RFP and Evaluation FAQ
Use this page when a buyer or partner needs a quick technical answer about SpotDraft developer capabilities. These answers are intentionally public-safe. For customer-specific terms, security evidence, commercial commitments, certifications, audit reports, or legal representations, use the customer agreement, Trust Center, and the SpotDraft account team as the source of truth.
API and webhook integration scope
Can external systems integrate with SpotDraft?
Yes. SpotDraft supports API and webhook based integrations for common CLM flows such as creating contracts from upstream systems, updating contract metadata, importing executed contracts, receiving lifecycle events, and syncing contract status or documents back to downstream systems.
Typical source systems include CRM, CPQ, ERP, procurement, HRMS, intake, and custom business applications. Typical downstream systems include data warehouses, document storage, reporting tools, finance systems, and operational workflow tools.
Can SpotDraft integrate with Salesforce, SAP, HRMS, or custom applications?
Yes, provided the use case is compatible with the enabled SpotDraft product capabilities and public API surface. For RFP purposes, describe these as standard business-system integrations that can be implemented through native integrations, public APIs, webhooks, partner-built integrations, or customer-built middleware.
Do not imply that every field, workflow setting, or admin action is API-configurable. Validate endpoint coverage before committing to a specific integration requirement.
Do standard integrations create a performance or terms concern?
Standard integrations with business systems such as CRM, ERP, HRMS, CPQ, procurement, or reporting tools are expected integration patterns. The concern is usually unapproved automation that harms service performance, such as scraping tools, custom bots, or clients that make excessive API calls without rate-limit handling.
Should a customer build an integration or use an existing integration?
Start by checking whether an existing SpotDraft integration already covers the use case. Build with public APIs and webhooks when the customer has a custom source system, a custom data model, a non-standard workflow, or a downstream sync requirement that is not covered by a native integration.
Technology partners who want to build a reusable integration can use the partner interest form.
Can SpotDraft be embedded into another product?
Some SpotDraft experiences are built for embedding, such as Clickthrough SDK and embedded signing flows. Do not assume the full SpotDraft CLM application can be embedded into another product unless that specific product path has been validated.
Common integration flows
What integration pattern should we assume for an RFP response?
The most common pattern is:
- The source system sends commercial context, counterparties, signatories, source identifiers, and contract data to SpotDraft.
- SpotDraft manages the contract lifecycle across creation, review, approvals, signature, execution, and storage.
- SpotDraft sends webhook events when important lifecycle changes occur.
- The integration fetches fresh contract, metadata, or document state from the API when downstream systems need more detail.
Use Platform 101 and Data Model for the full orientation.
Can integrations create contracts from another system?
Yes. Public APIs can support flows that create contracts from templates, upload third-party paper for review or signature, import externally executed contracts, and attach source-system identifiers for lookup and reconciliation. The exact endpoint depends on the contract type and workflow pattern.
Can an integration upload third-party paper for review or signature?
Yes, where the workflow is supported by the public API and the workspace is configured for that contract process. The integration should send the file, choose the correct contract type or workflow path, pass required metadata, and then rely on SpotDraft to manage review, approval, signature, and repository storage.
Can externally signed contracts be imported into SpotDraft?
Yes. A common repository integration pattern is to bring externally executed agreements into SpotDraft with the executed document, contract metadata, counterparty details, source-system ids, and any searchable fields needed for reporting or later lookup.
Can SpotDraft sync status, metadata, and documents back to downstream systems?
Yes. The recommended approach is event-driven. Subscribe to relevant webhook events, dedupe each event in your receiver, and then fetch the latest contract state or documents from the API before updating downstream systems.
Should downstream systems rely only on webhook payloads?
No. Treat webhooks as lifecycle signals. If the downstream system needs a complete or authoritative view, use the event to trigger a fresh API read, then sync the current contract, metadata, document, or status into the downstream system.
Can an integration keep source-system ids on contracts?
Yes. Store stable source-system identifiers in external metadata or another supported structured field. This allows lookup, reconciliation, and downstream sync without relying on contract names or human-readable values that may change.
Environments and rollout
Should implementation start in UAT or production?
Start in a UAT workspace whenever possible. Ask the SpotDraft CSM for a UAT workspace, implement and test the API and webhook integration there, then repeat the setup in production after the behavior is stable.
This avoids disrupting production templates, contracts, counterparties, metadata, approval routing, and workflow settings.
Are UAT and production interchangeable?
