Start free

What's newin SignFlow.

Every change that reaches you, newest first, on the day it ships.

Releases in the last 30 days: 22. The latest: 27 October 2026.

Read the latestFor developers: the API

  • New

    Trust Center.

  • New

    Search engines get a map of the public site.

  • New

    What's New and Developers pages.

and 8 more

Releases

New

  • Trust Center. A new page at /trust brings together how SignFlow protects your documents, with the proof for each claim: LeonAI's ISO/IEC 27001:2022 certificate (open the PDF, or check it with the Standards Institution of Israel), where SOC 2 Type 2 and the Tax Authority registration stand, encryption, sign-in, audit trails, who sees what, the policies, and SignFlow's live status. The header's Security link now opens it.
  • Search engines get a map of the public site. signflow.leonai.io now publishes a sitemap, names it in robots.txt, gives each public page one canonical address (so a link with ?upgrade= or a campaign tag counts as the same page), and describes the company and the site in structured data. An agency's own domain shows none of this: there, robots.txt names no sitemap and the platform's sitemap isn't served.
  • What's New and Developers pages. What's new shows every release, newest first, and you can filter it to new features, improvements, fixes, security updates, or the API changes you need to act on. Developers shows how to send a document for signature from your code in cURL, Node.js or Python. It also lists every webhook event, shows how to check a webhook's signature, and links to the OpenAPI spec. Both are in the header's new Resources menu and in the footer, with the Trust Center.

Improved

  • Lower prices and twice the credits. Starter is now ₪39 a month with 100 credits (was ₪49 with 50). Pro is ₪99 with 300 credits (was ₪129 with 150), and Business is ₪199 with 800 credits (was ₪249 with 400). Free now gets 10 credits a month (was 5). Credit packs cost less too: 100 credits for ₪49, 500 for ₪199, 1,000 for ₪349 and 2,000 for ₪599. Yearly billing still gives two months free. If you already subscribe, you keep your current price, and your plan's new monthly credits apply from your next billing cycle. Enterprise plans are now tailored with our team. Prices exclude VAT.
  • The Make.com app is listed from the Pro plan, with the API it connects through. The app signs in with an API key, and API keys come with Pro, so the plans no longer show the Make app on Starter, where it could not be connected. Starter keeps its webhooks. Nothing that works today stops: an existing Make connection keeps its key.

Fixed

  • An agency's own domain never shows LeonAI, even when the agency's brand can't be loaded. If the agency's name and logo are slow to arrive or fail to load, the app on that domain now shows no logo and no copyright line instead of LeonAI's, and calls the site by its address. The sign-in page asks you to try again, as before, and the legal pages say their details couldn't be loaded, with a Try again button, instead of showing LeonAI's terms.
  • An agency's own domain doesn't fall back to LeonAI's tab title, icon or link preview. If the agency's brand can't be read for a moment, the page that first loads on its domain is now titled with the domain itself and carries no LeonAI icon, description or link-preview image, instead of SignFlow's.
  • The Hebrew legal pages write the company's name correctly. In the Hebrew privacy policy, terms of service, license, security policy and accessibility statement, the period at the end of "LeonAI Ltd." (or your agency's company name) was drawn before the name, as ".LeonAI Ltd". It now stays at the end of the name.
  • The Help page's answers match the product again. Signing links stay open for 30 days by default, and each template can set anything from 7 days to a year (the page said 7 to 90 days, and offered a per-submission expiry date that doesn't exist). Documents can be sent from the dashboard as well as through the API, at its real path, /api/v1/submissions. Webhooks can be set once for the whole organization in Org Settings, and signers also see the fields that aren't assigned to anyone. The Hebrew answers now speak in the plural, like the rest of the app.
  • An agency's own domain no longer presents the Israel Tax Authority registration as the agency's. The homepage on an agency's domain said that the agency was registering as a remote-signature provider. The registration is the platform's, so the homepage there now leaves out that card and the matching highlight, and keeps the rest of its security section.

Security

  • signflow.leonai.io now tells browsers to use HTTPS only, and no other site can frame its pages. Every page and file on the app's own address now carries HTTP Strict Transport Security for a year, turns off the camera, microphone and location (the app never uses them), and allows no plugins and no framing except by SignFlow itself, so a signing page can't be hidden under another site's buttons. A full content policy now runs in report mode to find anything it would block, before it is switched on. White-label hosts already had these protections.

Fixed

  • The Skip to content link is now in Hebrew too, and screen readers say exactly what it shows. Keyboard users who press Tab first on any page see the link in the page's language ("דילוג לתוכן" in Hebrew), as a padded button instead of bare text squeezed over the logo, and a screen reader reads the same words it shows. The page's main area is named in the page's language too.
  • The header names every page in the page's language. Flows, Runs, Connections, Billing, Help, the legal pages and every other page the sidebar opens now show their name in the header the way the sidebar names them, in Hebrew or English, instead of the English word "Page". A page inside one of them, such as a flow's editor, shows its section's name.
  • When something breaks, the error screen no longer shows the program's internal error text. You see the screen's title, one plain sentence and Try again, in Hebrew or English, with a short reference (the time, in UTC) to quote to support.
  • The error screen looks like the app. When something breaks, the screen now has the app's header with its logo, a footer with the legal links, and two ways on: Try again, and back to the home page.

New

  • Flows (by invitation only): app triggers can now watch an app's list of changes. Some apps report what changed since you last asked rather than a list you can sort by date. A trigger can now follow that list, so it catches new and changed items, renamed and moved files included, without reading everything each time. A trigger like this starts from now on. If the app forgets where the trigger stood (for example after the flow was off for a long time), the trigger starts again from that moment and the next run says that changes made in between were not read. The first triggers that use it, for OneDrive, SharePoint, Outlook Contacts and Microsoft To Do, are in early access; nothing changes for the triggers you use today.

Improved

  • Flows (by invitation only): on the canvas, Alt+arrows never leave the flow editor. On the canvas, Alt with an arrow moves the selected modules; when there is nothing to move, it says why instead of going back a page. Outside the canvas, Alt+Left is still the browser's Back, which now asks first after a failed save (below).
  • Flows (by invitation only): leaving the editor asks first when your changes are not saved. If the latest changes could not be saved, the browser's Back and Forward and the links in the app's pages ask before leaving the editor, as the way back to the list already did, until your changes are saved.
  • Flows (by invitation only): the canvas keeps its controls in view. In a window 1280 px or wider, the canvas's controls sit centred in the free part of the canvas, and a pinned data picker keeps its own room: the controls move into the space beside it instead of hiding under it. When the canvas is too narrow to leave them that room (for example a 1280 px window with the app's sidebar open), they stay where they were. A data picker that is not pinned may still float over them.
  • Flows (by invitation only): on a phone, the canvas controls fit in one row. The most used controls stay in the row with larger touch targets, and the rest are under More, so the flow keeps more of the screen.
  • Flows (by invitation only): the canvas brings what you open into view. Opening a module's settings or a link's filter, opening the data picker beside the settings, choosing a row in the problems or notes list, or selecting a mapped value glides the canvas so the module (and its source note) is not hidden behind a panel. Nothing moves when you only point at something, and the move is instant when your system asks for reduced motion.

Fixed

  • Flows (by invitation only): the Ctrl+K palette tells screen readers which row Enter will open. The search field now names the selected row when the palette opens, after each search and when the list updates. Before, it named no row at opening or after a search, and after the list refreshed in the background it could name a different row from the one Enter then opened.
  • Flows (by invitation only): the Ctrl+K palette tells screen readers how many results a search found. Once you stop typing, a screen reader hears how many results are listed, or that nothing matches. In Hebrew, it uses Hebrew's own words for one and two results. It says nothing while you are still typing or while the flows are still loading.
  • Flows (by invitation only): clicking in the Ctrl+K palette's list keeps your place for screen readers. A click in the list that chooses nothing, such as on a group heading, between results or on the scrollbar, now leaves the focus in the search field. A screen reader therefore keeps announcing the result Enter will open. Before, the click moved the focus to the list, which could announce a result that was no longer selected.
  • Flows (by invitation only): leaving the flow editor can no longer lose a change made while the next page loads. Before, after you chose a link out of the editor, the editor stayed on screen until the next page had loaded. A change made in that moment whose save failed was lost when the editor closed, without the usual question. Now the editor closes from view at once, and its shortcuts and paste do nothing until the next page arrives. In exchange, a short loader may show when you leave the editor for a page you have not opened yet in this session.
  • The sidebar now stays collapsed across pages once you collapse it. Before, every page opened it again. The choice is kept in this browser.
  • Screen readers now name the sidebar's collapse button and say whether the sidebar is expanded.
  • Flows (by invitation only): on a phone, a notice no longer sits against an open question. While a question such as "Leave without storing your latest changes?" is open, notices show at the bottom of the screen, clear of it.
  • Flows (by invitation only): notices no longer end with one word alone on the last line. The text wraps more evenly, in Hebrew and English.
  • Flows (by invitation only): the canvas controls stay in reach. The "More controls" menu no longer closes by itself while you resize the window or turn your phone; the controls settle once you close it. And in windows just wide enough for a pinned data picker, the Notes and Problems buttons no longer slip under the picker: when one row can't hold them beside it, the controls wrap onto another line.
  • Flows (by invitation only): after a change could not be saved, Back and Forward in the browser always ask before leaving the flow editor. Before, in Chrome and Edge the question depended on timing.
  • Flows (by invitation only): the app's buttons and the command palette now ask before you leave the flow editor with changes that could not be saved, as links and Back already did. Before, Settings, Billing, a notification, View all and the palette's go-to actions left without asking.
  • Flows (by invitation only): leaving the flow editor while a change is still being saved now waits for it. The change is saved first, then you leave. If it can't be saved, or it takes more than a few seconds, you're asked first. Before, a change still being saved could be lost if its save then failed.
  • Flows (by invitation only): pressing Back twice quickly in the flow editor, with changes that could not be saved, now keeps you on the flow. You're asked once, and Stay leaves the address bar on the flow. Before, in Chrome and Edge, the address bar moved two pages back, and the next Back left the app.

Changed behaviour (API): POST /api/v1/flows/{id}/webhook/rotate no longer stops the old address at once: it keeps answering for 24 hours, and the answer's new previous_until says until when. Migration: if your integration rotates a token to cut off a leaked address, call DELETE /api/v1/flows/{id}/webhook/previous right after the rotation; from then on the old address answers 404.

New

  • Flows API (by invitation only): a module's output fields an app fetches. Some apps decide what a module gives as you set it up: pick a Priority form, and its columns, with the columns of the subforms you chose, are what the module outputs (Make's dynamic interface). A module's schemas (POST /api/v1/flows/schemas) now say where those fields come from (output.source), and POST /api/v1/flows/{id}/rpc-fields with use: "outputs" reads them from the connected system with the connection chosen for the module: at most 1,000 fields, each group and list with its own fields down to 4 levels, their words cut and the connection's credentials redacted. Asking these routes now also takes lists (a select of several choices, or records such as the subforms you chose), and a value mapped from another module is never sent to the app. No app in the catalog uses this yet.
  • Flows (by invitation only): map the fields an app gives for a module's output. When an app decides what a module gives as you set it up, as an ERP that answers the columns of the form you picked and of the subforms you chose (Make's dynamic interface), the data picker now lists those fields under the module, ready to map, and the pills that use them show their names. They are read from the app with the module's connection, only for the modules you can see in the picker, a few at a time. Until a field the module needs is chosen, the picker says which; when that field is mapped from another module, it says the fields show after a run. A busy app or a failed read offers to try again. A run's own output is still what the module gives: a date among these fields arrives as text, as Make's date functions read it.
  • Flows (by invitation only): an app step that tries a request again waits without holding the run. When an app answers "busy" or "try later" and its step is built to ask again after a pause, as Make's apps do, the run sleeps through the pause: it no longer counts toward the run's active time, and a pause of up to 5 minutes works. The step still counts as one operation, however many times it asked, and each try gets the step's full time, where Make counts the pauses in it.
  • Flows (by invitation only): a faster Add a module, and Ctrl+K.
    • Add a module has filters (All, Apps, Flow control, Tools), says how many apps and modules you can search, and shows your most-used next steps as Likely next, after … ("used after this in 4 of your flows") once three of your flows use that module. Apps show how many modules and triggers they have, whether they are in early access or beta, and whether you are connected. Flow control has its own tiles (Router, If-else, Iterator, Aggregator, Set variable, Sleep). Press → (← in Hebrew) to open an app and ← (→ in Hebrew) to go back. A footer offers Browse all and Missing an app? Ask for it, which writes to your provider's support address. It opens above the canvas's bottom controls and the last-run strip.
    • API: GET /api/v1/flows/apps/next?after=<module type> answers the module types that most often follow one in your organization's own flows (counts only), and a module in GET /api/v1/flows/apps may carry ui.pickerGroup: "flowControl". Both are additions; nothing changes for existing callers.
    • Ctrl+K (⌘K on a Mac) opens a command palette on every Flows page, and Enter opens its first result. Add a module without leaving the keyboard, open a flow by name (searching "Gmail" finds the flows that use it), find a connection and see how many flows use it, or press > for actions: Publish changes, Run once, Test mode, Auto-align, Go to Runs, Go to Data. Press G then R, D or C to jump to Runs, Data or Connections. The keyboard shortcuts list (?) names both.
    • In Hebrew, an app or flow name in Latin letters sits at the start of its row, next to its icon; a flow's apps read in order; a long name is cut at its own end; and an empty search field shows its hint on the right. In both languages, Add a module's search field and rows show their keyboard focus ring in full.
  • Flows (by invitation only): the Trigger tab sets up how a flow starts. Where the app offers both, choose As soon as it happens or Check on a schedule (Undo is one click). Copy the webhook address, listen for a sample call and turn its fields into the webhook's data structure, choose who may call (an API key, IP addresses) and save with Save the webhook settings, and choose when the caller gets its answer. A schedule shows its next three checks, about how many checks a month it makes, and how many recent checks found something new.
  • Flows (by invitation only): schedules can run only on chosen days, months and hours (for example Monday to Friday, 08:00 to 17:00). The schedule's summary shows the window.
  • Flows (by invitation only): a new webhook address no longer cuts the sender off at once. The old address keeps working for 24 hours, so there is time to update the system that sends the requests, and Stop the old address now ends it early. When the old address leaked, choose It leaked as the reason and the old address stops at once. Both are recorded in the audit log.
  • Flows (by invitation only): on a flow that checks on a schedule, Run once now reads Check now.
  • Flows: a previous webhook address is kept only for its 24 hours. It is never shown or returned, the daily clean-up clears it once its time is over, and ending it early or replacing it is recorded in the audit log.
  • Flows (by invitation only): a file from an earlier step can go straight into an app's file field. Map a signed PDF, or any file an earlier step made, into a field that takes a file's data, as you would map a file's data in Make, and the app receives the file's bytes. That covers a field at the top of the step, such as Google Cloud Vision's image to read text from, and a file field that appears only after you choose an option. Before, the run refused the first with "Invalid buffer", and the second sent the app the file's reference instead of its bytes. Files are still read only from your own organization. The builder knows such a file too: it shows as a file in the Data tab, with its own icon; mapped into a field that takes a file's data, it is not marked as a type the field can't take, and the panel's suggestions offer it there by name. Everywhere else a file reads as before: a group of its name, type, size and reference, never suggested for a text field or a template's fields.

