issuer=DraftRight",
"backupCodes": ["...","...","..."]
}
Confirms enrolment by verifying a TOTP code. Once verified, 2FA is required on all subsequent logins.
curl -X POST https://draftright.co.uk/api/auth/2fa/verify-setup \
-H "Authorization: Bearer TOKEN" \
-H "Content-Type: application/json" \
-d '{"code":"123456"}'
When /api/auth/login returns {requires2FA: true, tempToken: "..."}, post the TOTP (or backup) code with the temp token to complete sign-in.
curl -X POST https://draftright.co.uk/api/auth/2fa/login \
-H "Content-Type: application/json" \
-d '{"tempToken":"...","code":"123456"}'
Requires the current password + a valid TOTP code or backup code to disable.
Document Generator
Generate UK legal documents from 14+ templates (and growing). AI-powered with legislation references. The template library expands automatically as users interact with the platform.
Free: 1/mo Pro: Unlimited Elite: Unlimitedcurl -X POST https://draftright.co.uk/api/documents/generate \
-H "Authorization: Bearer TOKEN" \
-H "Content-Type: application/json" \
-d '{
"templateId": "nda",
"answers": {
"party1_name": "Acme Ltd",
"party2_name": "Jane Smith",
"purpose": "Partnership discussion",
"duration": "2 years"
}
}'
Response:
{
"content": "NON-DISCLOSURE AGREEMENT\n\nDate: 13 March 2026...",
"templateId": "nda",
"wordCount": 1247
}
Transcriber
Transcribe audio/video up to 1GB. Smart-splits long recordings at silence breaks, processes chunks with context continuity.
Free: 3/day 10min Pro: 20/day 60min Elite: 50/day 2hrcurl -X POST https://draftright.co.uk/api/transcribe \
-H "Authorization: Bearer TOKEN" \
-F "file=@meeting.mp3" \
-F "timestamps=true" \
-F "diarise=true" \
-F "summarise=true"
Response:
{
"text": "Welcome to the masterclass...",
"duration": 5586,
"srt": "1\n00:00:00,000 --> 00:00:13,640\nWelcome...",
"summary": "A 90-minute NLP masterclass covering...",
"diarised_text": "[Speaker 1] Welcome..."
}
File Converter
Convert between 15+ formats. Documents, images, audio, video.
curl -X POST https://draftright.co.uk/api/converter/pdf_to_word \
-H "Authorization: Bearer TOKEN" \
-F "files=@document.pdf" --output converted.docx
Returns binary file download.
Smart Doc Reader
Upload any document and chat with it. AI extracts data, answers questions, provides summaries.
Pro+After upload, use /api/smart-doc/chat to ask questions about the document.
Agreement Builder
Upload meeting recordings or transcripts. AI extracts parties, terms, obligations, deadlines, financial terms — then generates a professional legal agreement.
Free: Preview Pro: 5/mo Elite: Unlimitedcurl -X POST https://draftright.co.uk/api/agreement/create \
-H "Authorization: Bearer TOKEN" \
-F "files=@meeting.mp3" \
-F "title=Service Agreement" \
-F "templateType=service_agreement"
Response:
{
"draftId": 42,
"status": "processing",
"message": "Analysing transcripts..."
}
Poll GET /api/agreement/:id for status. When ready, the full agreement is in generated_content.
curl https://draftright.co.uk/api/agreement/42 \
-H "Authorization: Bearer TOKEN"
Returns parties, agreed terms, obligations, deadlines, financial terms, and generated content.
curl https://draftright.co.uk/api/agreement/42/download?format=pdf \
-H "Authorization: Bearer TOKEN" --output agreement.pdf
Legal Analyser
Type-agnostic legal analysis of any document or recording. Identifies legal issues, parties, risk assessment, action items, and applicable UK legislation. Used by Cases as the analysis backbone.
Free: Preview Pro+curl -X POST https://draftright.co.uk/api/legal-analyse/analyse \
-H "Authorization: Bearer TOKEN" \
-F "files=@contract.pdf" \
-F "title=Compliance Check" \
-F "aiContext=Full compliance check under UK law"
{
"id": 17,
"status": "queued",
"title": "Compliance Check"
}
Returns case_type, severity, parties[], legal_issues[], risk_assessment, action_plan[], legislation[], full transcript.
Returns user's analyses ordered by most recent.
If a job’s transcript was analysed, returns the analysis record. Used by the SPA to chain transcribe → analyse without re-uploading.