No. Treat them as separate systems. Credentials, webhook registrations, contract type ids, template ids, metadata keys, users, roles, entities, and workflow settings can differ between environments.
What should be validated before production rollout?
Validate the regional API host, API credentials, webhook endpoint URL, subscribed event types, contract types, templates, questionnaire or intake fields, user and role access, entity setup, signing behavior, metadata mappings, retry behavior, and reconciliation plan.
Can production configuration be copied directly from UAT?
Do not copy identifiers blindly. A template, contract type, entity, role, metadata key, or webhook id from UAT may not exist in production. Use environment-specific configuration and promote the mapping intentionally.
Authentication, regions, and limits
How are API calls authenticated?
Server-to-server API calls use client-id and client-secret headers. Some endpoints may also support user-email when the request must act in the context of an active workspace user.
Use Authentication and Regions for regional base URLs and request header details.
Are there different regional API hosts?
Yes. Use the API base URL for the region where the workspace is provisioned. Keep API calls, webhook setup, and embedded flows aligned to the same workspace region.
What is the public API rate limit?
SpotDraft applies a public API rate limit of 10 requests per second per workspace.
Webhook deliveries from SpotDraft are excluded from this API request limit. If your integration receives 429 Too Many Requests, slow down with bounded exponential backoff and jitter rather than retrying in a tight loop.
Are API costs or access entitlements the same for every customer?
API availability, commercial entitlements, and integration packaging can depend on the customer agreement. Use the public developer docs for technical behavior and the account team for commercial eligibility or pricing questions.
Does SpotDraft provide read-only APIs for security audits?
SpotDraft does not promise broad security-audit automation unless the exact endpoint, permission model, and workspace access have been validated. Public APIs are primarily for CLM integration workflows, not a blanket replacement for security audit exports or SIEM integrations.
Metadata and data model
What data should an integration send to SpotDraft?
Send the data SpotDraft needs to create, route, review, sign, store, and report on the contract. This often includes source-system ids, counterparty details, signatories, commercial fields, contract type, template choice, intake answers, questionnaire responses, and metadata needed for downstream reporting.
What is external metadata used for?
External metadata stores identifiers and integration-owned values that help connect a SpotDraft contract to records in other systems. Common examples include CRM opportunity ids, ERP vendor ids, procurement request ids, CPQ quote ids, and external workflow ids.
Use stable identifiers from the source system. Avoid storing secrets, tokens, or sensitive operational logs as metadata.
What is the difference between contract data, metadata, and external metadata?
Contract data is the structured data used to generate, route, or describe a contract in SpotDraft. Metadata is structured information used for repository organization, reporting, filtering, and workflow context. External metadata is integration-owned data used to connect SpotDraft records to records in other systems.
Can metadata be updated after contract creation?
Yes, where supported by the public API and workspace configuration. Design updates carefully: a downstream system should know whether it owns a field, mirrors a field, or only reads it from SpotDraft.
How should field ownership be described in an RFP?
Use a clear ownership model. The source system usually owns upstream commercial data. SpotDraft owns CLM lifecycle state and contract workflow state. Downstream systems should store derived or synced copies and reconcile from SpotDraft when lifecycle state changes.
Webhooks and operational debugging
What are webhooks used for?
Webhooks notify your integration about lifecycle changes so downstream systems do not need to poll continuously. Your receiver should verify the webhook signature, return a fast 2xx, enqueue slow work, and process events idempotently.
Use Webhooks for receiver setup and signature verification.
Are webhooks guaranteed to be delivered exactly once?
Design webhook receivers as if duplicate or delayed events can happen. Store a dedupe key, make downstream writes idempotent, and fetch fresh API state before making high-impact updates.
Does SpotDraft expose API or webhook logs in the product?
No. SpotDraft does not expose product-side API or webhook logs in the developer portal or product UI. Your integration should keep its own logs for outbound API requests, inbound webhook deliveries, signature verification, queue jobs, retries, and downstream processing results.
What should developers log?
Log the HTTP method, regional host, path, environment, response status, internal request id, retry count, webhook event type, contract id, delivery id or payload hash, signature result, queue job id, and downstream sync result.
Do not log client-secret, bearer tokens, signed document URLs, or sensitive contract content.
How should teams debug webhook failures?
Start with the receiver. Confirm the endpoint is public, uses HTTPS, accepts POST, verifies signatures from the raw request body, responds quickly with 2xx, and records delivery attempts in the integration's own logs. If downstream state is stale, reconcile by fetching fresh contract state from the API.
