Send a fax with one POST.

POSThttps://my.signalfax.com/api/v1/faxes

Send the PDF as base64, as a URL we fetch, or as a multipart file part — whichever is least work at your end.

curl -X POST https://my.signalfax.com/api/v1/faxes \
  -H "Authorization: Bearer $SIGNAL_FAX_KEY" \
  -F "to=9015550123" \
  -F "subject=Referral — Chen" \
  -F "file=@referral.pdf"

curl -X POST https://my.signalfax.com/api/v1/faxes \
  -H "Authorization: Bearer $SIGNAL_FAX_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "to": ["9015550123", "9015550124"],
    "document_url": "https://files.example.com/referral.pdf",
    "file_name": "referral.pdf",
    "subject": "Referral — Chen"
  }'

A 202 comes back with one fax object per recipient:

{
  "data": [
    {
      "id": "9d6a4768-0b4f-46e5-9b2b-59381876ba7d",
      "object": "fax",
      "direction": "outbound",
      "status": "sending",
      "from": "+19015550100",
      "to": "+19015550123",
      "pages": null,
      "file_name": "referral.pdf",
      "subject": "Referral — Chen",
      "error": null,
      "scheduled_at": null,
      "created_at": "2026-08-20T17:48:14.313Z",
      "document_url": "/api/v1/faxes/9d6a4768.../document"
    }
  ]
}

202 does not mean delivered. It means the carrier took the job. Fax is a real phone call to a real machine, and that call can still fail — a busy line, no answer, a machine that hangs up mid-page. Wait fordelivered before you tell anyone the fax arrived. If a page was oversized we scale it to fit and say so in a warnings array rather than letting the carrier reject it.

Register an HTTPS endpoint under Organization settings → APIand we will POST to it when a fax is delivered, fails, or arrives — so you don’t have to poll. Events are fax.delivered, fax.failed and fax.received, each carrying the same fax object the API returns.

POST /your-endpoint
Signal-Event: fax.delivered
Signal-Signature: t=1755712094,v1=6b1f…

{ "id": "evt_…", "type": "fax.delivered", "created": 1755712094,
  "data": { "id": "9d6a4768…", "status": "delivered", "pages": 3, … } }

Verify the signature before you trust the body. It is an HMAC-SHA256 over `${timestamp}.${body}`using your signing secret, with the timestamp inside the signed material so a captured delivery can’t be replayed later:

import { createHmac, timingSafeEqual } from "crypto"

function verify(secret, header, rawBody, toleranceSec = 300) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")))
  const t = Number(parts.t)
  if (!Number.isFinite(t)) return false
  if (Math.abs(Date.now() / 1000 - t) > toleranceSec) return false

  const expected = createHmac("sha256", secret)
    .update(`${t}.${rawBody}`)
    .digest("hex")

  if (parts.v1?.length !== expected.length) return false
  return timingSafeEqual(Buffer.from(parts.v1, "hex"), Buffer.from(expected, "hex"))
}

Verify against the rawrequest body — re-serialising the JSON changes the bytes and the signature won’t match. Answer 2xxto acknowledge; we retry twice more, then stop and log it. Changing your endpoint rotates the secret, so an old endpoint can’t keep verifying deliveries.