Improved

  • The legal links and Cookie settings are now also in the sidebar, under Help, on every page. "Legal & cookies" opens the Privacy Policy, Terms of Service, License, Security and Accessibility pages and your cookie settings from wherever you are. The flow editors no longer show the site footer below the canvas, so Tab past the editor's last control no longer scrolls the flow's header off screen.
  • Flows (by invitation only): an app list or field set you stop waiting for stops loading. When you close a dropdown, leave the module or the page while an app is still answering, SignFlow stops asking that app instead of finishing a read nobody will see, so a slow app is not kept busy for nothing.
  • Flows (by invitation only): an app's error that Make treats as fatal now turns the flow off, as in Make. When an app reports that its settings are wrong, that its access token was refused, that it failed unexpectedly, or that the data it got is incomplete, a scheduled or instant flow is turned off at that first error instead of after three in a row. You see why on the flow, with the error's message, and in the activity log. Each of the four now shows under its own name when you choose which errors an error route handles; an error your flow handles that way doesn't turn it off, unless the route rolls the run back. Incomplete data your flow doesn't handle is never stored as an incomplete run. Until now such a flow stayed on until its error limit; once the app's connection or settings are fixed, turn it on again.

Fixed

  • Flows (by invitation only): with a module's settings open, the small toolbar above the module now stays clear of the panel, so its More button can be pressed again. In the flow's outline, the focus ring around a row now shows whole, in Hebrew too.
  • Flows (by invitation only): keyboard users no longer lose the flow's header. When Tab goes past the editor's last control to the site footer and then back into the editor, the page scrolls back so the flow's name, Run once and Publish show again. On a very narrow canvas the canvas's bottom dock now wraps its buttons instead of hiding some.
  • Flows (by invitation only): in the data picker, a tab's keyboard focus ring now shows whole on a small screen.
  • Flows (by invitation only): in Hebrew, an English value beside a data item now shows its beginning.
  • Flows (by invitation only): on a phone with Test mode on, the data picker's list keeps room for more than one row.
  • Flows (by invitation only): a module you open or jump to now lands fully clear of the module settings panel. The canvas used to keep things 20 px short of the panel's real width, so the module, or its toolbar, could sit partly under the panel's edge.
  • Cookie settings show the choice you saved. Reopening Cookie settings showed the optional cookies you had turned on as off, so pressing Save Preferences without a change could switch them off. The settings now open on your saved choice, a change you close without saving is gone the next time you open them, and a saved choice that can't be read asks you again instead of counting as consent.
  • Flows (by invitation only): an app trigger written with Make's spelling of "the last item's id" now reads where it stands. Make's documentation names it data.lastId; until now only data.lastID was filled in, so a trigger that asked for new items after the last one it saw, written Make's way, asked from nowhere. Both spellings now give the same value.

New

  • Flows (by invitation only): find your way around a flow from the keyboard and at a glance. Select a module and a small toolbar appears above it (settings, run only this module, clone, add a note, and more). Notes now show who wrote them and when. The bar at the bottom of the editor is gone: the canvas has one bottom dock for undo and redo, zoom, auto-align, notes and problems, and a mini-map of the whole flow; the new outline lists every module and route and takes you to any of them. The arrow keys move from module to module and a screen reader says where you are and what comes next; Alt with an arrow nudges the selected modules; Tab goes from a module to its documents, its toolbar and its links.
  • Flows (by invitation only): the last run's summary at the bottom of the editor no longer covers the flow's bottom modules or the zoom buttons: it has its own row above the canvas's dock. In Test mode on a phone-sized window, the canvas no longer covers the status line at the bottom of the editor.
  • Flows (by invitation only): the data picker. Click into a field in a module's settings and the picker opens beside the settings panel (a sheet over it on a narrow screen). Pin it to keep it open while you move between fields. One search finds data, variables, functions and keywords at once; Text, Number, Date and List narrow what is shown; Suggested lists the outputs that match the field's name. Each module shows its app and when its last run started, each output a type icon and its value from that run, and the picker says which module runs after the one you edit, so its outputs are not listed. Up and Down arrows move between items, Enter inserts, / searches.
  • Flows (by invitation only): a mapped value shows where it comes from. Rest the pointer on a value in a field and the canvas marks its module with a note, "Customer name comes from here", and, if you may see run data, its value in the last run.
  • Flows (by invitation only): the picker's tabs are Suggested, Data, Variables, Functions and More. Operators and keywords are under More; now and the Time zone variable lead Variables. A list put into a text field says its items are joined with commas, and a collection that it is inserted as JSON text.
  • Flows API (by invitation only): fields an app fetches for a module. Some apps decide a module's fields as you fill it in: pick a form, and the app answers that form's fields; pick a column, and it answers the field for that column's value (Make's dynamic fields). POST /api/v1/flows/{id}/rpc-fields reads them from the connected system with the connection chosen for the module, as an app's dropdown lists are read. It runs only what the module itself declares, for at most 40 seconds, and answers at most 200 fields with their words cut and the connection's credentials redacted. A module's form now also says which fields show under a list whatever you pick (Make's options-level nested, ui.nestedAny), and where those fetched fields come from (ui.nestedSource, ui.specSource). No app in the catalog uses them yet.
  • Flows (by invitation only): a module's form shows the fields an app brings. Pick a value in a list, and the fields that belong under it show up, whatever you picked (Make's options-level nested). When the app decides those fields itself, as when it answers a column's own field or a form's keys (Make's dynamic fields), the form reads them from the app with your connection and shows them in place, with the app's own words and defaults. Opening a module never changes it: a fetched field's default fills an empty field only after you change what brings it, never replaces what you typed, and a value the app stops answering for is kept. Clearing the list removes the fields that showed under it.

Fixed

  • The template builder's signer preview walks fields in reading order. In Preview, Next Field went along each line from left to right, so on a Hebrew document it visited a line backwards. It now goes top to bottom, and along each line from its start: right to left on a Hebrew document, left to right on an English one. This is the order a signer is now taken through the document.

New

  • Flows API (by invitation only): an app's own lists for a field's dropdown. POST /api/v1/flows/{id}/rpc reads the choices of a field that an app fills from the connected system (Make's dynamic options), with the connection chosen for the module: a channel, a board or a form to pick from. It runs only a list the module itself declares, for at most 40 seconds, and answers at most 1,000 choices with the connection's credentials redacted. A module's settings show these lists, and a picked choice keeps its type (a number, or yes or no). No app in the catalog uses them yet.
  • Flows (by invitation only): the canvas shows the flow's last run. A link gets thicker the more items went through it, and a link nothing went down is dotted. The chips on a router's routes and on a document step's Signed and Declined paths say how many went each way. A bar at the bottom of the canvas says when the flow last ran, how many items it handled, how many documents still wait to be signed, and any failures or warnings. Play back replays that run on the canvas in a few seconds, then says what it did.
  • Flows (by invitation only): documents waiting for a signature show on the canvas. A dotted ring appears round a document step, with one token for each waiting document (two tokens and a "+" count past three). Open a token to see the document, when it was sent and when it expires, who has signed and who has not, and send a reminder to the next signer. People who can't edit flows see how many documents wait, without names. A document signed while you watch leaves through the Signed path.
  • Flows (by invitation only): an empty Signed or Declined path shows a dotted stub with a plus. Press it to add a step on that path.
  • Flows (by invitation only): an error route says what handles it, for example "Save it and retry later · Break · 3 tries".
  • Flows (by invitation only): Run once's status moved from the bar at the bottom of the editor into the last-run bar on the canvas, beside the last run's summary.
  • Flows (by invitation only): the numbers on the run bubbles pop when they change, so you can watch a run go. With reduced motion they just change.
  • Flows API: a run read gives the run list's fields. GET /api/v1/flows/{id}/runs/{runId} also returns flow_name, run_no, active_ms, items, started_by_name, waiting_documents and saved_to_retry, as GET /api/v1/flows/{id}/runs already did. Nothing was removed or renamed.

Fixed

  • Signing links copied from the Submissions list work again. The link shown on each row, Copy Signing Link, Open Signing Link and Copy link for a signer all built their link without the signer's key, so it ended in ?token=undefined. It opened for an anonymous signer, but a named signer got "Signer not found", and with several anonymous signers it could open the wrong one. The list now carries each signer's own link. Anywhere a signer's link is not available, the dashboard offers no link instead of a broken one. The API's submission list is unchanged for API tokens and integrations: it still never returns signers' signing keys.
  • Signers on a phone can scroll the whole document again. On a phone, the document in the signing steps (the first look, the See Preview window and the final review before Submit and Send) did not move under a finger unless it was zoomed in, so the end of the last page could never be reached. Now the document scrolls like any page: the header scrolls out of the way to give the document the whole screen, and the end of the last page comes up fully above the Submit and Send bar. Pinch to zoom still works. While zoomed in, a finger moves around the part you zoomed into; zoom back out to scroll on.
  • Signers get auto-detected fields in the order the document reads. Fields found on a document were listed by how high each box started on the page, then left to right, so on a Hebrew document a line was read backwards, and a tall signature box jumped ahead of the name beside it. Fields now go top to bottom, and along each line from its start: right to left on a Hebrew document, left to right on an English one. That order holds in the signing form, in Previous / Next on the editable document, and in the template builder's field list. Fields an author put in order in the builder keep that order. Documents already sent get the new order the next time they are opened.

Security

  • The web app's styling toolkit moved to Tailwind CSS 4. Tailwind 3 pulled in braces, which has a denial-of-service flaw with no fixed release (GHSA-vfj7-8cjw-p6xm). It was only ever used while building the app, and it is now gone from it entirely. Nothing looks different: every page we compared renders pixel for pixel as before, in English and Hebrew, light and dark, on desktop and phone. The one change is browser support: the app now needs Firefox 128 or newer. Chrome 111, Edge 111 and Safari 16.4, the versions it already required, are unchanged.
  • Digital signatures no longer depend on node-forge. node-forge has a signature-verification flaw with no fixed release (GHSA-86w9-cpqp-85rv). SignFlow never used it to verify a signature, and it is now gone from the server entirely. Signed PDFs come out exactly as before and show the same way in Adobe. Every agency certificate already generated or uploaded keeps working. Uploads still accept Windows and older OpenSSL exports, and new agency certificates are encrypted with AES-256, OpenSSL 3's default.

Changed behaviour (API): publishing a flow (POST /api/v1/flows/{id}/save) and turning a flow on (POST /api/v1/flows/{id}/activate) now answer 422 required_missing when a module leaves a required field empty. The answer's issues name each one (moduleId, and field as config.<name> or map.<name>; truncated counts any left out). Such a flow failed at that module on every run. Migration: read issues[].moduleId and issues[].field, fill each field they name in the draft (PUT /api/v1/flows/{id}/draft), then publish and turn the flow on again. Saving a draft is never refused, turning a flow off is never refused, and flows that are already on keep running as before.

Changed behaviour (API): PUT /api/v1/flows/{id}/trigger/start now answers 409 start_before_processed for Since a specific date before the last record the trigger took, on a Priority Watch records that detects changes since its last check. The answer's processed_until is the earliest time it takes, and GET /api/v1/flows/{id}/trigger/start gives it too (null for any other trigger). Migration: choose that time or a later one, or From now on.

New

  • Flows (by invitation only): a clearer module settings panel. The panel is wider and has a menu in its header (Clone, Copy, Delete: the canvas's own), tabs for Settings, Output (the module's data from the run on the canvas) and Notes, and a banner that lists the required fields still empty, each a link that takes you to the field. Discard changes puts the module back as it was when you opened it, as one step you can undo, and Run this module only is in the footer. A required field says "Required" under itself while it is empty. The document step's fields sit in sections that show how many are left, and less common settings sit under Advanced settings.
  • Flows (by invitation only): the document step says what it will do. Its reminders read as a sentence ("Up to 3 reminders: 2, 5 and 8 days after the document is sent"), and turning reminders on fills in their numbers. Use the proposals says how many fields it filled and offers Undo, and a chosen template shows how many fields and signers it has.
  • Flows (by invitation only): live updates. A signature, a run that starts, moves or ends, a call queued for a flow and a publish made in another window now appear in about a second, without a refresh: Flows home, the runs lists, the flow list and the dots on a Run once all update by themselves, and a run that is waiting for signatures keeps being followed for as long as you have it open. If the live connection is not available, everything refreshes every 30 to 60 seconds. When someone else, or you in another window or tab, changes the flow you have open, a note above the canvas says so, with Reload (take their version) and Keep mine; your own edits are never replaced behind your back.