Should integrations poll instead of using webhooks?
Use webhooks as the primary lifecycle signal. Polling can be used as a repair or reconciliation strategy, but it should not replace webhook-driven design for normal operation.
Security, access, and compliance
Does SpotDraft support role-based access controls?
SpotDraft workspaces support role-based access and product-level permissions. API behavior can also depend on the credential context and, when used, the active workspace user passed through user-email.
For customer-specific access-control commitments, evidence, and audit language, use the customer agreement, Trust Center, and account team.
Can SpotDraft support SSO, SCIM, and MFA?
SpotDraft supports enterprise identity and access patterns through product-level configuration. Whether SSO, SCIM, MFA, or a specific identity-provider setup is available for a customer depends on the workspace configuration, plan, and implementation scope. Validate the exact requirement with the account team before committing in an RFP.
How are provisioning and deprovisioning handled?
Workspace admins manage user access in SpotDraft, and identity-provider based provisioning may be available where configured. For exact provisioning, deprovisioning, access-review, and account reassignment language, use the customer agreement and account team guidance.
Are user actions auditable?
SpotDraft exposes contract activity in the product for contract lifecycle actions. API-accessible audit or activity data depends on the public API surface available for the workspace and use case. SpotDraft does not promise global security audit automation unless the specific endpoint, permission model, and customer requirement have been validated.
Can SpotDraft send real-time alerts for sensitive security events?
SpotDraft does not claim support for configurable security-event alerting unless the exact event, product capability, and delivery path have been validated. Contract lifecycle webhooks are not the same as a complete security-event alerting system.
Can SpotDraft provide security certifications or audit reports?
Security certifications, audit reports, penetration-test summaries, compliance evidence, DPA terms, subprocessors, and policy documents should be handled through the Trust Center or the SpotDraft account team.
Data, privacy, and resilience
What customer data can appear in an integration?
Depending on the workflow, integrations may process contract documents, contract metadata, counterparty information, signatory information, intake answers, questionnaire responses, workflow status, comments or task context, and source-system identifiers. Only send fields that are needed for the integration.
Can customer data be exported or deleted after termination?
Data return, export, retention, deletion, backup retention, and certification of deletion are governed by the customer agreement and SpotDraft policies. For technical integrations, design downstream sync so records can be identified by stable source-system ids and reconciled cleanly when a lifecycle or contractual event requires action.
Does SpotDraft provide RTO, RPO, backup, or disaster recovery evidence?
Disaster recovery, backup, RTO, RPO, restore testing, and business continuity evidence should be requested through the Trust Center or SpotDraft account team. The developer portal should not be treated as the source of truth for audit evidence or customer-specific resilience commitments.
Can SpotDraft back up data directly into a customer's environment?
Do not assume customer-managed backup as a standard public API capability. If the requirement is downstream document or metadata sync, design an integration that exports supported contract data or documents into the customer's storage system. If the requirement is legal backup ownership, route it to the Customer Success team.
How is PII in logs handled?
For developer-built integrations, the customer or partner owns its integration logs and should avoid logging secrets, tokens, signed URLs, or sensitive contract content. Questions about SpotDraft internal logging, retention, and evidence should be answered through Trust Center or Customer Success approved materials.
How is AI governance or AI data processing handled?
AI governance, model-provider, training-data, regulatory, and AI addendum questions should be answered from current SpotDraft-approved AI, privacy, legal, and Trust Center materials.
Clickthrough SDK
When should Clickthrough SDK be considered for integration?
Clickthrough SDK should be considered when the requirement is to present terms, capture acceptance, or embed a terms-acceptance flow into a website or application. It is different from a full CLM workflow where contracts move through review, negotiation, approval, and signature. Use Clickthrough SDK for SDK configuration, display modes, metadata, callbacks, and common setup checks.
Does Clickthrough SDK replace API-based CLM integrations?
No. Clickthrough SDK is for embedded acceptance flows. API and webhook integrations are the better fit when the requirement is to create CLM records, route contracts through workflows, sync metadata, or connect SpotDraft with source and downstream systems.
Does Clickthrough SDK support consent capture?
Clickthrough SDK is designed for embedded acceptance flows. Use the Clickthrough SDK documentation for implementation details and route legal questions about consent language, DPDP, GDPR, privacy notices, or enforceability to the legal or account team.