Attio & Twenty CRM + Signbee: Deal-Stage E-Signature Automation (2026)

import { NextRequest, NextResponse } from "next/server";
import crypto from "crypto";

const ATTIO_API_KEY = process.env.ATTIO_API_KEY!;
const ATTIO_WEBHOOK_SECRET = process.env.ATTIO_WEBHOOK_SECRET!;
const SIGNBEE_API_KEY = process.env.SIGNBEE_API_KEY!;

function verifyAttioSignature(rawBody: string, signatureHeader: string | null): boolean {
  if (!signatureHeader) return false;
  const expected = crypto
    .createHmac("sha256", ATTIO_WEBHOOK_SECRET)
    .update(rawBody)
    .digest("hex");
  return crypto.timingSafeEqual(Buffer.from(signatureHeader), Buffer.from(expected));
}

async function attioFetch(path: string, options: RequestInit = {}) {
  const res = await fetch(`https://api.attio.com/v2${path}`, {
    ...options,
    headers: {
      Authorization: `Bearer ${ATTIO_API_KEY}`,
      "Content-Type": "application/json",
      ...(options.headers || {}),
    },
  });
  if (!res.ok) {
    throw new Error(`Attio API error (${res.status}): ${await res.text()}`);
  }
  return res.json();
}

export async function POST(req: NextRequest) {
  const rawBody = await req.text();
  const signature = req.headers.get("Attio-Signature");

  if (!verifyAttioSignature(rawBody, signature)) {
    return NextResponse.json({ error: "Invalid Attio webhook signature" }, { status: 401 });
  }

  const payload = JSON.parse(rawBody);
  const event = payload.events?.[0];
  if (!event || event.event_type !== "record.updated") {
    return NextResponse.json({ skipped: true });
  }

  const recordId = event.id?.record_id;
  const objectId = event.id?.object_id;

  // 1. Hydrate the full Deal record from Attio REST API v2
  const dealRes = await attioFetch(`/objects/${objectId}/records/${recordId}`);
  const values = dealRes.data.values;

  const currentStage = values.stage?.[0]?.status?.title;
  const existingSignbeeId = values.signbee_document_id?.[0]?.value;

  // Guard: Only trigger when stage is 'Contract Sent' and no envelope exists yet
  if (currentStage !== "Contract Sent" || existingSignbeeId) {
    return NextResponse.json({ status: "ignored", currentStage, existingSignbeeId });
  }

  const dealName = values.name?.[0]?.value ?? "Enterprise Subscription Order";
  const dealAmountCents = values.value?.[0]?.currency_value ?? 2400000;
  const formattedAnnualValue = (dealAmountCents / 100).toLocaleString("en-US", {
    style: "currency",
    currency: values.value?.[0]?.currency_code ?? "USD",
  });

  // 2. Resolve associated Company & Primary Contact Record IDs
  const companyRef = values.associated_company?.[0]?.target_record_id;
  const contactRef = values.primary_contact?.[0]?.target_record_id;

  const [companyRes, contactRes] = await Promise.all([
    companyRef ? attioFetch(`/objects/companies/records/${companyRef}`) : null,
    contactRef ? attioFetch(`/objects/people/records/${contactRef}`) : null,
  ]);

  const companyName = companyRes?.data?.values?.name?.[0]?.value ?? "Client Organization";
  const recipientName =
    contactRes?.data?.values?.name?.[0]?.full_name ?? "Authorized Signatory";
  const recipientEmail =
    contactRes?.data?.values?.email_addresses?.[0]?.email_address;

  if (!recipientEmail) {
    return NextResponse.json(
      { error: "Primary contact on Attio deal is missing an email address" },
      { status: 422 }
    );
  }

  // 3. Compile CommonMark Order Form with Dynamic Markdown Pricing Table
  const orderFormMarkdown = `# Commercial Order Form — ${companyName}

**Order Reference:** ATTIO-${recordId.slice(0, 8).toUpperCase()}  
**Effective Date:** ${new Date().toISOString().split("T")[0]}  
**Customer Legal Entity:** ${companyName}  
**Primary Billing Contact:** ${recipientName} (${recipientEmail})

---

## 1. Subscription Services & Commercial Schedule

| Subscription Tier | Included Seats | Billing Cadence | Annual Contract Value |
|---|---|---|---|
| Enterprise Platform License | 50 Seats | Annual Upfront | ${formattedAnnualValue} |
| Dedicated Webhook & API SLA | Unlimited | Included | $0.00 |
| **Total Annual Commitment** | **50 Seats** | **Net 30** | **${formattedAnnualValue}** |

