AWS Bedrock Agents + Signbee: OpenAPI Action Groups for E-Signing (2026)

{
  "openapi": "3.0.3",
  "info": {
    "title": "Signbee E-Signature Action Group API",
    "version": "1.0.0",
    "description": "Dispatches legally binding CommonMark or PDF agreements for two-party electronic signature and checks SHA-256 verification status."
  },
  "paths": {
    "/api/v1/send": {
      "post": {
        "operationId": "sendDocument",
        "summary": "Compile a CommonMark agreement into an immutable PDF and email a signing ceremony link to Party B.",
        "description": "Binds Party A using the configured Signbee API key and emails Party B an interactive signing link.",
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "required": [
                  "title",
                  "markdown",
                  "sender_name",
                  "sender_email",
                  "recipient_name",
                  "recipient_email"
                ],
                "properties": {
                  "title": {
                    "type": "string",
                    "description": "Formal legal title of the contract (e.g. 'Master Services Agreement - Acme Corp')"
                  },
                  "markdown": {
                    "type": "string",
                    "description": "Complete contract text formatted in CommonMark markdown including tables and clauses"
                  },
                  "sender_name": {
                    "type": "string",
                    "description": "Full legal name of Party A (the sender)"
                  },
                  "sender_email": {
                    "type": "string",
                    "description": "Verified email address of Party A"
                  },
                  "recipient_name": {
                    "type": "string",
                    "description": "Full legal name of Party B (the recipient signer)"
                  },
                  "recipient_email": {
                    "type": "string",
                    "description": "Email address of Party B where the signing link will be delivered"
                  },
                  "expires_in_days": {
                    "type": "integer",
                    "description": "Number of days before the signing link expires (default 14)"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Contract compiled and dispatched for signature",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "id": { "type": "string" },
                    "status": { "type": "string" },
                    "signing_url": { "type": "string" },
                    "verify_url": { "type": "string" }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

import json
import os
import urllib.request
import boto3

secrets_client = boto3.client("secretsmanager")
_cached_api_key = None

def get_signbee_api_key() -> str:
    global _cached_api_key
    if _cached_api_key is None:
        secret_arn = os.environ["SIGNBEE_SECRET_ARN"]
        resp = secrets_client.get_secret_value(SecretId=secret_arn)
        secret_data = json.loads(resp["SecretString"])
        _cached_api_key = secret_data["SIGNBEE_API_KEY"]
    return _cached_api_key

def lambda_handler(event: dict, context) -> dict:
    action_group = event["actionGroup"]
    api_path = event["apiPath"]
    http_method = event["httpMethod"]

    # Convert Bedrock's [{'name': k, 'type': t, 'value': v}] list into a dict
    props = (
        event.get("requestBody", {})
        .get("content", {})
        .get("application/json", {})
        .get("properties", [])
    )
    payload = {}
    for item in props:
        val = item["value"]
        if item.get("type") == "integer":
            val = int(val)
        payload[item["name"]] = val

    # Attach enterprise EventBridge API Gateway webhook URL automatically
    payload["webhook_url"] = os.environ["SIGNBEE_EVENTBRIDGE_WEBHOOK_URL"]

    req = urllib.request.Request(
        url=f"https://signb.ee{api_path}",
        data=json.dumps(payload).encode("utf-8"),
        headers={
            "Content-Type": "application/json",
            "Authorization": f"Bearer {get_signbee_api_key()}",
            "User-Agent": "AWS-Bedrock-Agent/1.0",
        },
        method=http_method,
    )

    try:
        with urllib.request.urlopen(req, timeout=10) as response:
            status_code = response.getcode()
            resp_body = response.read().decode("utf-8")
    except urllib.error.HTTPError as err:
        status_code = err.code
        resp_body = err.read().decode("utf-8")

    return {
        "messageVersion": "1.0",
        "response": {
            "actionGroup": action_group,
            "apiPath": api_path,
            "httpMethod": http_method,
            "httpStatusCode": status_code,
            "responseBody": {
                "application/json": {
                    "body": resp_body
                }
            },
        },
    }

import {
  BedrockAgentRuntimeClient,
  InvokeAgentCommand,
} from "@aws-sdk/client-bedrock-agent-runtime";

const bedrock = new BedrockAgentRuntimeClient({ region: "us-east-1" });

export async function confirmAndSendSignbeeContract(
  sessionId: string,
  invocationId: string,
  actionGroup: string,
  approvedPayload: {
    title: string;
    markdown: string;
    sender_name: string;
    sender_email: string;
    recipient_name: string;
    recipient_email: string;
  }
) {
  // 1. Dispatch the human-approved contract via Signbee REST API
  const signbeeRes = await fetch("https://signb.ee/api/v1/send", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Authorization: `Bearer ${process.env.SIGNBEE_API_KEY}`,
    },
    body: JSON.stringify(approvedPayload),
  });

  if (!signbeeRes.ok) {
    throw new Error(`Signbee error (${signbeeRes.status}): ${await signbeeRes.text()}`);
  }
  const signbeeResult = await signbeeRes.json();

  // 2. Return the execution result back into the paused Bedrock Agent session
  const command = new InvokeAgentCommand({
    agentId: process.env.BEDROCK_AGENT_ID!,
    agentAliasId: process.env.BEDROCK_AGENT_ALIAS_ID!,
    sessionId,
    sessionState: {
      invocationId,
      returnControlInvocationResults: [
        {
          apiResult: {
            actionGroup,
            apiPath: "/api/v1/send",
            httpMethod: "POST",
            httpStatusCode: 200,
            responseBody: {
              "application/json": {
                body: JSON.stringify(signbeeResult),
              },
            },
          },
        },
      ],
    },
  });

  return await bedrock.send(command);
}