Cases (Matter Container)
A case is a matter-level container that ties transcripts, documents, analyses, agreements, and chat history together as a single unit. The case digest is an LLM-summarised view of everything attached; the chat lets you ask cited questions across the whole case.
Free: List + create Pro: Full + chat Elite: Full[transcripts:N] back to source items.private (default), business (visible to your business team), sharedReturns all cases the user owns or collaborates on.
Content attachment
job (transcribe), document, legal_analysis, agreementTriggers a digest recompute (Bull queue, ~1.5s debounce).
Chronological list of all attachments + corrections + chat messages on the case.
Case digest (the AI summary)
Returns the LLM-summarised digest: summary, key_facts[], legal_framing, risks[] (severity-rated), decisions[], open_gaps[], next_actions[]. Includes has_corrections flag.
Re-runs the digest LLM pipeline immediately. Skips the Bull queue. Useful right after attaching multiple items.
Case chat (Pro+, returns 402 below)
The assistant has context from: digest + all transcripts + documents + analyses + corrections + last 10 chat messages. Reply may include inline citations like [transcripts:42] or [documents:11] linking back to attached artifacts.
curl -X POST https://draftright.co.uk/api/cases/3/chat \
-H "Authorization: Bearer TOKEN" \
-H "Content-Type: application/json" \
-d '{"message":"Was anything said that constitutes harassment?"}'
{
"role": "assistant",
"content": "Based on the call transcript [transcripts:42] at 14:32...",
"citations": [{"kind":"transcripts","id":42}],
"model": "llama-3.1-70b-versatile",
"provider": "groq"
}
402 response (free/single tier): {error:"Case chat requires Pro or above", upgradeRequired:true}
Corrections (ground-truth overrides)
Merges into cases.corrections jsonb. The digest LLM treats this block as authoritative ground truth on next regenerate. Also surfaces in chat context.
{
"key_facts": {
"tenant_name": "Mike Bestart",
"property_address": "14 Marlowe Road"
},
"notes": "Tenant agreed verbally to vacate by month-end."
}
Document generation from case
action (draft from a specific next_action) or combined (combined remedy from all actions)The LLM proposes a document type name (looked up against the self-learning library for dedup) and writes the body. New types auto-create as community templates at draft confidence — the library grows from every case-driven draft.
Collaborators & sharing
viewer, editorGenerates a tokenised invite. Recipient hits /?caseInvite=TOKEN to accept.
No auth required — returns case title + inviter for the accept page.
Event Stream (SSE)
Server-Sent Events channel for push-based job state updates. Eliminates the ~15s polling lag from the heartbeat fallback — events arrive in ~50ms.
GET /api/jobs polling if the stream drops.Auth via the dr_session cookie. Browser-side use the EventSource API with withCredentials:true. The server keeps the connection alive with a 25s heartbeat ping; clients should reconnect with exponential backoff on close.
Event types:
hello— sent on connect; reset client reconnect backoffjob.update— fired on any job state change. Payload:{jobId, type, status}. Refetch the authoritative job record after receiving.ping— 25s keep-alive
const es = new EventSource('https://draftright.co.uk/api/events/stream', {withCredentials:true});
es.addEventListener('hello', () => console.log('connected'));
es.addEventListener('job.update', (e) => {
const {jobId} = JSON.parse(e.data);
refetchJob(jobId);
});
/api/events/ (proxy_buffering off; proxy_cache off; proxy_read_timeout 86400s;). Without this, events sit in nginx’s proxy buffer.Returns {users:N, connections:N}. Useful for ops/debugging.
Invoice Scanner
Extract structured data from PDF/image invoices using OCR + AI.
Starter+curl -X POST https://draftright.co.uk/api/invoice/scan \
-H "x-api-key: dr_your_key" \
-F "file=@invoice.pdf"
{
"vendor": "Acme Supplies Ltd",
"invoiceNumber": "INV-2026-0142",
"date": "2026-03-01",
"dueDate": "2026-03-31",
"total": 1250.00,
"tax": 250.00,
"currency": "GBP",
"lineItems": [
{ "description": "Web Development", "qty": 1, "unitPrice": 1000, "total": 1000 }
]
}
Contract Analysis
AI analysis of contracts: clause breakdown, red flags, compliance score, key dates.