## 2. Governing Terms & Execution

This Order Form incorporates by reference the Master SaaS Subscription Agreement. By executing this Order Form electronically via Signbee, both parties agree to be legally bound by the commercial terms set forth above.`;

  // 4. Dispatch via Signbee POST /api/v1/send
  const signbeeRes = await fetch("https://signb.ee/api/v1/send", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${SIGNBEE_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      title: `Order Form — ${companyName} (${dealName})`,
      markdown: orderFormMarkdown,
      sender_name: "Revenue Operations",
      sender_email: "revops@acmecloud.io",
      recipient_name: recipientName,
      recipient_email: recipientEmail,
      expires_in_days: 14,
      webhook_url: `https://crm-bridge.acmecloud.io/api/webhooks/signbee?crm=attio&dealId=${recordId}`,
    }),
  });

  const signbeeData = await signbeeRes.json();

  // 5. Write Signbee Document ID back to Attio for idempotency
  await attioFetch(`/objects/${objectId}/records/${recordId}`, {
    method: "PATCH",
    body: JSON.stringify({
      data: {
        values: {
          signbee_document_id: [{ value: signbeeData.id }],
        },
      },
    }),
  });

  return NextResponse.json({ dispatched: true, signbeeDocumentId: signbeeData.id });
}

import { NextRequest, NextResponse } from "next/server";

const TWENTY_GRAPHQL_URL = process.env.TWENTY_GRAPHQL_URL!; // e.g. https://api.twenty.com/graphql
const TWENTY_API_KEY = process.env.TWENTY_API_KEY!;
const SIGNBEE_API_KEY = process.env.SIGNBEE_API_KEY!;

async function twentyGraphQL<T>(query: string, variables: Record<string, unknown>): Promise<T> {
  const response = await fetch(TWENTY_GRAPHQL_URL, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${TWENTY_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ query, variables }),
  });

  const json = await response.json();
  if (json.errors?.length) {
    throw new Error(`Twenty GraphQL Error: ${JSON.stringify(json.errors)}`);
  }
  return json.data as T;
}

const GET_OPPORTUNITY_DETAILS = `
  query GetOpportunityForContract($id: UUID!) {
    opportunity(filter: { id: { eq: $id } }) {
      id
      name
      stage
      amount {
        amountMicros
        currencyCode
      }
      closeDate
      signbeeDocumentId
      company {
        id
        name
        domainName
        address
      }
      pointOfContact {
        id
        name {
          firstName
          lastName
        }
        emails {
          primaryEmail
        }
      }
    }
  }
`;

const UPDATE_OPPORTUNITY_SIGNBEE_ID = `
  mutation LockOpportunityEnvelope($id: UUID!, $signbeeDocumentId: String!) {
    updateOpportunity(
      id: $id
      data: { signbeeDocumentId: $signbeeDocumentId }
    ) {
      id
      signbeeDocumentId
    }
  }
`;

export async function POST(req: NextRequest) {
  const body = await req.json();

  if (body.eventName !== "opportunity.updated") {
    return NextResponse.json({ ignored: true });
  }

  const opportunityId = body.record?.id;
  if (!opportunityId || body.record?.stage !== "CONTRACT_SENT") {
    return NextResponse.json({ status: "stage_not_contract_sent" });
  }

  // 1. Query Twenty CRM GraphQL API for full relational context
  const data = await twentyGraphQL<{ opportunity: any }>(GET_OPPORTUNITY_DETAILS, {
    id: opportunityId,
  });

  const opp = data.opportunity;
  if (!opp || opp.signbeeDocumentId) {
    return NextResponse.json({ status: "already_dispatched" });
  }

  const amountMajor = (Number(opp.amount?.amountMicros ?? 0) / 1_000_000).toLocaleString("en-US", {
    style: "currency",
    currency: opp.amount?.currencyCode || "USD",
  });

  const signerFullName = `${opp.pointOfContact?.name?.firstName ?? ""} ${
    opp.pointOfContact?.name?.lastName ?? ""
  }`.trim();
  const signerEmail = opp.pointOfContact?.emails?.primaryEmail;

  if (!signerEmail) {
    return NextResponse.json({ error: "Missing pointOfContact primaryEmail" }, { status: 422 });
  }

  // 2. Dispatch Master Services Agreement + Order Schedule to Signbee
  const signbeeResponse = await fetch("https://signb.ee/api/v1/send", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${SIGNBEE_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      title: `MSA & Order Schedule — ${opp.company?.name ?? opp.name}`,
      markdown: `# Master Services Agreement & Order Schedule