Improved

  • Flows (by invitation only): the module settings panel's OK button is now Done. Your edits are saved to the draft as you make them, as before; Done closes the panel. The panel no longer waits for a first OK to show the required fields left empty: it shows them at once.
  • Organization settings: the Auto-Reminder hint says what it does.
  • Flows (by invitation only): Choose where to start asks you to publish first only when the trigger changed. Moving modules, renaming the trigger, adding a note or changing a module after it no longer asks you to publish before you choose where the trigger starts. A change to the trigger itself (its module, connection, settings or mapping) still does, because the choice is made for the live version's trigger.
  • Flows (by invitation only): Choose where to start publishes through the Publish dialog. When a flow has changes that are not live, Publish changes in Choose where to start now opens the same Publish dialog as the editor's header: it lists what changes, takes a note, and its toast offers Undo for 15 seconds. Cancel takes you back to Choose where to start. When the changes are already live (another window published them), Publish now says Nothing new to publish instead of naming a new version. The messages that said "Save the flow first" now say "Publish the flow first".

Fixed

  • Flows (by invitation only): a document's reminders keep their spacing after a delay. If a reminder could not go out on its day, the flow now sends one reminder and waits the plan's interval before the next, instead of sending every missed reminder at once.
  • Flows (by invitation only): Priority's Watch records no longer runs the same change twice. When it watches for changes since its last check, a check could read again, and run again, a change the check before had already taken: one made in the same minute that check ran, just before it read (Priority compares that time by the minute). A change the check before already took is now seen and not run again. A record changed again still runs, except when the second change, in that same minute, left every column the trigger reads as it was (a change only to a subform line, say).
  • SignFlow Connect: a rule watching Priority for changes since its last check could send its document twice for one change: the next check read again a change made in the same minute the check before ran, just before it read (Priority compares that time by the minute). A change a rule already ran for is now recognised and not run again. A record changed again still runs, except when the second change, in that same minute, left the record's columns as they were (a change only to a subform line, say).
  • Flows (by invitation only): Choose where to start never starts processed records again. On a Priority Watch records that detects changes since its last check, choosing Since a date earlier than where the trigger stood could start records the flow had already processed, so their Priority writes ran again and documents could be sent twice. Such a date is now refused: the dialog names the earliest time you can choose, and the date field starts there. Triggers that watch a date column, and app triggers, were not affected and take any date as before.

Security

  • Signing out, or switching Connect or Flows off for an organization, now ends open live-update connections at once. Before, a connection could stay open until its session expired, up to an hour (it carried run status only, never names or documents). Your other signed-in devices reconnect by themselves within a second. Other ways a session ends, and a plan or add-on that lapses, are unchanged and still end the connection within the hour.

New

  • Flows (by invitation only): routes and error handling open beside the canvas. They replace the Order routes and Add an error handler dialogs, and every change is saved to the draft at once and undone with Ctrl+Z.
    • Routes. Drag a route, press Alt+↑ or Alt+↓ on it, or use its menu to change the order, rename it, edit its filter, turn it off or delete it. Each route reads its filter as a sentence and, after a run, how many of the items that reached the router went down it. You also see which items took which route, and when items went down more than one route, a way to make one route skip what the other takes.
    • Error handling. Choose what happens when a module fails, or swap one handler for another in place. A route can handle one kind of error only: any other error is then not handled, so the run stops with it, or the item is saved to retry when incomplete runs are on. The panel shows the module's failures in the last run, with a link to the runs.
  • Flows (by invitation only): publish your changes, with a note, and undo it. The editor's header shows the live version and your draft ("Live v14 · Draft · 3 changes, saved"). Publish changes lists what changed and asks before it publishes; you can add a note, kept with the version (leave it empty and the list of changes is kept). For 15 seconds after publishing, Undo makes the previous version live again. Moving modules and editing notes are not changes.
  • Flows (by invitation only): make an earlier version live. The version chip opens your versions, with who saved each, when, and its note: preview one, restore it into your draft, or make it live (on a flow that is on, it must pass the same checks as turning the flow on).
  • Flows (by invitation only): Test mode. With Test mode on, Run once runs a safe test: nothing is written and no document is sent. How documents end is asked once and reused while Test mode is on.
  • Flows (by invitation only): a run's result after Run once. When a run waits or ends, a message says how many documents it sent, how many operations wrote to other systems, and how many items were saved to retry.
  • Flows API: make a version live. POST /api/v1/flows/{id}/versions/{versionId}/publish makes a saved version the live one (via: undo or make_live; an optional expect_version_id refuses with 409 version_changed when another version is live now). A flow turned on or off, or rescheduled, during the call also answers 409 version_changed, and nothing changes. Recorded in the audit log. Needs the "Edit flows" permission.
  • Flows API: version notes and names. POST /api/v1/flows/{id}/save takes an optional note (one line, at most 200 characters). GET /api/v1/flows/{id}/versions gives each version's note and the saver's name (created_by_name, while they are a member of your organization). GET /api/v1/flows/{id} gives next_version_no.

Improved

  • Flows (by invitation only): Save is now Publish. The editor's Save button is Publish changes in the header, with Run once, the on/off switch and Test mode. Ctrl+S (⌘S) opens the Publish dialog instead of saving at once. Your draft is still saved as you work. Turning a flow off offers Undo.
  • Flows (by invitation only): publishing needs the required fields. A flow with a required field left empty can't be published until it is filled in; the Publish button lists the modules. Run once still runs with them, and warns.
  • Flows (by invitation only): the editor's tabs are Editor, Runs and Trigger.

Fixed

  • Flows (by invitation only): Publish keeps to the flow it checked. A flow that is on is checked as it is turned on before a new version goes live. If someone turned the flow on or off, or changed its schedule, while you published, the version could go live without those checks. Publish now stops and says the flow changed meanwhile, and saves nothing: reload it and publish again. Publishing changes that are already live (a second press of Publish, or another window that published the same draft) no longer adds a copy of the live version: POST /api/v1/flows/{id}/save answers with the live version and changed: false, and writes no version and no audit entry.

Changed behaviour (API): Remind (POST /api/v1/submissions/{id}/resend/{signerId}) now answers 409 instead of sending, for a document that ended (submission_ended), a signer who already signed or declined (signer_done), and a signer whose turn has not come in a document with a signing order (signer_not_current). Migration: remind only signers whose status is pending or viewed (and, with a signing order, whose turn it is), or treat these 409 codes as "nothing to send". Make scenarios that remind every signer through Send a Reminder will see them as errors.

Changed behaviour (API): turning a flow on (POST /api/v1/flows/{id}/activate), and saving a flow that is on (POST /api/v1/flows/{id}/save), now answer 409 invalid_graph when a module that uses a connection has none chosen (issue connection_not_chosen, on conn). Such a flow failed at that module on every run. Migration: choose the module's connection (its conn in the draft), then save and turn the flow on again. Flows that are already on keep running as before.

New

  • Flows (by invitation only): automatic reminders on document steps. In a Create a document and wait step, turn on Remind signers who haven't signed and choose when: the first reminder after a number of days (1 to 30), then one every few days (1 to 30), up to 5 reminders. Each reminder emails every signer who still has to sign (with a signing order, only the signer whose turn it is), in the name of the person who sent the document. Reminders stop when the document is signed, declined or voided, and none is sent once it expires. A signer anyone else (a person, or another flow) reminded in the last 24 hours is skipped. Each reminder is in the audit log, marked as sent by the flow, and fires signer.reminder_sent. New document steps start with reminders on when your organization set Auto-Reminder (days): every that many days, at most 3 times. Existing steps are unchanged. A reminder that could not be sent shows as a warning on the step's operation, and the document keeps waiting.
  • Flows API: `forNewModules` on `POST /api/v1/flows/schemas`. Send forNewModules: true when the nodes are modules being added: their settings' defaults then follow the organization's settings where the module says so (today, a new Create a document and wait step's reminders follow Auto-Reminder (days)). Without it, the answer is as before.
  • Flows (by invitation only): listen for a sample call while a flow is off. On a flow that starts with a custom webhook, an owner or admin can listen for 5 minutes (POST /api/v1/flows/{id}/webhook/listen). The next call is kept as a sample and answered 200 Accepted, and nothing runs for it; every other call to a flow that is off is still turned away and not kept. On a flow that is on, the call is kept and also runs as usual. Read the sample with GET /api/v1/flows/{id}/webhook/sample to build the webhook's data structure from it, and stop or discard it with DELETE /api/v1/flows/{id}/webhook/listen. A sample never keeps a file's contents and holds at most 512 KiB: a larger call still ends the listening, but only its method, content type and size are kept. Only owners and admins can read a sample, for 24 hours after the call; the daily cleanup then deletes it. A flow set to Keep data confidential can't listen. Listening, stopping and each kept sample are recorded in the audit log.
  • Flows (by invitation only): Flows home. The Flows page now opens on what needs you: a connection to reconnect, a flow that turned itself off or fails today, and runs saved to retry, each with the button that fixes it. Beside it are the documents your flows sent that wait for signatures, with Remind. People with the "Edit flows" permission see names; others see how many there are. One sentence sums up your last 30 days.
  • Flows: tabs, search and a richer list. All, On, Off and With problems each show a count, next to Trash. Search finds a flow by its name, its folder, the apps it uses or the names of its modules. Each flow shows its path of apps, how it starts, its last run, its last 7 days and its operations, and you can sort by name, last run or operations.
  • Flows: starter flows. All templates offers ready-made flows, for example "Save signed documents back to Priority", each opening as a draft to fill in. With no flow yet, Flows shows them next to a short "How a flow works". The API lists them at GET /api/v1/flows/starters (scope flows:read).
  • Automation in the sidebar. Flows and Data sit in their own Automation group. Runs, Connections and Apps join it as their pages arrive.
  • Flows (by invitation only): answer the webhook caller. A flow that starts with a Custom webhook can now answer the request that started it, with the new Webhook response module: a status from 200 to 599, a body (text; a collection or a list, sent as JSON; or a file) and up to 16 headers. The caller waits up to 180 seconds for the first answer. If the run ends without one it gets 200 Accepted, or 500 Scenario failed to complete. when the run failed. A flow that processes data in order, or that does not run immediately, still answers Accepted at once. A flow with a Webhook response is not turned off by an ordinary error and waits out no back-off: the failing request is answered (when its caller is held) and is not run again. An error that stops the flow from running at all (for example, running out of operations) still turns it off, and so does the last failed automatic retry of an incomplete run. When the run cannot start at once (the flow's maximum runs per minute, or a back-off), the caller gets 429 Too many requests for scenario and nothing is kept.
  • Flows (by invitation only): one Runs page for all your flows. Runs, in the sidebar's Automation group with the number of runs saved to retry, lists every flow's runs, newest first and grouped by day. Each run shows its number, its status, how it started, how many items it handled, its operations, and how long it worked.
    • Filters: by flow, by period (the last 24 hours, 7 days or 30 days, or dates you choose) and by status, Waiting to sign included. The filters stay in the page's address, so a link keeps them.
    • Empty checks (scheduled checks that found nothing new) are hidden unless you ask for them, and the page says how many it hid.
    • Open a run's row to see what happened to each item: where it ended, or where it failed.
    • A flow's own runs tab is now the same page, fixed to that flow.
  • Flows (by invitation only): Saved to retry. Runs that failed at a module and were saved, so they can be retried from there, now have a tab of their own with their count. Each one shows: You can Retry now, retry with the draft's settings, open the module in the editor, or delete the saved run (it asks first). Each retry and delete is in the audit log.
    • where it stopped and the error;
    • when it retries. A retry waits while its run still waits for signatures.
  • Flows (by invitation only): the builder warns before `erase` fails on a Priority field. Priority does not let a number, an amount, a date or a yes/no column be emptied through its API, so a run refuses erase there. The mapping panel now marks erase in those fields, and a field that holds it says so, before the flow runs.
  • Flows API: `ui.erase` on a module's inputs. POST /api/v1/flows/schemas marks an input with ui: { erase: "refused" } where a run refuses the erase keyword.
  • Flows (by invitation only): your custom variables in the mapping panel. Anyone who can edit flows now sees the organization's custom variables by name in the mapping panel's Variables tab, and can map one into a field. Their values stay visible to owners and admins only.
  • Flows API: custom variable names for flow editors. GET /api/v1/custom-variables?view=names returns each variable's name and type, never its value. It needs the "edit flows" permission and the flows:read scope. The full list, with values, stays owners and admins only.
  • Flows API: a document out for signature has an output while it waits. For a step that sent a document still waiting to be signed, GET /api/v1/flows/{id}/runs/{runId}/payload now returns its output so far: the document, when it was sent and when it expires, and each signer's name, email, role and status as of when it was sent. It never contains a signing link. When the document is signed, declined, voided or expires, its real output replaces it, as before. GET /api/v1/flows/{id}/runs/{runId}/operations marks such a step with has_provisional_output, keeps has_output false until the document ends, and gives a document's step settled_at, the time its signing ended. Reading outputs still needs the "edit flows" permission, and a confidential flow keeps none.

Improved

  • Flows: New flow no longer asks for a name first. It opens "Untitled flow" in the editor with the name selected, ready to type over. A flow's last update date moved into its More menu, and the links between the flow pages moved from above the list to the sidebar.
  • Flows: "Waiting to sign". A run held for its documents now reads Waiting to sign. It used to read "Waiting for a signature or another flow".
  • Flows: a flow's runs load as you scroll. The runs tab no longer pages with Newer and Older; more runs load at the end of the list, or with Load more runs. "Show check runs" is now Hide empty checks, and it is on by default. The tab now lists the runs of the period you choose: the last 7 days by default, or 24 hours, 30 days, or dates you choose up to a year back (it used to page over every run). A flow in the trash no longer lists its runs on its tab; restore the flow to see them.
  • Flows (by invitation only): a module with no connection chosen stops the flow from turning on. The builder marks the module and lists it with the flow's warnings, and its settings say so under the Connection field. You can still run the flow once with Run once to test it: the notice under Run once names the module, as before. The note before turning the flow on asks you to fix it first.
  • Every email SignFlow sends is redesigned.
    • Signing invitations, verification codes, reminders, signer and completion notices and team invitations use SignFlow's light look: your organization's logo and brand color on a white card. When you have set no brand color, the accent is SignFlow's teal instead of indigo. Organization Settings → Branding shows the same default in its email preview.
    • Billing notices use SignFlow's dark look. A Hebrew notice now reads right to left from top to bottom.
    • Internal billing and collection alerts to the SignFlow team use the same dark look.
    • What every email has now: a short inbox preview line, a plain-text version for mail apps that show text only, and a layout that holds up on phones and with images turned off. A Hebrew name or document title in an English email keeps its own direction. Verification codes still never appear in the subject or the preview line.
  • Logos show up in more inboxes. The logo now travels inside the email instead of being fetched from our servers when the email is opened, so mail services that cannot reach those servers still show it. This covers the SignFlow logo and organization or agency logos uploaded to SignFlow up to 512 KB. A larger logo, or one hosted on your own website, is still linked as before.
  • Replies reach someone. Replying to a SignFlow email used to go to a no-reply address. A reply now goes to your organization's reply-to address when you have set one, else to support: care@leonai.io, or your agency's own support address under a white-label brand.

