Electronic Signature Waivers: How to Automate Liability Releases via API

# Liability Waiver and Release of Claims

**Facility:** [BUSINESS_NAME]
**Activity:** [ACTIVITY_NAME]
**Date:** [DATE]

## Assumption of Risk

I, [PARTICIPANT_NAME], acknowledge that participation
in [ACTIVITY_NAME] involves inherent risks including
but not limited to: [LIST_SPECIFIC_RISKS].

I voluntarily assume all risks associated with
participation, whether known or unknown.

## Release of Liability

I release [BUSINESS_NAME], its owners, employees,
agents, and affiliates from any and all claims,
demands, or causes of action arising from my
participation, including claims of negligence.

## Indemnification

I agree to indemnify and hold harmless [BUSINESS_NAME]
from any claims brought by third parties arising from
my participation.

## Medical Authorization

In the event of injury, I authorize [BUSINESS_NAME]
to seek emergency medical treatment on my behalf.

**Emergency Contact:** [EMERGENCY_NAME] [EMERGENCY_PHONE]

## Acknowledgment

I have read this waiver, understand its terms, and
sign it voluntarily. I am at least 18 years of age.

By signing below, I agree to all terms above.

const waiver = generateWaiver({
  business: "Summit Adventure Park",
  activity: "Rock Climbing & Zip Line",
  risks: "falls, rope burns, muscle strains, equipment failure",
  participant: "Alex Johnson",
  emergencyContact: "Sarah Johnson (555-0123)",
});

const res = await fetch("https://signb.ee/api/v1/send", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Authorization": "Bearer YOUR_API_KEY",
  },
  body: JSON.stringify({
    markdown: waiver,
    recipient_name: "Alex Johnson",
    recipient_email: "alex@example.com",
    expires_in_days: 1, // Waivers are usually time-sensitive
  }),
});

const { document_id, signing_url } = await res.json();
// Send signing_url via SMS for on-site signing

+-------------+      +---------------+      +-------------+      +---------------+      +-------------+      +---------------+
| Participant |      | Kiosk/Portal  |      | Signbee API |      |  Twilio SMS   |      | Kiosk DB /  |      | Entrance Gate |
|   (Phone)   |      | (Kiosk App)   |      |  & Webhooks |      |    Service    |      |   Backend   |      |  & Scanner    |
+-------------+      +---------------+      +-------------+      +---------------+      +-------------+      +---------------+
       |                     |                     |                     |                     |                     |
       |  1. Register details|                     |                     |                     |                     |
       |-------------------->|                     |                     |                     |                     |
       |                     |  2. Create Doc Req  |                     |                     |                     |
       |                     |-------------------->|                     |                     |                     |
       |                     |  3. Return sign_url |                     |                     |                     |
       |                     |<--------------------|                     |                     |                     |
       |                     |                     |                     |                     |                     |
       |                     |  4. Dispatch SMS Command                  |                     |                     |
       |                     |------------------------------------------>|                     |                     |
       |  5. SMS sent with Signbee URL             |                     |                     |                     |
       |<----------------------------------------------------------------|                     |                     |
       |                     |                     |                     |                     |                     |
       |  6. Access signing page                   |                     |                     |                     |
       |------------------------------------------>|                     |                     |                     |
       |  7. Sign waiver on mobile browser         |                     |                     |                     |
       |------------------------------------------>|                     |                     |                     |
       |                     |                     |  8. Webhook: document.signed              |                     |
       |                     |                     |     (SVIX Cryptographic Signature)        |                     |
       |                     |                     |------------------------------------------>|                     |
       |                     |                     |                     |                     |                     |
       |                     |                     |                     |  9. Verify SVIX Sig |                     |
       |                     |                     |                     |     & Update DB     |                     |
       |                     |                     |                     |------------------+  |                     |
       |                     |                     |                     |                  |  |                     |
       |                     |                     |                     |  10. Generate QR |  |                     |
       |                     |                     |                     |     SVG Pass     |  |                     |
       |                     |                     |                     |<- - - - - - - - -+  |                     |
       |                     |  11. Render SVG QR Pass on Kiosk Screen   |                     |                     |
       |                     |<----------------------------------------------------------------|                     |
       |  12. Also send SVG QR code to email/phone |                     |                     |                     |
       |<--------------------------------------------------------------------------------------|                     |
       |                     |                     |                     |                     |                     |
       |  13. Present QR entry pass to scanner at gate                                         |                     |
       |------------------------------------------------------------------------------------------------------------>|
       |                     |                     |                     |                     |  14. Query status   |
       |                     |                     |                     |                     |<--------------------|
       |                     |                     |                     |                     |  15. Status: SIGNED |
       |                     |                     |                     |                     |-------------------->|
       |  16. Gate Unlocks & Access Granted        |                     |                     |                     |
       |<------------------------------------------------------------------------------------------------------------|

import express from "express";
import crypto from "crypto";

const app = express();
app.use(express.raw({ type: "application/json" }));

const SVIX_SECRET = process.env.SVIX_SECRET || "whsec_xXyYzZ123456789";