Growth+curl -X POST https://draftright.co.uk/api/contract/analyze \
-H "x-api-key: dr_your_key" \
-F "file=@contract.pdf"
{
"summary": "12-month service agreement...",
"complianceScore": 78,
"clauses": [...],
"redFlags": [
{ "clause": "4.2", "risk": "Unlimited liability", "severity": "high" }
],
"keyDates": [
{ "date": "2026-04-01", "event": "Start date" }
]
}
Bulk Document Generation (API)
Generate up to 500 documents in a single call from a CSV upload or a JSON records array — one document per row, each formatted with UK legislation references.
curl -X POST https://draftright.co.uk/api/bulk-docs/api/generate \
-H "x-api-key: dr_your_key" \
-F "templateId=tenancy" \
-F "file=@tenants.csv"
{
"total": 42,
"success": 42,
"failed": 0,
"results": [
{ "index": 0, "content": "TENANCY AGREEMENT..." }
]
}
File Conversion (API)
Convert files via API key.
Starter+curl -X POST https://draftright.co.uk/api/converter/pdf_to_word \
-H "x-api-key: dr_your_key" \
-F "files=@document.pdf" --output converted.docx
Transcription (API)
Full transcription via API key. Same capabilities as consumer.
Growth+curl -X POST https://draftright.co.uk/api/transcribe \
-H "x-api-key: dr_your_key" \
-F "file=@recording.mp3" \
-F "timestamps=true" \
-F "summarise=true"
Agreement Builder (API)
Programmatically generate legal agreements from transcripts via API.
Growth: 10/mo Scale: 50/mo Enterprise: 200/mocurl -X POST https://draftright.co.uk/api/agreement/api/create \
-H "x-api-key: dr_your_key" \
-F "files=@meeting.mp3" \
-F "title=Service Agreement" \
-F "templateType=service_agreement"
{
"draftId": 42,
"status": "ready",
"parties": [
{ "name": "Sarah", "role": "provider", "organisation": "The Coaching Corner" }
],
"agreedTerms": [
{ "term": "500/month coaching", "confidence": "high", "category": "payment" }
],
"generatedContent": "SERVICE AGREEMENT\n\nDate: 13 March 2026...",
"usage": { "used": 3, "limit": 10 }
}
Company Search
Search UK Companies House.
Growth+curl "https://draftright.co.uk/api/company/search?q=Tesco" \
-H "x-api-key: dr_your_key"
curl "https://draftright.co.uk/api/company/profile/00445790" \
-H "x-api-key: dr_your_key"
Usage Stats
Real-time usage by endpoint, daily breakdown, recent activity.
curl https://draftright.co.uk/api/biz-dashboard \
-H "Authorization: Bearer TOKEN"
Compliance Signals
Enterprise Premium product. Continuous UK regulatory monitoring across seven live sources (gov.uk policy/HMRC/HSE/ICO/ACAS/Companies House/Parliament bills), AI-matched to your SIC codes, sectors and data posture. Signals carry severity, applicable actions, and pre-drafted compliance documents.
Enterprise Premium · £5,000/moBusiness profile
Returns SIC codes, sectors, jurisdiction, data posture flags, monitored sources.
UK; UK-ENG, UK-SCT for narrower matching{processesPersonalData:true, employees:>50}Signal feed
Returns AI-matched signals ranked by severity and recency. Includes summary, source citation, applicable acts, suggested action items.
curl https://draftright.co.uk/api/compliance-signals/signals?severity=high \
-H "Authorization: Bearer TOKEN"
AI drafts a compliance response document tailored to your business profile and the signal context.
Director Radar & Timeline
Personal-liability radar for company directors. Tracks regulatory exposure timelines, signal frequency by area, board-level risk surface.
Enterprise PremiumReturns 0–100 score, breakdown by domain (employment / data / health-safety / commercial / tax), trend, top open risks.
Director-scope exposure analysis: HSE breaches, Companies House filing risk, ICO data risks, employment tribunal exposure.
Chronological view of all matched signals + actions taken + drafts generated. Useful for ESG reporting.
Board Pack Generation
Quarterly board pack PDF synthesising signals + actions + health into a director-ready compliance brief.
Enterprise Premium2026-Q2 (defaults to current)Async generation. Returns {jobId}; poll the SSE stream for completion.
Reviewer Onboarding & Identity
The Reviewer Portal lets UK-qualified solicitors review AI-drafted templates and earn royalties on every sale of templates they’ve approved. Onboarding requires SRA number, PII attestation, practising certificate attestation, and Stripe Identity verification.
/api/reviews.Creates a Stripe Identity verification session. Reuses non-terminal sessions to avoid duplicate Stripe charges. Returns {sessionId, clientSecret, status}.
If Stripe Identity isn’t enabled on the account yet, response is {status:"unavailable"} and admin can still approve manually.
Review Queue
Active reviewers see the AI-drafted templates needing review. Each round is a single template revision; reviewers can claim, then submit accept/reject/edit decisions.