Fixed

  • Remind no longer emails a signer who should not get one. POST /api/v1/submissions/{id}/resend/{signerId} now answers 409 for a document that ended (submission_ended: completed, declined, voided or expired), a signer who already signed or declined (signer_done), and, in a document with a signing order, a signer whose turn has not come (signer_not_current). Before, it sent each of them a reminder email. A signer after one who declined, in a document with a signing order, is also not reminded: their turn cannot come. And Remind on a document saved without a name now uses its template's name; before, it failed with an error.
  • Flows (by invitation only): no more false "no connection" warning on HTTP modules. An HTTP module set to No authentication needs no connection, and is no longer marked as missing one. Resolve URL never needs one.
  • Flows (by invitation only): an error route can hold an If-else and its Merge before its error handler. A route that handles a failure by choosing between branches, merging them and then ending with Ignore, Resume, Break, Commit or Rollback was refused with "it can only end an error route". Make allows and runs such a route, and now so does SignFlow.

Security

  • Flows: answers from a flow's webhook address are sandboxed. Every response from /api/v1/flows/inbound/… now carries Content-Security-Policy: sandbox; default-src 'none'; frame-ancestors 'none' and X-Content-Type-Options: nosniff, so a page a flow returns cannot run script with a signed-in person's session. A Webhook response cannot set cookies, redirects (Location), CORS headers or other security headers.
  • Flows (by invitation only): moving an active flow to the trash needs the right to turn flows on and off. The trash turns a flow off, so a member who may edit flows but not turn them on or off can no longer switch one off this way. In the flows list, Move to the trash is unavailable to that member on an active flow; a flow that is already off can still be moved. API: POST /api/v1/flows/{id}/trash on an active flow answers 403 without flows.activate, and 409 flow_changed when the flow was turned on in the meantime.

Breaking (API): a flow graph's meta.timezone is no longer read. A flow's runs, inputs and dates use the flow's own time zone (Schedule settings), else your organization's, else UTC. A graph that still has meta.timezone is accepted, and the key is dropped the next time the flow's draft is saved. Migration: set the flow's time zone with PUT /api/v1/flows/{id}/schedule, sending timezone together with the flow's schedule.

New

  • Flows API: a note can say who wrote it and when. A note on a module or a link may carry by (a member's user id) and at (a UTC time). A by that names no member of the organization is dropped when the flow is saved; the note is kept, and a former member keeps their name on notes that were already theirs.
  • Flows API: more about each app. GET /api/v1/flows/apps can describe an app (ui.description), its category, how it connects (ui.authKinds), its setup steps and what its connection can and cannot do (ui.scopeWords), and what a trigger's items are called (ui.itemNoun). The built-in apps now describe themselves and give their category.
  • Flows API: run numbers, active time and item counts. In GET /api/v1/flows/runs and GET /api/v1/flows/{id}/runs, each run now has its number in its flow (run_no), how long its steps worked (active_ms, in milliseconds, waits and sleeps left out) and how many items its start gave (items). The document reads (GET /api/v1/flows/documents, GET /api/v1/flows/{id}/runs/{runId}/documents) give each document its run's number. Runs from before this change have none (null).
  • Flows (by invitation only): each run counts the items at every link. A run now records, for every link of the flow, how many items went along it and how many its filter stopped: router routes, If-else branches, a document's signed and declined paths and error routes included. A run that waits for documents keeps its counts so far, marked as not final. Read them with GET /api/v1/flows/{id}/runs/{runId}/links. Runs from before this change have no counts.
  • Flows (by invitation only): run a schedule only in the time windows you choose. Through the API, a flow's schedule can now hold time windows, as Make's advanced scheduling does: days of the week, months, and a From and Until time on the flow's clock. A window can cross midnight, such as 22:00 to 06:00.
    • Checks at regular intervals start exactly when a window opens and repeat every interval inside it. A daily, weekly, monthly or yearly time outside every window is skipped.
    • Daylight saving is followed. A window that would open in the hour the clocks skip opens when the clocks jump.
    • Clear refusals. Days after Saturday are refused with a reason, where Make would save a schedule that never runs. Turning on a flow whose windows its schedule can never meet is refused too.
    • Your windows are kept. Saving the schedule in Schedule settings keeps the windows set through the API. Editing them there comes in a later release.
  • Flows (by invitation only): a "Time zone" variable. In a module's settings, the Variables tab of the mapping panel now lists Time zone (אזור זמן in Hebrew): the time zone the run uses, such as Asia/Jerusalem. It is the flow's own time zone from Schedule settings, else your organization's, else UTC, and it stays the same for the whole run. A flow's schedule, its runs, its inputs and its dates now always use that one time zone.
  • Flows (by invitation only): an error route can handle just the errors you choose.
    • A filter on the error route. Right-click a module's error route and choose Set up a filter, or click its line, to decide which errors the route handles. In the filter, the Data tab lists the module's Error, with its Type, Message and Details, so the route can take, say, only errors whose type is ConnectionError. Copy filter and Paste filter work on an error route too.
    • An error the filter turns away is never hidden. It is treated as if the module had no error route: the run stops with that error, or, when the flow stores incomplete runs, that item is saved to retry and the run ends with a warning.
    • A different way out for each kind of error. Put a Router on the error route and give each of its routes a filter; a fallback route takes every other error. An error that no route takes stops that item quietly, as an error route with no error handler does.
    • Deleting a module keeps its error route connected. When you delete the first module on an error route, the route now joins the next module instead of being cut off, and the filter that was on the deleted module's way out moves onto the error route, so only the errors it lets through take the route.
    • API. In a flow's graph, an error link now accepts a filter, in the same shape as other links' filters.
  • Flows (by invitation only): new API reads for the Flows screens. Your API token needs flows:read (integrations:read for connection usage).
    • Runs across your flows. GET /api/v1/flows/runs lists the runs of all your flows, newest first. Filter it by flow, status and time; empty scheduled checks are hidden by default, and the first page says how many were hidden. It pages with next_cursor. A flow's own run list (GET /api/v1/flows/{id}/runs) takes the same status filter. Every run now shows its flow's name, who started it, its documents waiting for signers and its runs saved to retry.
    • Documents out for signature. GET /api/v1/flows/documents lists the documents your flows sent that wait for signers, soonest expiry first, with each signer's progress. GET /api/v1/flows/{id}/runs/{runId}/documents lists every document one run sent and how each ended. Both need the permission to edit flows, because they show signers' names and emails. GET /api/v1/flows/{id}/waits/summary gives the counts per document module to everyone in your organization.
    • Saved to retry, everywhere. GET /api/v1/flows/incomplete-runs lists the runs saved to retry across your flows (count=1 gives how many are still open, pending or retrying; add flow_id or run_id to count one flow's or one run's). Every saved run now shows its whole retry plan (how many tries, how far apart, the next one) and whether the run that saved it is still going.
    • Your flows in numbers. GET /api/v1/flows/stats gives the last 30 days at a glance: runs, documents sent and signed, and the share of runs with no error.
    • A richer flows list. Each flow in GET /api/v1/flows shows its path of apps, its module names (for search), its runs on each of the last 7 days, its operations in the last 30 days, how many of its saved runs are still open, and how many of its documents wait for signers.
    • Connection usage. When flows are enabled for your organization, the connections list shows how many flows use each connection, and GET /api/v1/integrations/connections/{id}/usage lists them, module by module.

Improved

  • Flows (by invitation only): error handlers say what they do. The five error handlers are now named Skip this item, Save it and retry later, Use a stand-in result, Stop and keep what was done and Stop the run, in English and Hebrew. GET /api/v1/flows/apps also gives each flow-control module Make's name and id (makeName and makeId, for example Ignore and builtin:Ignore), and each error handler a line on how the run ends (ui.outcome).
  • Flows API: a document step's `ended_at` is when its document was sent. In GET /api/v1/flows/{id}/runs/{runId}/operations, a document step's ended_at no longer moves to when the document was signed, declined or expired. Documents settled before this change keep the time they had. When the document was signed, declined or expired is still in the step's output (completed_at when it was signed, ended_at when it was declined or expired).
  • Flows (by invitation only): a new look for the Flows pages. The rest of SignFlow is unchanged.
    • Calmer colours, light and dark. The Flows pages and the windows they open use a new palette. Dark mode is a set of cool greys, with colour kept for meaning: green for done, amber for warnings, red for errors, violet for the flow itself.
    • A clearer keyboard focus. Moving with Tab shows a thin violet outline around what has focus.
    • Mapping pills you can read at a glance. A pill is tinted in its app's colour, with the module's number in a small chip and the field's titles after it (3 Customer › Email). Screen readers say "Module 3, Customer, Email". A pill you add lands with a short animation, unless your device asks for reduced motion.
    • Lighter links. Links between modules are thin solid lines, and error routes are dashed.
    • Slightly smaller, tighter text on the Flows pages.
    • Hebrew typing follows the language you type. Text typed in a Flows field aligns to its own language, so an address stays left to right.
    • Notifications at the bottom centre of Flows pages.
    • A code font for formulas, keys and IDs.
  • Flows (by invitation only): an automatic retry waits for its run to end. When a run that is still going, for example one waiting for documents to be signed, saves a failed step to retry, its automatic retries now wait until that run ends: every document signed, declined or expired, or the run stopped. Retrying or deleting that step through the API was already refused until then. This keeps a run's documents from being sent twice and a later failure from being lost. A retry held this way is not lost and uses up none of its attempts; it starts within a minute of the run's end. A flow with Process data in order on starts no new runs from its trigger while it has a saved step that is not resolved, so its new runs now also wait for that run to end.

New

  • Flows (by invitation only): move around the canvas with a trackpad or a mouse, and find your way back.
    • Trackpad and pinch. Swipe with two fingers to move the view, and pinch to zoom smoothly around the pointer, in Safari too. Pinching over the canvas zooms the canvas, not the whole page.
    • Canvas options. In the zoom controls, choose how the canvas reads your scroll wheel: Detect automatically, Mouse or Trackpad. Your choice is remembered in this browser.
    • Middle-click drag. Hold the mouse wheel down and drag to move the view, starting anywhere on the canvas, even on a module.
    • Each flow opens where you left it. The builder remembers each flow's zoom and position in this browser. Fit the flow to the screen resets it.
  • Flows (by invitation only): a quicker module picker, and Order routes that tidy up.
    • Enter adds the top match. Press Enter in the picker's search to add the top match; the picker shows which module Enter will add as you type.
    • Modules grouped by kind. An app's modules are grouped under headings (triggers, actions, searches, and more). Instant triggers are marked with a lightning bolt and "Instant", and polling triggers with a clock.
    • Auto-align in this order. In Order routes, this option rearranges the flow so the routes are drawn top to bottom in the order you set, in the same Apply (one Undo). It is on by default, and your browser remembers your choice.
  • Flows (by invitation only): notes, paths and filters on the canvas.
    • Note previews. Hover over a module's or link's notes badge, or move to it with the keyboard, to read its first note without opening it. Press Esc to close the preview.
    • All notes in one list. A Notes (n) button in the canvas's top corner, next to Problems, lists every note in the flow. Click a module or link in the list to select it and bring it into view.
    • Select the whole path. Right-click a route, an If-else branch, a signed or declined path, or an error route and choose Select the whole path to select every module on that path up to where it rejoins the flow, so you can copy, clone or delete them together. It also works when you can only view the flow.
    • Copy and paste filters. A link's menu has Copy filter and Paste filter (Copy condition and Paste condition on an If-else branch); a paste is one step you can undo. A filter only pastes onto another filter, and a condition onto another condition; if a paste can't be made, the builder says why.
    • More in the shortcuts list. It now covers swiping with two fingers to pan, pinching or Ctrl/Cmd + wheel to zoom, and dragging with the middle mouse button to pan.
  • Flows (by invitation only): see where a mapped value comes from, and a notice when Run once may fail.
    • Where a value comes from. Rest the pointer on a mapped value in a module's settings or a filter, select it, or focus an item in the Data tab, and the module it comes from is ringed on the canvas. The ring stays still and goes away when you move off or close the panel.
    • Run once warns, never blocks. When a run starts while some modules still have required fields left empty or no connection chosen, a notice under Run once lists them by number and name ("Module 3 · Send email: a required field is empty"). Click one to open its settings, or close the notice. It appears only once the run has actually started.
    • F2 in the shortcuts list. The keyboard shortcuts list (?) now shows how to switch a mapped field to text mode: F2, or a double-click on the field.

Improved

  • SignFlow opens faster. A first visit downloads about 45% less: about 400 KB gzipped instead of 744 KB. Pages without a document or a chart no longer download the PDF viewer and the chart library (the pages that show them still load them as before), and a visit downloads only the language you read: English, or Hebrew if you chose it. The other language downloads when you switch. Signing pages still load both, because a document's own language decides which one its signer sees.
  • Flows (by invitation only): the module stays in view, and the problems list takes you there. When a module's settings or a link's filter opens, the canvas moves so the module or link stays visible beside the panel, not under it; a newly added module is brought into view the same way. The problems list names each module by number and name ("Module 3 · Find deals"), and clicking a problem takes you to it and opens the module's settings or the link's filter. Field paths no longer show as raw text.
  • Flows (by invitation only): full module names on hover. When a module's name or its app line is cut off on the canvas, hovering over it shows the full text.
  • Flows (by invitation only): clearer names. When you delete modules, the confirmation lists each one by number and name ("Module 3 · Find deals"), and if the flow can't be joined back together afterwards, the message names the modules too. On an If-else that has its Merge, the + button is named for its module ("Add a condition to module 2"), so screen readers can tell two If-elses apart. In the module picker, a scheduled trigger is marked "Scheduled" with a clock, as an instant trigger is marked "Instant".
  • Flows (by invitation only): the module stays in view when the editor opens a panel for you. When the editor opens a panel itself (the run Inspector, a module's settings after you add a connection, the webhook address while Run once waits, or the start when you turn the flow on), the canvas first moves that module out from under the panel, even while the canvas is still opening. Clicking a notes badge closes its preview as the notes open.

