# Online Notary Center integration starter

This public guide is intended for a customer's integration project. It is not an internal ONC repository instruction file. Review it with the project owner before placing it in your project's AGENTS.md, and follow that project's access and approval rules.

## Use the API reference as the contract

- Start at [ONC API Documentation](https://www.onlinenotarycenter.com/docs/).
- Read [authentication](https://www.onlinenotarycenter.com/docs/#authentication), [notarization](https://www.onlinenotarycenter.com/docs/#notary), [eSign](https://www.onlinenotarycenter.com/docs/#esign), and [automation](https://www.onlinenotarycenter.com/docs/#automation) for the requested workflow.
- Confirm API access, the authorized account, credentials, and the intended environment with ONC and the customer. Do not assume a test environment or universal account entitlement exists.
- Verify each HTTP method, endpoint, request field, response, and status against the reference before implementing it. Do not invent endpoints, SDKs, MCP servers, authentication scopes, or native CRM connectors.
- RON includes a commissioned notary and required human participation. IPEN involves physical appearance before the notary. eSign collects electronic signatures without a notarial act. Do not substitute one workflow for another.

## Keep credentials and customer information protected

- Put token exchange and authenticated ONC calls on the customer's server. Keep client secrets and access/refresh tokens out of frontend code, URLs, committed files, screenshots, and logs.
- Use the customer's approved secret storage and deployment process. Examples must use explicit placeholders and fictional documents and signers.
- Send or retrieve only information the customer has authorized for the integration. Treat invitation links, passcodes, session references, and completed files as confidential.
- Do not infer authorization from possession of a webhook notification or session reference. Request session details and files through the authenticated API with the intended account.

## Follow the documented sequence

1. Confirm the customer's intended product, account access, document requirements, and authorized participants.
2. For a supported notarization request, follow the documented creation, signer, preparation, and handoff sequence. For eSign, follow the separate documented eSign sequence.
3. Use documented status checks or a configured completion notification to determine the next supported action.
4. Retrieve available completed files through the authorized API and store them under the customer's approved access and retention process.

These are integration steps, not permission to run requests. A coding assistant must not create real sessions, upload documents, send invitations, or retrieve customer records simply to demonstrate the integration.

## Completion webhooks

- See [Subscribe to Completed Sessions](https://www.onlinenotarycenter.com/docs/#create-hook) and the related automation reference.
- The documented completion notification uses action `session_completed` and a `notary_id` session reference. Do not invent additional event names or assume the notification contains a completed document.
- Use the reference to retrieve supported session details and available files. Verify processing and file availability instead of assuming every file is ready when a notification arrives.
- Confirm receiver authentication and delivery behavior with ONC. Do not assume signed notifications, a retry schedule, ordering, or exactly-once successful delivery.
- Make the receiver safe to process repeated or delayed notifications and plan authorized status reconciliation. This is a customer implementation recommendation, not an ONC delivery guarantee.

The documented notification shape, shown with a placeholder rather than a real session reference:

```json
{
  "action": "session_completed",
  "notary_id": "SESSION_REFERENCE"
}
```

For example, a customer integration can associate the returned ONC session reference with its own work item, receive the completion notification, and request the available result through the API before updating that work item. This requires an implemented connection; it is not a prebuilt CRM connector.

## Zapier and other tools

Confirm Zapier app access and the supported connection with ONC before proposing a setup link or building a Zap. This guide does not establish public app availability, invitation-only access, a native connector for any named CRM, or automatic access to customer accounts.

## Human participation and authorization

- AI assistance is for integration development. It does not perform notarizations, replace a notary, complete identity verification, answer KBA questions, provide signatures/consent, or bypass required human actions.
- Obtain the customer's authorization before connecting real credentials, registering/changing webhook destinations, creating or changing sessions, uploading documents, inviting participants, downloading private records, or changing external systems.
- Never initiate payments, subscriptions, or customer communications as an unapproved implementation test. Respect the customer's explicit approval and deployment process.
- Keep any law, document eligibility, identity, and witness questions with the authorized ONC/notary workflow and the customer's responsible reviewers.

## Implementation checks

- Use mocks and fictional data first. Agree a safe environment and authorized end-to-end test with the customer and ONC before real calls.
- Check missing/expired credentials, denied account access, invalid input, incomplete sessions, unavailable files, network failures, and repeated/delayed notifications.
- Ensure failures do not expose credentials or customer information. Keep sensitive records out of test fixtures and public issue reports.
- Review the handoff, status mapping, file retrieval, authorization, and recovery behavior with the customer before release.
- If documentation and observed authorized behavior disagree, stop the dependent action and ask ONC for clarification. Do not silently invent a replacement contract.