**Opportunity ID:** ${opp.id}  
**Client Organization:** ${opp.company?.name} (${opp.company?.domainName})  
**Registered Address:** ${opp.company?.address ?? "On File"}  
**Total Contract Value:** ${amountMajor}

## 1. Commercial Scope

| Line Item | Description | Total Fee |
|---|---|---|
| ${opp.name} | Annual Platform & API Access | ${amountMajor} |

## 2. Binding Electronic Execution

Executed electronically pursuant to the US ESIGN Act, UETA, and UK Electronic Communications Act 2000.`,
      sender_name: "Legal & Deal Desk",
      sender_email: "deals@yourdomain.com",
      recipient_name: signerFullName || "Authorized Signatory",
      recipient_email: signerEmail,
      expires_in_days: 10,
      webhook_url: `https://crm-bridge.yourdomain.com/api/webhooks/signbee?crm=twenty&dealId=${opp.id}`,
    }),
  });

  const createdDoc = await signbeeResponse.json();

  // 3. Persist Signbee Document ID back into Twenty CRM via GraphQL Mutation
  await twentyGraphQL(UPDATE_OPPORTUNITY_SIGNBEE_ID, {
    id: opp.id,
    signbeeDocumentId: createdDoc.id,
  });

  return NextResponse.json({ dispatched: true, documentId: createdDoc.id });
}

import { NextRequest, NextResponse } from "next/server";

export async function POST(req: NextRequest) {
  const { searchParams } = new URL(req.url);
  const crmType = searchParams.get("crm"); // "attio" | "twenty"
  const dealId = searchParams.get("dealId");

  const event = await req.json();
  if (event.event !== "document.signed" || !dealId) {
    return NextResponse.json({ received: true });
  }

  const { document_id, signed_at, sha256_hash, verify_url, recipient_email } = event.data;

  if (crmType === "attio") {
    // 1. Update Attio Deal stage to 'Closed Won' and save verification link
    await fetch(`https://api.attio.com/v2/objects/deals/records/${dealId}`, {
      method: "PATCH",
      headers: {
        Authorization: `Bearer ${process.env.ATTIO_API_KEY}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        data: {
          values: {
            stage: "Closed Won",
            signbee_verify_url: [{ value: verify_url }],
          },
        },
      }),
    });

    // 2. Append an immutable audit note to the Attio Deal timeline
    await fetch("https://api.attio.com/v2/notes", {
      method: "POST",
      headers: {
        Authorization: `Bearer ${process.env.ATTIO_API_KEY}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        data: {
          parent_object: "deals",
          parent_record_id: dealId,
          title: "Contract Executed via Signbee (SHA-256 Verified)",
          format: "plaintext",
          content: `Signed by ${recipient_email} at ${signed_at}.\nDocument ID: ${document_id}\nSHA-256 Hash: ${sha256_hash}\nVerification Certificate: ${verify_url}`,
        },
      }),
    });
  } else if (crmType === "twenty") {
    // Update Twenty CRM Opportunity stage to CLOSED_WON via GraphQL
    await fetch(process.env.TWENTY_GRAPHQL_URL!, {
      method: "POST",
      headers: {
        Authorization: `Bearer ${process.env.TWENTY_API_KEY}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        query: `
          mutation MarkOpportunityClosedWon($id: UUID!, $verifyUrl: String!) {
            updateOpportunity(
              id: $id
              data: {
                stage: CLOSED_WON
                signbeeVerifyUrl: $verifyUrl
              }
            ) {
              id
              stage
            }
          }
        `,
        variables: {
          id: dealId,
          verifyUrl: verify_url,
        },
      }),
    });
  }

  return NextResponse.json({ synced: true, crmType, dealId, document_id });
}

{
  "mcpServers": {
    "signbee": {
      "command": "npx",
      "args": ["-y", "signbee-mcp"],
      "env": {
        "SIGNBEE_API_KEY": "signbee_live_98a7bc65d43e21f0..."
      }
    },
    "attio-crm": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-attio"],
      "env": {
        "ATTIO_API_KEY": "attio_v2_secret_..."
      }
    },
    "twenty-crm": {
      "command": "npx",
      "args": ["-y", "twenty-mcp-server"],
      "env": {
        "TWENTY_API_KEY": "twenty_jwt_...",
        "TWENTY_BASE_URL": "https://api.twenty.com"
      }
    }
  }
}