Fixed

  • Submissions: a request held for review no longer shows a signing link in the list. A request created with "hold": true (status draft, "Draft (held for review)") showed a signing link that could not work in the Signing Link column, with its copy and open buttons, and its menu offered Copy Signing Link, Open Signing Link and a Copy link for each signer. The row now shows "—" in that column and its menu has no link items until the request is released, as the request's own page already did.
  • Flows (by invitation only): smaller fixes in the canvas builder. The Problems and Notes lists in the canvas's top corner no longer run past the bottom of a short canvas. Run with existing data shows the real reason a past run can't be reused, and forgets a refusal about the flow's start once you change the start module. Screen readers read a Connection field's note when there is no connection to choose from. A required field that holds an empty group is no longer reported as left empty.
  • API: updating a request's status to `in_progress` now answers 400 instead of failing with a server error. PATCH /api/v1/submissions/{id} listed in_progress as a status you could set, but SignFlow never stores it: every such request failed with 500 and changed nothing. The statuses you can set are pending and expired. The API reference now lists every status a request can have, adding viewed and signed and dropping in_progress.

New

  • Flows (by invitation only): the flows list, each flow's run history, and its webhook's requests and queue. For organizations the flow builder has been turned on for:
    • The Flows list shows each flow's folder, an on/off switch, its schedule in words, its saved version and when it last ran, and filters by folder. A flow's menu renames it, moves it to a folder, turns it on or off, clones it (the copy gets its draft, but not its schedule or its webhook), exports it as JSON, or moves it to the Trash, where it can be restored or deleted for good; a flow left in the trash is deleted after 30 days.
    • Each flow has a Diagram and a History view. History lists the flow's runs, newest first: their status, how each run started, when, how long it took, how many operations it used, and any error with the number of the module it happened in. Check runs, scheduled checks that found nothing new, are hidden until you ask for them. Show on canvas opens the flow with that run's results on its modules, as after Run once: grey when the flow may have changed since the run, and a run whose data was not kept (a confidential flow) or was deleted (after 30 days) says so.
    • Owners and admins also get a Webhook view: the requests the flow's custom webhook answered in the last 3 days (when, the method, the answer, the size, the address and the user agent; never what they held), and the requests waiting in its queue, which they can open, delete one at a time or all at once. For a custom webhook, Set the data structure from this request makes a data structure from a waiting request's fields, and the webhook then checks every request against it and keeps only its fields.
  • Flows (by invitation only): filters on links and If-else conditions. Click a link's line, or choose Set up a filter on its menu, to give the link a filter: a label and groups of conditions. Every condition in a group must hold (AND), and one group holding is enough (OR); a filter with no conditions lets everything through. A condition compares a value with another using one of 52 operators, grouped as text, numbers, dates, times of day, arrays, yes/no and basic, with their names in English and Hebrew; both values can be mapped from the modules before the link, and a new condition's operator starts from the type of the value it checks. Exists and Does not exist take no second value. A link with a filter shows a funnel and the filter's label. A router route's menu can make it the Fallback route, which is tried only when no other route took the bundle (one per router: choosing another route moves it there), or turn the route off so it is skipped. An If-else's settings list its branches in the order they are tried; each condition opens in the same editor, as it does from its branch's line or menu (closing one opened from the settings goes back to them), and Else takes none. Problems in a filter or a condition are shown beside it. When you delete a module with one link in and one link out, the link in now leads to the module after and keeps the conditions of both links, joined with AND (a value they read from the deleted module is cleared), and a message says when it took on the other link's conditions. The links are not joined when the link out is an error route or a route turned off, when it leads back to the module the link in comes from, or when the link in is an Else branch or an error route and the link out has conditions; the modules after are then left unconnected, and a message says so. Every change is saved automatically and can be undone.
  • Flows (by invitation only): scheduling, flow settings, inputs and outputs, and version history in the flow builder. The bar under the canvas now says when the flow runs, beside its on/off switch; click it to choose: immediately as data arrives (for a flow that starts from a webhook or another instant trigger; up to 100 runs a minute by default, or no limit), at regular intervals, once, on demand, or at one or more times of the day every day, on days of the week or of the month, or on dates you choose each year. Under the advanced settings you can set when the schedule starts and ends, and its time zone (your organization's by default). Flow settings choose whether the flow processes data in order, keeps its data confidential (a confidential flow keeps no incomplete runs), keeps a failed run as an incomplete run to retry later, and reads the variables' current values when one is retried, and how many failed runs in a row turn the flow off. Three settings, *Discard data if storage is full*, *Commit after each module* and *Commit trigger last*, are kept with the flow but have no effect yet, and the dialog says so. Inputs and outputs define the values a flow starts with and the values it hands back: a name, a description, one of 15 types, a default value, required and multi-line, with options, nested fields and list items. Flow settings and inputs and outputs are saved with your draft and reach a flow that is on once you save it; Undo does not take them back. Version history lists the saved versions, with who saved each one and when, opens any of them read-only, and restores one into your draft (Save then publishes it); versions are kept for 60 days, and the published one as long as the flow. When errors turn a flow off, the flow's page now says when, how many runs in a row failed, and the last error. In English and in Hebrew.
  • Flows (by invitation only): Priority and SignFlow settings in the canvas builder. Forms, subforms and columns of a connected system such as Priority are listed by their titles, and a long list has a filter. Choosing a form saves its columns as the connected system describes them, says how many were read and which columns identify a record, and Refresh the list reads the connected system's forms and columns again. Changing the form clears what depended on it, including mappings in later modules and filters on links that read its columns, and a message says what was cleared, by name. A form the connection no longer offers is named in a warning. Watch and Search modules take conditions: a column chosen by its title, a comparison the connection supports and a value, which a search can map from an earlier module. The document module offers your active templates and shows a card for each signer role of the chosen template ("Signer 1", "Signer 2"), where you type or map the signer's name, email, phone and signing order; a card left empty is not sent. Add a signer adds a signer with no role, for example when the template's fields are not assigned to signer roles. The document module's prefilled fields are the template's fields except signatures and initials, with required fields marked. An empty one shows a proposal when an earlier module's output has a matching title or name, with how sure the proposal is. Nothing is filled in until you choose Use the proposals or Use on one field, and a proposal never replaces a value a field already holds.
  • Flows (by invitation only): webhook addresses, where a trigger starts, and connections from a module.
    • Webhook address. A flow that starts with a webhook or an instant (push) trigger shows its webhook address at the top of that module's settings, with a Copy button. The address is always the full https address, even when you work on your own domain. For an instant trigger it lists, by name, the fields each request must carry, and the list follows the module's settings as they are saved. If the flow has no address yet, an owner or admin can create one there; if the flow's first module changed kind, they can replace the old address after a confirmation, since the old one stops working at once. Only organization owners and admins see or create the address; other members are told to ask one of them.
    • Choose where a flow starts. When a flow starts with a trigger that checks for new records, right-click that module and choose "Choose where to start". The dialog offers the starting points that trigger has with its saved settings, such as from now on, since a date and time you pick, all records, a record number, or a record you pick from a list. It shows what is chosen now and whether the trigger's next check still starts from it. With some triggers, a date earlier than where the trigger stands can start records the flow already processed again. The choice is made for the saved flow. If the flow has never been saved, or your latest changes are not saved, the dialog asks you to save first and lets you save right there.
    • Add a connection from a module. Owners and admins can add a connection from a module's Connection field. For Priority, the Priority connection form opens right there; the connection is checked with Priority before it is saved, and the module gets it at once. Other apps' connections, such as the HTTP app's keychains, can't be added from the flow builder yet. Other members are asked to have an owner or admin add the connection. Keys and passwords you type are never shown again.
  • Flows (by invitation only): routers, error handlers, aggregators and document paths in the flow builder.
    • Order routes. Right-click a router, or open the menu of one of its routes, and choose Order routes to see its routes in the order they run, with the fallback route always last. You can move a route earlier or later, add a route to a module that is not connected yet, or delete a route together with the modules on it, after a confirmation that names them. Nothing changes until you select Apply, and one Undo reverses it. Add a route with a new module first applies the changes you made in the dialog, then adds the new route as a step of its own (its own Undo). If the flow changes while the dialog is open, the dialog does not apply your changes over it: it tells you, and you can start over. If you can't edit the flow, the dialog only shows the order.
    • Add an error handler. Right-click a module that can fail and choose Skip, Retry, Resume, Commit or Rollback. Each comes with a short description of what it does and how the run then ends; Commit and Rollback are marked Advanced. Retry starts out retrying automatically 3 times, 15 minutes apart, and turns on "Store incomplete runs" for the flow, unless the flow keeps its data confidential. Retry and Resume open their settings once added. You can put other modules on the error route too; the error handler always stays last. One Undo removes the handler, and the flow's settings stay as they are. Every link on an error route is drawn in the error-route style.
    • Aggregators. You choose an aggregator's Source module from a list of the modules before it on its path that pass bundles on; if none of them can be its source, the setting says so. Stop when nothing was collected is in every aggregator's advanced settings, and Group by in those of the Array aggregator and Aggregate to JSON. Group by can be mapped: the aggregator gives one bundle for each different value it takes, and a typed value puts every item in one group. Once the source is chosen, the canvas shades the path from it to the aggregator.
    • Signed or declined path. Adding a module after a module that sends a document for signing, or drawing a line from it, first asks which path it goes on: Signed (the document was completed) or Declined (it was declined, voided or expired). A path that already leads to a module can't be chosen again, and the question says where it leads. A module that sends a document, added onto a line that is already there, continues that line along its Signed path.
    • Auto-align keeps each module's main line level and puts its error route on the rows below it, with a router's routes and an If-else's branches in the order they run.
  • Flows (by invitation only): If-else branches and the Merge's outputs in the flow builder.
    • If-else branches. Adding a module after an If-else, or drawing a line from it to a module, first asks which branch the line starts: the next condition, numbered in the order the conditions are tried, or Else. A line drawn straight into a Merge makes a branch with no modules of its own. Once Else leads somewhere, a new line from the If-else is the next condition, with no question. An If-else's branches can't be unlinked, and its menus say so.
    • Merge outputs. A Merge's settings name the If-else it joins and list its outputs. Each output takes one value for each branch that leads into the Merge, and the mapping panel for that value lists only the modules on that branch and the modules before the If-else; a branch with no modules of its own maps from the modules before the If-else. A run takes the values of the branch its bundle came down. Add an output by its name: it is kept once one of its branches has a value. Removing an output removes its value on every branch. The settings also say when a branch doesn't lead into the Merge yet or when the Merge joins no If-else, and list any value left for a branch the Merge no longer joins, with Remove. Every change is saved automatically and can be undone. In English and in Hebrew.
  • Flows (by invitation only): pick a data store or a data structure in a module's settings, or add one there. A module setting that uses one of your organization's data stores or data structures lists them by name. Owners and admins get an Add button beside the list: it opens the same form as the Data stores or Data structures page, and the data store or data structure you create is chosen in the setting at once. Other members see the list without Add, and when the list is empty they are asked to have an owner or admin add one. If the data store or data structure a setting uses no longer exists, the setting says so. In English and in Hebrew.
  • Flows (by invitation only): copy and paste, keyboard shortcuts, and the flow builder from the keyboard and with a screen reader.
    • Copy, paste and clone. Select modules and press Ctrl+C (Cmd+C on a Mac), or choose Copy on a module's menu, to copy them with their settings, notes and the links between them. Press Ctrl+V (Cmd+V) in this flow or in another one to paste them near the middle of the canvas, or choose Paste on a menu to paste them where you opened it. Clone puts a copy beside the modules. Pasted modules get new numbers, keep their settings exactly as copied, are not connected to the rest of the flow yet, and are selected; a mapping that reads a module the flow doesn't have is cleared, and a message says so. If what you paste can't be used as modules of a flow, a message says why and nothing changes. A paste or a clone is one step for Undo. You can copy from a flow you can only view.
    • Keyboard shortcuts. Press ? outside a field, or use the Keyboard shortcuts button under the canvas, to see every shortcut, with Mac keys on a Mac. The arrow keys move the selected modules (further with Shift), and each press, or a held key, is one step for Undo. Ctrl+Shift+Enter (Cmd+Shift+Enter) runs the flow once again with the data of its latest run, after the same confirmation of what it writes or sends as Run once; it needs the permission to turn flows on, and says so when there is no earlier run's data to use.
    • From the keyboard. Tab reaches the canvas at the module or link you were last on (at first the flow's start), then that item's own buttons; no other module or link is in the Tab order. On a module that isn't selected, or on a link, the arrow keys go along the flow: to the next or previous module and the link between them (in Hebrew the flow runs to the left, and so does the arrow that goes forward), up and down between a router's routes or an If-else's branches, and Home and End to the flow's start and the end of the path; with Ctrl (Cmd) they do so from a selected module too. Enter opens a module's settings or a link's menu, and the menu key or Shift+F10 opens the menu of the module or link you are on. A module's menu now has Add a module after it and Link to…, which lists only the modules a link from it can reach and then puts you on the new link. Menus, dialogs and panels give the focus back to the module or link you opened them from (the flow's start once that module is deleted), and the module picker keeps the focus until you close it, with the arrow keys moving through its list.
    • With a screen reader. Modules are read with their number, name, app and action, and links with their route, condition or path. The page says when you save (with the version number) or a save fails, when a run you started starts, waits for signatures and ends (with its number of operations), and when the flow is turned on or off. It never reads out the data in your flow.
  • Flows (by invitation only): run one module by itself, and Run once waits for a webhook's data.
    • Run this module only. Right-click a module and choose Run this module only to run just that module with your latest changes: for real if you may run the flow for real, otherwise as a safe test. If the module maps values from earlier modules and you can edit the flow, a dialog asks you to type in those values before it runs; a field you leave empty is not given. A module that writes to another system or sends a document is confirmed first, as with Run once, and a safe test asks how its document ends. The result shows on the module as after Run once, and you can open it. Triggers, routers, If-else, Merge, aggregators and error handlers can't run by themselves, and neither can a module that isn't connected to the flow's start; the menu says why. It waits while a run is going on, or while Run once starts or waits for data; the menu says so, so only one run goes at a time. Run once, in turn, is off while a module's run starts.
    • Run once waits for data. When Run once finds no request waiting for a flow that starts with a webhook, it now waits for one: it shows "Waiting for data…" with Stop waiting, and runs the flow once as soon as a request arrives. It stops and says so after 5 minutes with nothing arriving, or when you change the flow while it waits (moving modules doesn't count). Owners and admins can open the webhook's settings from there to see its address. Waiting needs the right to edit the flow; without it, Run once says that no request is waiting, as before. In English and in Hebrew.
  • Flows (by invitation only): an If-else comes with its Merge.
    • The Merge is added for you. Add an If-else and the flow builder also adds the Merge that joins its branches: its first condition and Else lead straight into the Merge, and one Undo removes both. This differs from Make, where you add the Merge yourself. Pasting or cloning an If-else copies it as it was, with no Merge added.
    • "Do nothing" on each empty branch. A branch with no module yet shows a "Do nothing" marker. Click it to add a module on that branch; the module goes where the marker was.
    • Add a condition. When the If-else has its Merge, its + adds another condition branch straight into the Merge (its label says "Add a condition", or "Add a branch" while there is no Else yet). The + of the last module on a branch adds the new module before the Merge, never through a router.
    • Merge routes. At the end of a branch of an If-else that has no Merge, the module picker offers "Merge routes". It adds one Merge and links the end of every branch into it. If the branches can't be joined, it says why and changes nothing.
    • Deleting an If-else deletes its Merge too when no branch has a module yet, and the modules before and after them are linked again. The confirmation names both.
  • Flows (by invitation only): every app has its own colour and icon in the flow builder. The module picker and the canvas no longer show the same grey cube for every app: each app's circle is in its brand colour. OpenAI, ActiveCampaign and Notion show their own logos, exactly as each company provides them. The other apps show their initials, because their brand rules don't allow their logo to be redrawn on a coloured circle or they publish no logo for this use. The Priority ERP apps show the Priority icon.
  • Flows (by invitation only): warnings for empty required fields, and more help in a module's settings.
    • Required fields and connections. A module with a required field left empty, or with no connection chosen for an app that needs one, now shows a warning on the canvas and in the flow's list of warnings. Warnings never stop you from saving, turning the flow on or running it.
    • A module's own problems in its settings. A module's settings list its problems and warnings at the top, each field named by its label. If you press OK while a required field is still empty, the settings stay open and the field is marked; press OK again to close them.
    • A field's type on hover. Hover over a field's name in a module's settings to see what type of value it takes. Screen readers announce it too.
    • Choose where to start after saving a polling trigger. After you save a flow whose polling trigger is new or has changed settings, Choose where to start opens so you can pick where the trigger begins reading. With Save and turn on, it opens first, and the flow turns on once you close it.
    • The fallback route in the filter. A router route's filter now has a Fallback route switch, so you can set the fallback route without opening the route's menu.
    • A prompt before losing changes. If your latest changes could not be saved to the draft, the browser asks before you close or reload the tab, and All flows asks before you leave.
  • Admin: switch an organization's flows on and off from its page. On an organization's page in the admin console, the Features tab has a Flows card for the platform owner: Flow engine turns the flow builder on or off for that organization, and Apps in alpha shows it every app still in alpha, to test by hand. Each switch applies at once and is recorded in the organization's audit log. The card says when Connect is off, as the Flows page needs both. Other admins don't see the card. In English and in Hebrew.
  • Flows (by invitation only): map more in the mapping panel.
    • Fields from the last run. When a module's output has no data structure (for example a webhook or parsed JSON), the mapping panel now lists the fields from the flow's last run, under "Fields from the last run", and you map them like any other field. If the flow hasn't run yet, the panel tells you to use Run once to see them.
    • The error on an error route. On an error route, the mapping panel lists the module that failed as its error (Type, Message and Details), so the error handler and the modules on the route can map what went wrong. It no longer offers that module's normal outputs there, which are always empty when the route runs.
  • Flows (by invitation only): move a flow to a folder from its top bar, a check before you turn a flow on, a test on a record you choose, and more in the canvas builder.
    • Move a flow to a folder from its top bar. The top bar shows the flow's folder next to its name. Click it to move the flow to another folder, or leave the folder's name blank to take it out of its folder; the folders your flows already use are suggested. If you can't edit the flow, or it is in the trash, the folder is shown but can't be changed.
    • Before you turn a flow on. While a flow is off and you can turn it on, a short line beside the on/off switch under the canvas says what to do first: fix the problems marked on the canvas, save (a flow that is on runs its saved version), or test it with Run once; once all of that is done, it says the flow is saved and tested. It doesn't check the modules' connections; turning the flow on does. If the flow hasn't been run in this browser tab since your last change, the switch first asks whether to turn it on anyway, and Cancel leaves it off. Moving modules around the canvas doesn't count as a change.
    • Delete and OK in a module's settings. Delete removes the module after asking first (it names any modules that use its data), and one Undo brings it back; OK closes the settings. A note there says your changes are saved to the draft automatically. Delete shows only when you can edit the flow, never for a flow in the trash.
    • Resume's output. A Resume's settings list the outputs of the module that failed, by their titles, and you set the values the run goes on with in their place, typed, or mapped from earlier modules or from the error of the module that failed (its type, message and details). A field you leave empty is left out. When that module can output fields that only appear when it runs, you can add one by its name.
    • A connection that needs attention shows on the canvas. When a module's connection needs attention, is disconnected or not available, or no longer exists, the module gets a problem mark, and the problems list says what to do, so you don't have to open the module's settings to find out. A module that isn't connected to the flow's start gets no such mark.
    • A flow appears along its paths. When you open a flow, its modules and the lines between them fade in one after another, from where the flow starts. It plays once, as the flow opens, and not again while you work. If your device is set to reduce motion, the flow appears at once.
    • Test a flow on a record you choose. When a flow starts with a trigger that checks for new records, you have the right to edit the flow, and it isn't in the trash, Test with a record… under Run once runs a safe test from one record: pick one of the records the trigger lists now, or type the ID of one of them. Nothing is written, no document is sent, and the trigger keeps its place. If the flow sends documents, you choose how each one ends, as in any safe test. Your last pick is remembered until you reload the page, and forgotten once the trigger reads a different kind of record.
    • Turning on a webhook flow shows its address. When you turn on a flow that starts with a webhook or an instant (push) trigger, that module is selected and its settings open at the webhook address, with a ring round it for a few seconds (still, if your device is set to reduce motion). The same settings open for every member who turns the flow on; those who aren't owners or admins are told, as before, to ask one of them for the address.
    • A live dot beside the webhook address. While the flow is on, a small dot pulses beside the address in the module's settings (still, if your device is set to reduce motion).
  • Flows (by invitation only): edit, copy and paste mapped values.
    • Edit a mapped value as text. Double-click a mapped field, or press F2 in it, to see and change its value as text such as Dear {{1.name}} or {{formatDate(1.when; "YYYY")}}. Press Escape or F2, or click outside the field, to turn it back into mapped values. If the text can't be read, the field says where and keeps your previous value until you fix it.
    • Copy, cut and paste mapped values between fields. Select part of a mapped field and press Ctrl+C or Ctrl+X (Cmd on a Mac), then paste it into another field: functions, keywords and module outputs arrive as mapped values, not plain text. Pasted text written in the same {{ }} form becomes mapped values too, and any other text is pasted as plain text, as before.
  • Flows (by invitation only): webhook settings, and find and download in run results.
    • Webhook settings. Owners and admins now see a webhook's settings under its address in the module's settings. Get a new address is there at any time, not only after the flow's first module changed kind: after a confirmation, the old address stops working at once, and the settings stay as they are. A custom webhook also takes an API key you can create, replace or remove: a new key is shown only once, with the name of the header to send it in, and can be copied, and a request without the right key is refused. Its allowed IP addresses, one address or CIDR range a line, refuse requests from any other address; leave the list empty to take requests from any address. What each request brings adds the request's headers (with the API key's value hidden) or its HTTP method to its data, or keeps a JSON body as text. The data structure a custom webhook checks each request against can now also be chosen here, by name, or cleared. For a flow in the trash, nothing here can be changed.
    • Find and download in run results. In a module's run results, a find box narrows the input and output to what matches and opens the levels that hold each match. Ctrl+F (Cmd+F on a Mac) while you are in the results jumps to it; anywhere else it still opens your browser's own find. Each section also has Download JSON, which saves the whole section, as Copy JSON copies it, in a JSON file named by the flow's, run's and module's ids and the operation's number, never by what it holds. Find searches only what the results show: a value they leave out is not found, though Copy JSON and Download JSON still give it. Find and Download JSON are offered only where the run's data is shown, which needs the right to edit the flow, and never for a run whose data was not kept (a confidential flow) or was deleted after 30 days.
  • Flows (by invitation only): run with existing data from a menu, and choose which run's data.
    • A menu next to Run once. A ▾ next to Run once offers Run with existing data…, so you no longer need the Ctrl/Cmd+Shift+Enter shortcut to find it. It appears for people who may turn flows on and run them, and not on a read-only flow or a flow in the trash.
    • Choose the run. Run with existing data… lists the flow's recent runs, newest first, and picks the latest run that has data. Runs that can't be run again are greyed out with the reason: check runs that found nothing new, runs of one module alone, confidential runs, and runs whose data was deleted after 30 days. A flow that writes to other systems or sends documents still asks you to confirm first. The keyboard shortcut still reuses the latest run.
  • API: reuse a chosen run's data. POST /api/v1/flows/{id}/runs accepts existing_run_id together with existing_data: true. A run that can't be reused is refused with 409 not_reusable and a reason; a run from another flow or organization returns 404.