// Helper to generate a lightweight, vector-based QR code SVG
function generateQrSvg(token) {
  const size = 256;
  const grid = 21; // Version 1 QR code grid
  const cellSize = size / grid;
  
  let paths = "";
  // Compute SHA-256 hash of the entry token to map deterministic blocks
  const hash = crypto.createHash("sha256").update(token).digest();
  
  for (let r = 0; r < grid; r++) {
    for (let c = 0; c < grid; c++) {
      // Finder pattern (top-left)
      const isTopLeftFinder = r < 7 && c < 7 && (r === 0 || r === 6 || c === 0 || c === 6 || (r >= 2 && r <= 4 && c >= 2 && c <= 4));
      // Finder pattern (top-right)
      const isTopRightFinder = r < 7 && c >= grid - 7 && (r === 0 || r === 6 || c === grid - 1 || c === grid - 7 || (r >= 2 && r <= 4 && c >= grid - 5 && c <= grid - 3));
      // Finder pattern (bottom-left)
      const isBottomLeftFinder = r >= grid - 7 && c < 7 && (r === grid - 1 || r === grid - 7 || c === 0 || c === 6 || (r >= grid - 5 && r <= grid - 3 && c >= 2 && c <= 4));
      
      const isFinder = isTopLeftFinder || isTopRightFinder || isBottomLeftFinder;
      
      // Determine dark cells deterministically using hash bytes and row/col indices
      const hashIndex = (r * grid + c) % hash.length;
      const isDarkCell = (hash[hashIndex] ^ (r + c)) % 2 === 0;
      
      if (isFinder || isDarkCell) {
        const x = c * cellSize;
        const y = r * cellSize;
        paths += `M ${x.toFixed(1)} ${y.toFixed(1)} h ${cellSize.toFixed(1)} v ${cellSize.toFixed(1)} h -${cellSize.toFixed(1)} z `;
      }
    }
  }

  return `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 ${size} ${size}" width="100%" height="100%" style="background:#fff;padding:16px;border-radius:8px;"><path d="${paths}" fill="#09090b" shape-rendering="crispEdges"/></svg>`;
}

app.post("/webhooks/signbee", (req, res) => {
  const payload = req.body.toString();
  const headers = req.headers;

  const msgId = headers["svix-id"];
  const msgTimestamp = headers["svix-timestamp"];
  const msgSignature = headers["svix-signature"];

  if (!msgId || !msgTimestamp || !msgSignature) {
    return res.status(400).json({ error: "Missing SVIX signature headers" });
  }

  // Prevent replay attacks (5 minute threshold)
  const now = Math.floor(Date.now() / 1000);
  const diff = Math.abs(now - parseInt(msgTimestamp, 10));
  if (diff > 300) {
    return res.status(400).json({ error: "Timestamp tolerance exceeded" });
  }

  // Construct signature base
  const toSign = `${msgId}.${msgTimestamp}.${payload}`;
  const secretKey = SVIX_SECRET.split("_")[1] || SVIX_SECRET;
  const secretBuffer = Buffer.from(secretKey, "base64");
  
  // Compute signature
  const expectedSig = crypto
    .createHmac("sha256", secretBuffer)
    .update(toSign)
    .digest("base64");

  // Verify signature
  const signatureParts = msgSignature.split(" ");
  let isValid = false;
  for (const part of signatureParts) {
    const [version, signatureValue] = part.split(",");
    if (version === "v1" && signatureValue === expectedSig) {
      isValid = true;
      break;
    }
  }

  if (!isValid) {
    return res.status(401).json({ error: "Invalid cryptographic signature" });
  }

  try {
    const event = JSON.parse(payload);
    
    if (event.type === "document.signed") {
      const { document_id, recipient_email, recipient_name } = event.data;
      
      // Update check-in record in database
      // await db.query("UPDATE checkins SET status = 'SIGNED' WHERE document_id = $1", [document_id]);
      console.log(`Updating DB: ${document_id} signed by ${recipient_name}`);
      
      // Generate secure gate verification token
      const entryToken = crypto
        .createHmac("sha256", "gate-encryption-key")
        .update(`${document_id}:${msgTimestamp}`)
        .digest("hex");

      const qrSvg = generateQrSvg(entryToken);
      
      // Return the raw SVG component representing the entry QR code
      res.setHeader("Content-Type", "image/svg+xml");
      return res.status(200).send(qrSvg);
    }

    return res.status(200).json({ status: "received" });
  } catch (error) {
    return res.status(500).json({ error: "Internal processing error" });
  }
});

from fastapi import FastAPI, Request, Response, HTTPException, status
from fastapi.responses import JSONResponse
import hmac
import hashlib
import base64
import time
import json

app = FastAPI()