Returns unclaimed rounds matching the reviewer’s specialisms.
Locks the round to this reviewer for 24h. Re-claim or release via DELETE.
approve, reject, editEarnings, Stats & Stripe Connect
Reviewers earn royalty on every sale of a template they’ve approved. Earnings paid out via Stripe Connect.
Count of approvals/rejections/edits, approval rate, avg time-to-decision.
Returns lifetime + month-to-date royalty earnings, by template, with sale references.
Returns the Stripe Connect onboarding URL to redirect the reviewer to.
Stripe Payments Webhook
Inbound webhook receiving Stripe events for subscription lifecycle, one-off purchases, and refunds. Signature-verified with idempotent handling.
Handled events:
checkout.session.completed— provisions plan, sends welcome emailcustomer.subscription.created/updated/deleted— plan changes, cancellation grace periodsinvoice.payment_failed— triggers retry email + lifecycle dripcharge.refunded— royalty rollback for reviewer payouts
Webhook secret env var: STRIPE_WEBHOOK_SECRET (production) or STRIPE_WEBHOOK_SECRET_TEST (test). All events recorded in the subscription_events + payments tables for idempotency.
Identity Verification Webhook
Same /api/payments/webhook endpoint also dispatches Stripe Identity events to the reviewer verification flow.
Handled events:
identity.verification_session.verified— updates reviewer tostripe_identity_status=verifiedidentity.verification_session.requires_input— reviewer needs to retryidentity.verification_session.canceled— admin manual review
Note: identity-verified is a signal, not a final gate. Admin must still flip reviewer.status=active after the signal stack passes review.
Document Templates
/api/cases/:id/draft-doc or /api/legal-analyse auto-creates a new community template at draft confidence. Reviewers (via the Reviewer Portal) promote drafts to verified. GET /api/documents/templates returns the live list.| ID | Name | Category | Flags |
|---|---|---|---|
tenancy | Tenancy Agreement (AST) | Property | RRA-gated (Free) |
section21 | Section 21 Response | Property | RRA-gated (Free) |
noise_complaint | Noise Complaint Letter | Property | |
deposit_dispute | Deposit Dispute Letter | Property | |
employment_contract | Employment Contract | Employment | Audit-gated |
resignation | Resignation Letter | Employment | |
grievance | Grievance Letter | Employment | |
nda | Non-Disclosure Agreement | Business | Audit-gated |
freelance_contract | Freelance Contract | Business | |
loan_agreement | Loan Agreement | Business | Audit-gated |
refund_request | Refund Request Letter | Personal | |
council_tax_appeal | Council Tax Appeal | Personal | |
flight_delay | Flight Delay Claim | Personal | |
parking_appeal | Parking Fine Appeal | Personal | Audit-gated |
Gating semantics: Audit-gated templates return 410 Gone on all tiers (free + AI). RRA-gated returns 410 on Free tier only; AI-tier path generates with RRA-2025-aware prompts. Audit findings at AUDIT-2026-04-11.md; solicitor sign-off required before un-gating.
Public Config
Unauthenticated endpoint exposing client-side build flags — e.g. Sentry DSN if frontend telemetry is enabled.
curl https://draftright.co.uk/api/public/config
{
"sentryDsn": "https://...@sentry.io/...",
"version": "v1.1",
"env": "production"
}
Returns only public, non-secret config. Server enforces a deny-list to prevent accidental leakage.
Conversion Formats
| Type ID | From | To |
|---|---|---|
pdf_to_word | DOCX | |
word_to_pdf | DOCX | |
excel_to_pdf | XLSX | |
csv_to_excel | CSV | XLSX |
jpg_to_pdf | JPG | |
png_to_pdf | PNG | |
mp4_to_mp3 | MP4 | MP3 |
mov_to_mp4 | MOV | MP4 |
avi_to_mp4 | AVI | MP4 |
mkv_to_mp4 | MKV | MP4 |
mp3_to_wav | MP3 | WAV |
wav_to_mp3 | WAV | MP3 |
m4a_to_mp3 | M4A | MP3 |
png_to_jpg | PNG | JPG |
jpg_to_png | JPG | PNG |
Rate Limits
Monthly. Resets on the 1st.
| Plan | API Calls | Agreements | Max File |
|---|---|---|---|
| Starter | 200/mo | — | 25MB |
| Growth | 1,000/mo | 10/mo | 500MB |
| Scale | 5,000/mo | 50/mo | 500MB |
| Enterprise | 15,000/mo | 200/mo | 1GB |