Improved

  • Flows (by invitation only): while a flow is on, the dot on its Active badge in the top bar pulses gently (not if your device is set to reduce motion), and the on/off switch under the canvas is green.

Fixed

  • Template builder: with several fields selected, the Properties panel now changes all of them. Switching Required to Optional, Read-only, Fallback, On document or Every page, and changing the typography, colours, size, rotation, opacity, validation, options, signer or Store in database used to change only one of the selected fields. The panel now says how many fields it is editing, and hides what belongs to a single field: the label, placeholder, default value, API name and position. Validation and options change only the selected fields of the same type, and display-only elements (headers, dividers, help text, links and HTML blocks) are never made required or read-only. Delete and Duplicate in the panel act on every selected field, and one Undo reverts the whole change.
  • Signing: a drawn signature no longer blinks and jumps while you draw it. Each time the signer lifted the pen, the pad went blank for a moment and the signature came back moved to the middle and down to the line, so a signature drawn in several strokes flickered and the next stroke landed in the wrong place. The signature now stays exactly where it is drawn. On the second and later signature fields, Use previous signature now sits below the pad, so it no longer pulls the pad up under the pen when it disappears.
  • Signing: empty required signature boxes no longer blink. On the document page, each empty required signature, initials, date or upload box pulsed for as long as it stayed empty. It now has a steady amber outline.
  • Submissions: a submission's page now shows its field values. The values a flow, the API or Make.com filled in when creating a submission were not shown anywhere on its page. They appeared only in the signed PDF, and fields that are not printed on the document never appeared at all. A new Fields Data card lists every value the submission holds, from the moment it is created: each field's name and value in document order, signatures as images, uploads by file name, and yes/no answers. Values that came with the submission are marked Prefilled, and fields that are not printed on the document are marked as such. API: GET /api/v1/submissions/{id} also returns fields, the submission's fields in document order, which names each key of fields_data.
  • Flows (by invitation only): fixes in the canvas builder.
    • Schedule: a schedule that can no longer be read now says "Not valid: set it again" beside the flow's on/off switch and in Schedule settings, as the flows list does, and nothing is saved until you choose how the flow runs.
    • Inputs and outputs: turning Multi-line off for a text input or output no longer removes the line breaks from its default value, and removing a default's last line break no longer takes the cursor out of the box.
    • Priority settings: columns saved by an earlier version of the builder now offer Read the columns instead of showing nothing. After you change the form, the message names filters on links and If-else conditions apart from mappings, and says how many of each were cleared. A condition row added while the connection's comparisons are still loading no longer assumes "is", and column titles in condition rows and in the "no longer offered" warning read in their own direction.
    • Webhook address: a webhook trigger's settings now say when the fields each request must carry could not be read, with Try again, instead of "Loading" forever. The address shows only for the flow's first module, and someone who is no longer a member of the organization is told so instead of being asked to find an owner or admin.
    • Choose where to start: coming back to the window no longer reads the list of records again. When a read fails, the dialog says so, with Try again, instead of showing the older choice or saying the flow was saved elsewhere, and it says when the flow was saved again in another window.
    • Filters: a second value left on an Exists or Does not exist condition now has its own Remove the second value button, and on a flow with more than 200 problems the editor still shows a filter's own problems and says how many more it cannot list.
    • Webhook view: a flow that starts with an instant (push) trigger now says that only a custom webhook keeps a request log, instead of showing an empty log. Deleting queued requests, setting the data structure or opening a request now says "Only an owner or admin of the organization can do this" when that is why it was refused, and someone who is no longer a member is told that instead. The queue's explanation and the "no longer in the queue" message now say exactly when a request leaves the queue or goes back to it.
    • Run history: a past run of a saved version, opened from the run history, shows as loading while that version is read, and its results go grey only if the flow has changed since that run or that version can no longer be read.
  • Flows (by invitation only): empty If-else branches no longer overlap. Two branches that went straight into the same Merge were drawn as one line, with their controls on top of each other, so only one could be reached. Each now has its own line and its own control. Two links between the same two modules, such as two router routes into one Merge, are also drawn apart.
  • Flows (by invitation only): fixes in the canvas builder.
    • Webhook address: while the flow has more than one first module, or its modules are not linked yet, a webhook or instant (push) trigger that no line leads into now shows owners and admins the flow's webhook address, when it has one for that kind of trigger, instead of saying that only the module the flow starts with gets one.
    • Leaving the page: when you reload or leave the page before your last change has gone to the draft, the flow builder now asks your browser to send it even after the page is gone, for all but the largest flows, unless a save to the draft is already on its way.
    • Settings that can't be read: a module's settings that can't be read because flows are not enabled for your organization, or because you lack the access needed, no longer offer a Try again that would only fail again, and when flows are not enabled they now say so. When an instant (push) trigger's list of the fields each request must carry can't be read, the webhook section no longer has a Try again of its own; when asking again can help, the Try again in the module's settings just below reads it again.
    • Signer email: in the document module, an email address you type for a signer is now checked as you type, and text that isn't an email address is not saved. An email mapped from an earlier module is kept as it is.
    • With a screen reader: the page now also says when your latest changes could not be saved, or when the flow was changed in another window or tab, so your changes were not saved.
    • Run this module only: once SignFlow has turned down every way you may run a module by itself, because you don't have the right, the menu now says you need the right to run this flow, instead of offering Run this module only and doing nothing when you choose it.
    • Link to…: after Link to… asks which If-else branch, or which signed or declined path, the link takes, the focus now lands on the new link.
    • Run once: when you cancel one of Run once's own dialogs, the focus goes back to the Run once button. When a change to the flow ends Run once's wait for data, undoing the change no longer starts the wait again: press Run once for another.

