# Task: Assinar um documento

I want my application to do what Lacuna's "Assinar um documento" demo does: Receba um documento real do Dropsigner por e-mail e assine com um código enviado por SMS.

- Docs: https://docs.lacunasoftware.com/pt-br/articles/signer
- Live demo: https://try.lacunasoftware.com/pt/signer/sign-a-document
- This demo for AI agents: https://try.lacunasoftware.com/pt/signer/sign-a-document.md

## Samples

- Lacuna's samples for this product: https://github.com/LacunaSoftware/SignerSamples

## Call sequence

No call sequence has been recorded for this demo yet, so none is shown here: this page doesn't guess calls. The docs and samples below show the calls; the live demo makes them.

## Patterns to copy

- Upload the PDF first, then create the document with the upload's id as its file, and read the new document's id from the single item the create call returns. A `SignerApiException` with code `FileHasPassword` or `CpfAlreadyBeingUsed` is a problem with the user's input, not an outage.
- Read the document back and treat its first flow action's user as the truth rather than what you sent: Dropsigner looks signers up by e-mail and keeps a known user's stored name, CPF and phone.
- Follow progress by polling the document (`GetDocumentDetailsAsync`): Concluded, Canceled and Expired are final, Refused is not. The Demo polls every 5 s for the first 10 minutes, then every 30 s.
- Seeing that the signer opened the document takes `GET /api/documents/{id}/events`, which the typed client lacks: read it into your own type and count only a `DocumentViewed` whose agent e-mail is the signer's.
- Ask for a fresh download ticket (`GetDocumentDownloadTicketAsync`, `Signatures` or `PrinterFriendlyVersion`) on each click: the link needs no authentication, lasts an hour and carries a one-time token, so never log it.

## What to do

Implement this in my project with its existing stack, language, framework and conventions, following the call sequence and the patterns above, and adapting the samples rather than copying them whole. Ask me before adding any dependency or package. Keep API keys and private keys out of the browser and out of the repository.