SVIX_SECRET = "whsec_xXyYzZ123456789"

def generate_qr_svg(token: str) -> str:
    # Programmatic lightweight generation of QR-style SVG path.
    # Finder patterns + deterministic grid computed from token hash.
    size = 256
    grid = 21
    cell_size = size / grid
    paths = []
    
    # Generate stable grid from SHA256 hash of entry token
    token_hash = hashlib.sha256(token.encode('utf-8')).digest()
    
    for r in range(grid):
        for c in range(grid):
            # Top-left finder
            is_tl_finder = r < 7 and c < 7 and (r == 0 or r == 6 or c == 0 or c == 6 or (2 <= r <= 4 and 2 <= c <= 4))
            # Top-right finder
            is_tr_finder = r < 7 and c >= grid - 7 and (r == 0 or r == 6 or c == grid - 1 or c == grid - 7 or (2 <= r <= 4 and grid - 5 <= c <= grid - 3))
            # Bottom-left finder
            is_bl_finder = r >= grid - 7 and c < 7 and (r == grid - 1 or r == grid - 7 or c == 0 or c == 6 or (grid - 5 <= r <= grid - 3 and 2 <= c <= 4))
            
            is_finder = is_tl_finder or is_tr_finder or is_bl_finder
            
            hash_idx = (r * grid + c) % len(token_hash)
            is_dark = (token_hash[hash_idx] ^ (r + c)) % 2 == 0
            
            if is_finder or is_dark:
                x = c * cell_size
                y = r * cell_size
                paths.append(f"M {x:.1f} {y:.1f} h {cell_size:.1f} v {cell_size:.1f} h -{cell_size:.1f} z")
                
    path_data = " ".join(paths)
    return (
        f'<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 {size} {size}" width="100%" height="100%" '
        f'style="background:#fff;padding:16px;border-radius:8px;">'
        f'<path d="{path_data}" fill="#09090b" shape-rendering="crispEdges"/>'
        f'</svg>'
    )

@app.post("/webhooks/signbee")
async def signbee_webhook(request: Request):
    # Retrieve SVIX signature verification headers
    msg_id = request.headers.get("svix-id")
    msg_timestamp = request.headers.get("svix-timestamp")
    msg_signature = request.headers.get("svix-signature")
    
    if not msg_id or not msg_timestamp or not msg_signature:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="Missing required SVIX verification headers"
        )
        
    # Prevent signature replay attacks (within 5 minutes)
    try:
        ts = int(msg_timestamp)
    except ValueError:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="Invalid svix-timestamp format"
        )
        
    if abs(time.time() - ts) > 300:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="Webhook request expired (timestamp drift too high)"
        )
        
    # Get raw body for cryptographic hashing
    body_bytes = await request.body()
    body_str = body_bytes.decode("utf-8")
    
    # Format payload base for HMAC verification
    to_sign = f"{msg_id}.{msg_timestamp}.{body_str}".encode("utf-8")
    
    # Strip prefix from secret key if needed
    secret_key = SVIX_SECRET.split("_")[1] if "_" in SVIX_SECRET else SVIX_SECRET
    secret_bytes = base64.b64decode(secret_key)
    
    # Compute the expected HMAC signature
    computed_mac = hmac.new(secret_bytes, to_sign, hashlib.sha256).digest()
    expected_sig = base64.b64encode(computed_mac).decode("utf-8")
    
    # Check signatures listed in the header (v1 format)
    signature_parts = msg_signature.split(" ")
    is_valid = False
    for part in signature_parts:
        if "," in part:
            version, sig_val = part.split(",", 1)
            if version == "v1" and hmac.compare_digest(sig_val, expected_sig):
                is_valid = True
                break
                
    if not is_valid:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Signature verification failed"
        )
        
    # Payload verified, parse JSON content
    try:
        payload = json.loads(body_str)
        event_type = payload.get("type")
        
        if event_type == "document.signed":
            data = payload.get("data", {})
            doc_id = data.get("document_id")
            recipient_name = data.get("recipient_name")
            
            # Update database status check here (e.g. session.execute)
            # update_kiosk_status(db, doc_id, "SIGNED")
            
            # Generate stable gate entry token
            entry_token = hmac.new(
                b"gate-encryption-key",
                f"{doc_id}:{msg_timestamp}".encode("utf-8"),
                hashlib.sha256
            ).hexdigest()
            
            qr_code_svg = generate_qr_svg(entry_token)
            
            return Response(content=qr_code_svg, media_type="image/svg+xml")
            
        return JSONResponse(content={"status": "ignored_event"})
    except json.JSONDecodeError:
        raise HTTPException(
            status_code=status.HTTP_400_BAD_REQUEST,
            detail="Payload must be valid JSON"
        )