Security

  • Flows: reusing a chosen run's data needs the same permission to turn flows on and run them as before, and only runs of the same flow in your organization can be chosen. The run's audit log entry records which run's data was reused.

Changed (API): the status of a held request is draft, not held as documented on 2026-10-12, which never worked in production. API responses and the submission.created webhook show draft for a request created with hold: true, and draft is used for held requests only. If your integration looks for held, look for draft.

New

  • Flows (by invitation only): the canvas now marks a module's warnings apart from its problems: things a module found in its own settings that stop nothing, such as a password or token typed into an HTTP module's settings instead of its connection. They have their own mark on the module and their own group in the problems list, and they never stop you from saving the flow, turning it on or using Run once.
  • Flows (by invitation only): add notes to a module or a link with Add a note in its menu. Notes are plain text for the people who build the flow and change nothing in how it runs. A module or link with notes shows a note icon with their number; click it to read or edit them (people who can only view the flow can read them too). Each module or link holds up to 200 notes of up to 10,000 characters each. Notes are saved with the flow's draft, and Undo takes them back.
  • Flows (by invitation only): the flow builder now has its data pages. The Flows, Data stores, Data structures and Custom variables pages share a bar of links under their title, so each is one click from the others; Custom variables is shown to owners and admins only.
    • Data structures describe the fields of the data your flows read and write. Data stores and webhooks check data against them; Parse JSON, Create JSON and Aggregate to JSON use one to describe the fields of the JSON, without checking the data. A field has a name, a type, a label, help text, whether it is required, a default value and multi-line text, and a collection or a list's items can hold fields of their own. Generate from a sample makes the fields from a JSON sample you paste. When a data store or a webhook checks data, a Strict structure refuses fields it does not list. Owners and admins create, change and delete structures; other members see them and can try a sample. A structure that a flow or a data store still uses is not deleted, and the page names them. If you rename or remove a field of a structure that data stores with records use, the page warns you before saving and names the fields and the stores; those records keep their values under the old names.
    • Data stores keep records that your flows add, read, update and search from one run to the next. Owners and admins create, change and delete a store, each with a size in MB and, if you choose, a data structure; a store that a flow still uses is not deleted, and the page names those flows. Open a store to browse its records a page at a time (Load more records), add a record (with your own key, or none for one made for you), edit one (its data is replaced whole), delete one, or delete them all after you confirm. A store with a data structure checks each record against it and keeps only the structure's fields. When records hold fields the structure no longer lists (after a field was renamed, for example), the page warns you and names those fields. In a store without a data structure, a record that a flow saved with dates or binary data can be viewed and deleted on the page but not edited there, so its values are never turned into text. Browsing and changing records needs the Edit flows permission.
    • Custom variables (owners and admins only, viewing included) are named values your organization's flows read, such as a rate, a date or an on/off switch: text, a number, a boolean or a date. A flow reads them when its run starts, so a change takes effect from its next run. A variable keeps its name for good; its type and value can change, its last 20 values are kept as its history, and it can be deleted after you confirm. A value is never shown in a notification. Values are stored as entered, so don't keep passwords, tokens or keys there.
  • Flows (by invitation only): mapping values between modules. In a module's settings, a mapped field now holds text and pills together: a value from an earlier module, a variable, a function, an operator or a keyword shows as a pill you can type around, select and delete from the keyboard. Choices, switches, lists and groups get a Map button, and going back to a fixed value asks first when it would remove a mapping. Clicking into a mapped field opens a mapping panel below it, with Data, Functions, Operators, Variables and Keywords tabs and one search that works in English and Hebrew. The Data tab lists only the modules that come before the field on its path, with their outputs by name. Click an item to insert it where the cursor is, or drag it into the field; the pill shows the output's name as the Data tab does, with its raw key when you hover over it. Alt+Down arrow moves from the field into the panel, and Esc goes back. Beside each output, the panel shows a sample: the value it held in the run you last started from this page, or else in the flow's latest run. A confidential flow shows no samples, nor does a run whose data was deleted (run data is kept for 30 days); the panel says why. Many mapped fields show the type of value they take while they are mapped; a value that can't be converted to that type gets a note, and the panel marks such items, but nothing is blocked. The erase keyword is listed with the other keywords and goes where the cursor is, as any keyword does; the field says when it won't clear the field, for example in a required field or inside other text. Some connected-system columns, such as Priority number or date columns, can still refuse erase when the module runs.

Fixed

  • Creating a request with hold: true failed with an error and created nothing. It now works; a held request shows status draft ("Draft (held for review)").

Breaking (API): PUT /api/templates/{id}/fields now refuses a field box outside the page with 400 invalid_field_geometry. Field positions are percentages of the page (0–100). If you send positions in points or pixels, convert them to percentages of the page width and height. A template that already holds an out-of-page box must have that box moved or removed before its fields can be saved again.

New

  • Flows (by invitation only): a new flow builder, for organizations it has been turned on for. A Flows page in the sidebar lists your organization's flows, finds them by name and creates new ones. Each flow opens on a canvas: add modules from a searchable list of apps, link them by dragging, add routers, move, rename and delete modules (the links around a deleted module are joined up again), zoom and pan, and see each problem next to the module it concerns. Clicking a module opens its settings, with choices loaded live from your connection or your organization. Your changes save themselves as a draft; Save publishes them as a new version, and the switch turns the flow on or off. Run once runs the flow now, for real or as a safe test that writes nothing and sends no document, and shows how many operations each module ran, with each operation's input, output and error. Undo and Redo step back and forward through your changes to the flow (a move, a deletion, a run of typed settings: one step each). On the keyboard: Ctrl+Z, Ctrl+Y, Delete, Escape, Ctrl+S for Save and Ctrl+Enter for Run once (Cmd on a Mac). In Hebrew, the flow runs right to left. The SignFlow Connect rules builder is unchanged.
  • Hold a signing request for review before anyone is invited. Create a request with "hold": true and nobody is e-mailed: it shows as "Held for review", its signing links do not work, and you get a preview link (the token stays in the link's fragment, so it never reaches a server log) that shows the document with its signature boxes and a PDF download. When it looks right, POST /api/v1/submissions/{id}/release sends the invitations — only for the exact document you reviewed — and gives the signer a full expiry window from that moment. Hold needs an organisation, and is not available with a signing password, signer payment, or a template that appends pages.

Fixed

  • SignFlow Connect: a connection deleted while one of its flows was still finishing could reappear as active, or as needing to be reconnected, without its credentials. A deleted connection now stays deleted.
  • Templates: a field box placed outside the page (positions are percentages of the page) is now refused when fields are saved, instead of being stored where no signer could ever see or sign it.
  • Audit trail: a held request's audit trail and certificate say "created and held for review", then "released for signing" — never "sent" before anyone was invited — and internal preview views never appear on them.

Breaking (API): an API token without admin can no longer use the flows API (/api/v1/flows/…) or the Connect API (/api/v1/integrations/…): it gets 403 *Insufficient permissions*, with the scope it needs in required_scopes. Migration: on the API Keys page, add a flows scope (flows:read, flows:write, flows:run) or a Connect scope (integrations:read, integrations:write) to the token, as its use needs. Signing in to SignFlow is not affected.

Security

  • API tokens and flows: an API token now needs a flows scope to use the flows API (/api/v1/flows/…): flows:read to read flows, runs and logs, flows:write to create, change, activate or delete a flow and to see or rotate its webhook address, and flows:run to run, replay or stop it. A token with admin keeps full access, and signing in to SignFlow is not affected. An existing token without admin loses access to the flows API until you add a flows scope to it on the API Keys page.
  • API tokens and SignFlow Connect: an API token now needs a Connect scope to use the Connect API (/api/v1/integrations/…): integrations:read to read connections, rules and their history, and integrations:write to create, change, check or delete them and to see a rule's webhook address. A token with admin keeps full access, and signing in to SignFlow is not affected. An existing token without admin loses access to the Connect API until you add a Connect scope to it on the API Keys page.
  • Changing an API token's name or scopes is now recorded in your organization's audit log, as creating, revoking and deleting a token already were.
  • Changes to API tokens, MCP connector access, single sign-on settings and your organization's two-factor policy are now written to the audit log before SignFlow answers the request. Until now such an entry could occasionally be lost.
  • An audit log entry longer than its size limit (10,000 characters, or 4,096 for SSO and two-factor security events) is now kept as a readable excerpt, clearly marked as shortened, instead of being cut off mid-way, so no entry can be made unreadable.
  • Turning two-factor authentication on or off, and generating new recovery codes, is now recorded in the audit log of every organization you belong to. Until now these changes were not recorded when made in the app.
  • SignFlow Connect: when one of a connection's credentials contained or overlapped another, an error on the connection card, in the connection form or in a run's details could show part of a credential. Now the whole credential is hidden.
  • SignFlow Connect: when your server (for example your Priority address) answers with a redirect, SignFlow now checks every address it is sent to, not only the first, and follows at most 10 redirects. A redirect to a different address is not followed when the request carries your credentials or data. The connection shows *The server redirected to a different address … use that address instead*, so nothing you send to your server reaches another one.
  • A webhook, SSO or Connect address can no longer be a raw IPv6 address (raw IPv4 addresses were already refused), and a blocked name written with a final dot, such as localhost., is refused like the name itself.

Fixed

  • A signer who opens or signs a document at the moment it finishes no longer leaves a trace on it. They are not shown as having viewed it, no signer.viewed or signer.opened webhook goes out for it, and a signature that arrives as it finishes is not recorded half way, with the signer marked signed but their values missing.
  • A signer who signs or declines while their signing page is still opening keeps that status. They are no longer shown as having only viewed the document, and signer.viewed and signer.opened are no longer sent after their signature or decline.
  • Opening a shared signing link of a voided, expired or lapsed document no longer adds a signer to it, writes a "viewed" audit entry or sends signer.viewed and signer.opened. It answers that the document is no longer available, or that the link has expired (410), as before. A link opened at the moment its document is completed, declined, voided or expired gets the same answer, and the document gains nothing from it.
  • Opening a shared signing link twice at the same moment (for example on two devices at once) no longer adds two signers to the document. Both opens get the same signer, the document is recorded as viewed once, and signer.viewed and signer.opened are sent once. Until now the extra signer, who never signs, could keep the document from ever completing.
  • PATCH /api/v1/submissions/{id} on a finished document now saves a name, metadata, webhook or redirect change even when the request also sends "status": null, or "fields_data": null or "". Until now that answered 409, although nothing it asked would have changed the finished document.
  • Voiding a document no longer answers with an error when, after the document was voided, one of SignFlow's own log writes or reads fails: the void stands and the request succeeds. The audit entry naming who voided it is written even when the document's details cannot be read. If SignFlow cannot read the document's details at that moment, the submission.voided webhook is not sent; until now the request failed and the webhook was not sent either.
  • A finished document can no longer be changed by a request that arrives as it finishes. Until now, if a document was completed, declined, voided or expired while one of these requests was on its way, the request could still change it:
    • PATCH /api/v1/submissions/{id} could reopen the document or rewrite its recorded field values. It now answers 409 (for example *Submission is completed and can no longer be modified*) and changes nothing, as it already did for a document it found finished. A request that changes only the name, metadata, webhook or redirect address works as before.
    • A signer's Sign or Decline could still be recorded on it, with its audit rows, its signer.signed or signer.declined webhook and its notification. The signer now gets *This submission is no longer active*, the answer for a document that had already finished, and nothing is recorded or sent. Saving progress at that moment is refused too.
  • Setting a document's status to expired through the API now does what an expiry does everywhere else. It sends the submission.expired webhook, and the audit log records who expired it, as it does for a void. Until now it changed only the status.
  • PATCH /api/v1/submissions/{id} with an empty status ("") is refused with 400 *Invalid status value*. Until now it blanked the document's status.

Breaking (API): POST /api/v1/submissions/{id}/void on a declined submission now answers 422 *Cannot void declined submission* instead of voiding it. Migration: a declined submission is already closed — nobody can sign it — so there is nothing to void; treat the 422 as "already finished", as you would for a completed or expired one.

Improved

  • A declined document can no longer be voided. It already counted as finished everywhere else in SignFlow, but voiding it replaced the decline with "voided" and sent a void notification after the decline one. The dashboard no longer offers Void on a finished document — declined, completed, voided or expired — on the Submissions list or a submission's page, and bulk Void skips finished documents in your selection and counts only the ones it will void. The SignFlow MCP tool submission_void refuses a declined document too, with the API's own message.

