Changelog

All notable changes to this project will be documented in this file.

[0.8.1] - 2026-07-03

Boldsign.WebhookPlug now acknowledges BoldSign's endpoint-verification ping (X-BoldSign-Event: Verification) with 200 OK before signature validation. The ping is sent before any webhook signing secret exists, so it can never carry a valid signature; previously the plug rejected it with 401 and BoldSign's dashboard "Verify" button always failed.

Bumped the package version to 0.8.0.
Replaced Bypass-backed tests with a small Bandit-backed local test server.
Multipart uploads now use raw request bodies to avoid creating atoms from dynamic BoldSign form field names.

Empty multipart list fields now encode as "[]" instead of being omitted.
Multipart field names and filenames now percent-escape ", CR, and LF in content disposition headers.
Webhook signature parsing now handles BoldSign headers with a space after the comma, such as t=TIMESTAMP, s0=SIGNATURE.

Added regression coverage for empty list multipart encoding, raw multipart request encoding, multipart content disposition escaping, and spaced webhook signature headers.

OAuth bearer token support via Boldsign.new(access_token: ...).
New Boldsign.Contact, Boldsign.ContactGroup, Boldsign.CustomField, and Boldsign.Plan modules.
Additional document endpoints for attachments, audit logs, tags, recipient authentication, recipient changes, expiry updates, prefill updates, team/behalf lists, and draft sending.
Additional template endpoints for tags, embedded request/create/edit URLs, and embedded merge request URLs.
Boldsign.User.update_metadata/2.

Bumped the package version to 0.7.0.
Refreshed the README and LiveBook embedded signing example for the current API surface, current regional endpoints, API-key or OAuth auth, and hosted-PDF usage.
Expanded request handling so document and template operations can automatically switch between JSON and multipart payloads where the official BoldSign API allows file uploads.
Updated the default regional base URLs to match the current official BoldSign endpoints, including CA and AU regions.

Added compatibility with req 0.6 by converting multipart form-part names to atoms at the request boundary while preserving the exact BoldSign wire field names.
Corrected several HTTP verb and query-parameter mismatches in existing document, template, team, user, and identity verification wrappers.
Aligned identity verification requests with the current official API contract.

Added extensive local HTTP server coverage across client auth, documents, templates, contacts, contact groups, custom fields, users, teams, identity verification, plan APIs, and multipart encoding.
Added multipart regression coverage for Req-compatible atom part names, including bracketed/dotted BoldSign field names.

Send document requests now stay on JSON by default and only switch to multipart when files are actually present.
Multipart form encoding now follows the official BoldSign SDK pattern for file uploads plus JSON-encoded complex fields such as signers and textTagDefinitions.

Initial release with support for BoldSign REST API.
Boldsign module for client configuration.
Boldsign.Document for document management (send, create, list, download, etc.).
Boldsign.Template for template-based operations.
Boldsign.User and Boldsign.Team for administrative operations.
Boldsign.Brand for brand management.
Boldsign.SenderIdentity for sender identity management.
Boldsign.IdentityVerification for KYC/identity verification flows.
Boldsign.Webhook with signature verification.
Boldsign.WebhookPlug and Boldsign.Webhook.Handler for easy Phoenix integration.
Boldsign.File helper for multipart uploads.
Livebook example for embedded signing.