Fixed

  • SignFlow Connect: changing a flow's object no longer keeps the previous object's subform data. Until now the old subforms stayed switched on but invisible (the switches list only the new object's subforms), and the field mapping failed with "Could not load fields". A flow already saved that way loads its fields again and shows *This flow still includes subform data from a different object* with a Remove button; mappings that read from a removed subform are cleared.
  • Voiding a document can no longer mark one that was just completed as voided. If the last signer finishes at the same moment you void, the document stays completed, you are told it cannot be voided, and no void notification or submission.voided webhook goes out.
  • An expired document no longer hides a decline. A document declined a moment before its signing link lapsed stays declined, and submission.expired no longer fires for it. When two submits reach a lapsed link at the same moment, submission.expired now fires once instead of twice.
  • API reference: POST /api/v1/submissions/{id}/void now documents the 422 it has always returned for a finished submission, with each error message. 409 is now documented only for its real meaning: the submission changed while it was being voided, and nothing was voided.

second release

Fixed

  • SignFlow Connect (Priority): subforms show their Priority titles (for example "פירוטי הזמנה" instead of ORDERITEMS_SUBFORM) everywhere a flow names one: the subform picker of an *add a row* or *attach a file* step, the step cards, the subform-data switches, mapped subform columns and the run log. A subform's title was never read, so every subform appeared under its internal code. Flows already open may need Refresh schema (or up to an hour) to show the titles.

Breaking (API): POST /connections and PUT /connections/{id}/credentials for Priority now refuse a serviceRoot that is not shaped https://<server>[/<prefix>]/odata/Priority/<file>.ini[,<n>]/<company>. Migration: send the parts instead — host, ini, company (and optional language, servicePath) — or a root in that shape.

New

  • SignFlow Connect (Priority): connect by server address, .ini file, company and language — or paste the full Priority API address and it is split for you. Find my companies checks the company you typed and then lists your companies by name.
  • SignFlow Connect: test a flow against a real record picked from a list. Search by the record's number (and, if you like, one more column you choose by its name); when Priority says which records are newest, they come first. Records with a multi-part key are picked, never typed.
  • SignFlow Connect (Priority): for flows that Priority starts (push), the flow builder now lists the fields your Priority business rule must send and walks you through the setup in Priority step by step.

Improved

  • SignFlow Connect (Priority): the form list shows only the forms your Priority administrator enabled for the API, under their Priority names. If Priority does not say which forms you may use, every form is listed with a note.
  • SignFlow Connect (Priority): a mistyped company is now refused when you connect (where Priority lets SignFlow check it). Until now it connected and then failed later.
  • SignFlow Connect: Update credentials shows the server, .ini file and company already filled in — to rotate a Priority access token, type only the new token (an App key, if your installation uses one, is kept).
  • SignFlow Connect: column pickers show Priority's column names with a lock on read-only columns (they can be read — for example into a document — but not written), a * where Priority marks a column required, and "Date only" / "Date and time" on date columns; the date picker lists the update and creation dates first.
  • SignFlow Connect: mapping suggestions now match Hebrew field names, and suggest read-only columns such as a customer name or a total.
  • API: GET /api/v1/integrations/connections/{id}/objects accepts include and returns meta.notice. POST /connections and PUT /connections/{id}/credentials for Priority take host, ini, company, language (and optional servicePath); the single serviceRoot field still works, but a value that is not a Priority OData address (https://<server>/odata/Priority/<file>.ini/<company>) is now refused. New: POST /providers/{providerId}/credential-options, GET /connections/{id}/credentials, GET /connections/{id}/objects/{objectId}/records.

Fixed

  • SignFlow Connect (Priority): forms show their Priority titles. The previous title lookup never worked, so forms appeared under their internal codes.
  • SignFlow Connect (Priority): a flow whose Priority form was later disabled for the API now says so, naming the form, instead of showing an empty form picker.
  • SignFlow Connect (Priority): switching on a flow that watches for changed records no longer blames a missing Priority BPM setting — if Priority refuses, you see Priority's own reason.

Security

  • SignFlow Connect: listing companies before connecting, and reading a connection's settings for the update form, are limited to organization owners and admins. The access token and App key are never sent back to the browser. Picking a test record is limited to the same people who can test a flow.

second release

New

  • SignFlow Connect: a flow can now explicitly clear a Priority field ("Clear the field in Priority" in the value picker of an *update fields* step). It is offered on text columns only: Priority refuses to empty a number or date column through its API, so for those the step fails with a clear reason (for a number, map 0 instead). Until now there was no way to erase a value on purpose.

Improved

  • SignFlow Connect (Priority): numbers and dates written back to Priority now arrive as numbers and dates. A value typed as 1,234.50 is written as 1234.5 (a comma is accepted only as a thousands separator in 3-digit groups; a decimal comma such as 1,5 is refused with a "needs a number" message rather than guessed). A date is written as the calendar day you typed (2026-10-04 or 4/10/2026), so it never lands a day early. A date with a time must state its timezone (Z or +03:00); a time without one is refused, because different servers would read it differently. Until now writes to number columns failed and dates could shift.
  • SignFlow Connect: a mapped value that resolves to nothing is left untouched in Priority — the field keeps its current value. A value made only of spaces or invisible direction marks (common when pasting from Word or WhatsApp) counts as nothing, and a pasted number such as "‏1,234" is written as 1234.
  • SignFlow Connect (Priority): a text value longer than its Priority column allows is cut to fit, and the run log tells you which column (by its Priority title) was cut and to how many characters.
  • SignFlow Connect (Priority): when Priority rejects a request, the message now shows Priority's own words (Hebrew included) together with a hint on what to fix — a missing mandatory field, a form not enabled for the API, a value that already exists, and more.
  • SignFlow Connect (Priority): large forms are read past 2,000 records. A check reads up to 10,000 records; if there is more, it keeps a bookmark and continues on the next check (about 5 minutes later), so a mass update is worked through over several checks and nothing is skipped. A record that changes again while a long scan is running may trigger twice rather than be missed.
  • API: PATCH /api/v1/integrations/rules/{id} on an active flow now answers a refused trigger with 400 { "error": "<first problem>", "blockers": ["…"] } — the same shape as activation. error still carries a readable message; the full list is in blockers.

Fixed

  • The date picker (signing-date fields in the signing flow, and the date-range filter on Submissions) keeps its styling and month arrows after the calendar library moved to version 10. Without this fix the calendar would have shown up unstyled, with no navigation icons.
  • SignFlow Connect (Priority): a step that hits a form you lack permission on fails with Priority's reason and a hint, and your other flows keep running. A rule that watches such a form (or one that is not enabled for the API) shows the problem on the connection card ("Rule "<name>": …") while the connection stays active.
  • SignFlow Connect (Priority): a momentary "Priority is busy" answer (licence pool exhausted) is retried later by the job queue instead of being treated as a bad access token. A new record is never created twice because of it; an update may be re-sent once, which leaves the same values.
  • SignFlow Connect (Priority): flows filtering on a number or date column now send Priority a filter it accepts; a condition value that does not fit its column is refused when the flow is switched on, naming the column by its Priority title.
  • SignFlow Connect: a flow's trigger read no longer downloads attached files when a form's attachments list was chosen for enrichment — the run log says which list was skipped.

Security

  • SignFlow Connect (Priority): access control — a permission problem on one Priority form no longer counts as a broken connection: Priority's refusal (HTTP 403) is scoped to that form, so only the step or rule that touched it fails. No check was loosened — Priority still enforces every permission itself, and a rejected access token, or a refusal on the connection check itself, still counts against the connection exactly as before.

Breaking change (API): POST /api/v1/integrations/rules/{id}/activate can now answer 409 with code: "baseline_confirm" and matching (records already match the trigger), or 400 with code: "baseline_over_cap" (more than 500 match). Both apply only to first-match ("once per matching record") flows; flows that watch for changes, and push (webhook) flows, are unaffected. Migration: for baseline_confirm, re-send the request with the JSON body {"includeExisting": false} (only react to new matches) or {"includeExisting": true} (also send to the records that match now). For baseline_over_cap, narrow the trigger's condition.

Fixed

  • SignFlow Connect (Priority): dates from Priority now print as the same calendar day you see in Priority. Until now a date could appear one day early on the signed document.
  • SignFlow Connect: flows that watch a date column no longer miss records. A record stamped exactly at the last check, or created later the same day on a date-only column, is now picked up.
  • SignFlow Connect: switching a flow on — or back on after a pause — no longer sends documents for every record that already matched. Flows that watch for changes start from that moment. A flow that sends once per matching record asks first if records match right now, and by default only reacts to new matches.
  • SignFlow Connect: a flow that writes back to the record that triggered it (a status, a note, the signed PDF) no longer sends the document again because of its own write. As an extra safeguard, one record can trigger at most 3 documents per flow in 24 hours.

Improved

  • SignFlow Connect: "Reconnect" is now Update credentials and changes the connection's credentials in place. Your flows and any pending write-backs keep working — no need to rebuild them after rotating a Priority access token. Credentials for a different Priority company or server are refused; connect that company as a new connection instead.
  • SignFlow Connect: a connection marked as having a problem is re-checked automatically and returns to normal on its own once the problem is fixed.

Security

  • Creating, updating and removing an integration connection is now recorded in your organization's audit log.

New

  • Anyone can now sign up for SignFlow on their own. The sign-in page has a Sign up tab, also at https://signflow.leonai.io/signup: sign up with Google or Microsoft, name your organization, then choose your plan. Stay on Free (no credit card needed) or check out a paid plan straight away, and change plans any time from Billing. If you picked a paid plan on the pricing page before signing up, its checkout opens for you as soon as your organization is created. Until now a new account could only wait for an invitation from an existing organization.
  • Organization names in Hebrew (or any language) work at signup. You no longer have to make up a "workspace address" in English letters; SignFlow generates it.

Improved

  • Every "Start free" button now opens the Sign up tab instead of the sign-in form.
  • If you sign in without belonging to an organization, the page now welcomes you and offers to create one. Checking for an invitation is still on the same page.
  • White-label (agency) domains get the same signup flow. After creating an organization there, you land on the agency's own plans and prices to choose from, instead of the billing overview.
  • On the pricing and legal pages, the top bar shows Go to app when you're already signed in, instead of "Sign in" and "Start free".

Fixed

  • Sign-in and sign-up: if you chose Google and then went back without finishing, the Google button kept spinning and both sign-in buttons stayed disabled until you reloaded the page. They now work again as soon as you're back.

Security

  • Creating an organization now includes a quick, privacy-friendly security check (Cloudflare Turnstile) that stops automated signups. Most people never see a challenge; if one appears, a single click is enough. This applies on signflow.leonai.io and on partner (white-label) domains. Organizations can no longer be created from an organization's own custom signing domain: those pages now link to signflow.leonai.io to sign up.

New

  • SignFlow now shows its live service status. A small status pill in the footer of the home page, the pricing page and the app (and under the sign-in form) reads "All systems operational", or says what is wrong, and opens status.leonai.io. While SignFlow has a service disruption or scheduled maintenance, a banner at the top of the page says so and links to live updates. Only SignFlow's own status counts: an incident on another LeonAI product does not show here. If the status can't be read, you see a plain "Status" link instead. White-label (agency) domains don't show the pill or the banner.

Fixed

  • Organizations that pay by bank transfer: follow-up on overdue invoices works again. Since mid-July a fault in how SignFlow recorded that day's follow-up made the whole step fail, so overdue bank-transfer invoices were neither chased nor acted on. Now our billing team is reminded about each overdue invoice once a day, and a subscription whose bank-transfer invoice is 7 or more days past due is suspended (it falls back to Free-plan features) until the invoice is marked paid. Organizations paying by card were not affected.
  • Every five minutes SignFlow copies a tamper-evidence fingerprint of every document's audit trail to separate storage. When the database or storage had a brief hiccup, that five-minute copy was skipped. It now retries on the spot, so a momentary outage no longer costs a copy. No audit record was lost: audit trails themselves were never affected, and each copy covers every document's full history, so the next copy five minutes later covered anything a skipped one would have.

Improved

  • The LeonAI partner program now runs in-house. Partners sign in at dash.leonai.io/partners and apply at dash.leonai.io/partners/apply. Partner links keep working, commissions are in shekels on the price before VAT, and nothing changes in what customers pay.
  • The privacy policy now names the partner-referral cookies. With your consent to analytics cookies, arriving through a LeonAI partner link stores a random click id in leonai_via for up to 90 days, so the partner who referred your organization is credited; it is deleted once your sign-up is recorded. It also lists LeonAI's own partner ledger.
  • Partner reporting now runs through our own in-house partner program, and partner commissions on purchases are checked every day against what was actually paid. If reporting a purchase ever fails, it is found and sent again, so the partner who referred you is not left uncredited.

Fixed

  • Creating an organization on someone's behalf from the platform console no longer reports a partner referral for the person doing the setup.
  • LeonAI's WhatsApp assistant can see your SignFlow account again. When you write to it, it now knows your plan, status and this month's usage. Before, looking up a SignFlow account always failed, so the assistant answered as if you had no account.

Removed

  • Dub is gone from SignFlow. Its tracking script and every server call to it have been removed, its dub_id cookie is no longer set (an existing one expires on its own), and the privacy policy no longer names it. Partner referrals and purchases are credited through LeonAI's in-house partner program only. Partner links, commissions and what you pay are unchanged.
  • The API no longer reads a dubClickId field when you create an organization (POST /api/organizations and POST /api/organizations/with-owner), and the field is gone from the API reference. A request that still sends it works as before; the field is ignored. Nothing to change on your side.

Security

  • SignFlow no longer contacts Dub at all: purchases and sign-ups are reported only to LeonAI's own partner ledger, the web app no longer loads Dub's tracking script or sets its dub_id cookie, and our servers make no further calls to Dub. Dub Technologies (USA) is no longer a SignFlow sub-processor: your sign-in email, purchase amounts and referral click ids are no longer sent to it.

Security

  • Updated postcss-selector-parser to 6.1.4 to close a low-severity denial-of-service advisory (GHSA-w9m9-85wc-3x92). This library only runs while the SignFlow web app's stylesheet is being built. It never sees your documents, signers or account data, and the published app looks and behaves exactly as before. You don't need to do anything.

Start with the latest

Start freeSee the plans