Skip to main content
Common questions about the doola Partner API and Partner Portal. For endpoint-level request and response detail, see the API reference tab and the guides.
Don’t have access yet? Get API access. Already a partner and can’t find your answer here? Email engineering@doola.com.

​
What you can do today

  • Form US companies (LLC or C-Corp) for your users. Submit a formation request via the API; doola handles state filing, registered agent, and EIN. Your user never has to interact with doola directly.
  • Register and manage your customers. Create customers (idempotent) and attach one or more companies to each.
  • Track formation status in real time. Receive webhook events as a company moves through formation, and read the company from the API whenever you need its current state.
  • Download company documents. Articles of Organization, EIN letter, operating agreement or bylaws, forwarded mail and filed annual reports, via temporary signed links.
  • Resolve required actions. Answer what doola needs from you to continue a formation, such as replacement company names when the state rejects every option.
  • Stay compliant after formation. Read each company’s compliance calendar, and file its annual report through the API.
  • Embed doola’s formation flow in your product. The Embedded SDK puts the whole wizard, signing and the founder’s dashboard inside your app, in your branding, while you take payment.
  • Let AI agents form companies. The doola Formation MCP server lets a founder form a Wyoming LLC from their own AI client.
  • Self-manage your API keys and webhook endpoint in the Partner Portal, including reviewing delivery logs.
  • Browse everything in the Partner Portal, a ready-made web dashboard for your team.

​
Access and authentication

Request API access and the doola team provisions your account, issues your API keys (dk_test_... for sandbox, dk_live_... for production), and creates Partner Portal logins for anyone on your team who needs dashboard access. You then generate your own webhook signing secret in the portal.
Once your agreement is signed, you get sandbox access and production keys, a direct line to our engineering team for integration and API questions, and implementation support from sandbox through go-live and beyond.
API keys follow the format dk_live_.... They are long, unique, and scoped to your account only, so your key can never see another partner’s data. Keys don’t expire by default, and if one is ever compromised it can be revoked and replaced without losing any of your customer or company data.
Yes, for the Partner Portal, which uses a standard email and password login. A portal sign-in can’t replace the API key for integration calls: creating customers and companies, confirming payment, creating signing sessions and minting SDK sessions accept only the API key.API key vs. Partner Portal: the API key (dk_live_...) is for machine-to-machine calls such as creating customers, forming companies, and reading status. Anything else, such as managing API keys, setting your webhook URL, or reviewing delivery logs, lives in the Partner Portal.
Yes. Manage your API keys (create, list, revoke, delete) in the Partner Portal. Two intentional guardrails: an existing API key can’t mint new keys (only a signed-in user can), and “revoke all keys at once” stays a doola-assisted action to avoid accidental lockouts.
Yes. Each person gets their own email and password login, and all logins see the same company and customer data scoped to your account.
Completely. Your account is a fully isolated tenant, so your API key only ever has access to companies and customers that belong to you. There is no way to see, or be seen by, another partner through the API or the portal.

​
Forming companies

Every formation includes:
  • Entity filing — the LLC or C-Corp filed with the state authority
  • EIN (Employer Identification Number) from the IRS
  • Registered Agent service for the first year, in the formation state
  • Governance document — an Operating Agreement for an LLC, Corporate Bylaws for a C-Corp
  • US business address — the Registered Agent address doubles as a US mailing address. Incoming mail is opened, scanned, and delivered to you through the document_mail_uploaded webhook, within these limits:
    • All State and government notices are included, with no cap
    • Plus the first 5 pieces of non-official mail
    • No packages — the address accepts letter mail only
    • Physical mail forwarding is available for an additional fee
The first three arrive as the three services attached to every company (Formation, EinCreation, RegisteredAgent), so you can track each one independently — see Company services. The governance document lands as a document_operatingagreement_uploaded or document_corporatebylaws_uploaded webhook shortly after the Articles of Organization are processed.The only per-company charge on the base formation is the state filing fee, which varies by state and entity type — look it up from the state-fees reference endpoint.
LLC and C-Corp. Set the optional entityType field on the create-company request to LLC (the default when omitted) or CCorp. The two differ in who you list: an LLC takes members with ownership percentages, while a CCorp takes executiveMembers (officers and directors) and a ccorpValuation (authorized shares and par value per share).
  • The customer the company belongs to (doolaCustomerId)
  • The entity type, LLC (default) or CCorp
  • The US state to form in
  • Up to 3 preferred company names, in order. doola uses the first one that clears the state’s availability check
  • The industry, an exact label from the NAICS list (see Choosing an industry)
  • A business description
  • The responsible party (the person legally responsible for the EIN application)
  • For an LLC: company members and their ownership percentages (must total exactly 100%)
  • For a C-Corp: executive members (at least one President, Secretary, Treasurer, and Director; President, Secretary, and Treasurer may each appear once, Director may repeat) plus the share structure (number of authorized shares and par value per share)
doola auto-assigns the registered agent based on the chosen state, so you don’t supply that.
Yes. doola forms US companies for founders anywhere in the world. Under doola’s partner workflow, an SS-4 signature is required when no one on the company supplies a valid SSN. An ITIN is accepted but does not waive signing; this checks format, not issuance or tax residency. The create-company response flags the requirement in signatureRequirements, and you collect the signature through a fully whitelabeled doola signing link. See the signing guide for the end-to-end flow.
Yes, when no member, executive member, or responsible party supplies a valid SSN. ITIN-only companies are eligible. Expedited processing is available for an additional fee, billed per use. Contact our team for pricing details.Request it at company creation by adding requestedServices: [{ "service": "EinCreation", "variant": "Expedite" }] to the create-company payload. See Expedited EIN for the full guide.
All 50 US states plus Washington DC. Query /v1/partner/references/states for the live list, so you never hardcode anything in your onboarding forms.For current state filing fees by state and entity type, see the doola state fees spreadsheet.
Your API call returns immediately (usually within a second) with a PENDING status. The actual formation work happens asynchronously in the background. Timelines vary by state and current volume. You are notified by webhook the moment the status changes, and you can check status any time via the API or the portal.The end-to-end journey your customer experiences, from submission to a ready-to-use company, typically runs as follows. Share this timeline with your clients to set expectations.
1

Submit the formation request

You collect the company details (name options, entity type, state) and member / responsible-party details, then submit them via the API. The call returns immediately with a PENDING status.
2

Company filed with the state — ~1 week on average

doola files the formation, prepares the Articles of Organization, and assigns the Registered Agent. Timing varies by state and current volume.
3

Business documents secured

The EIN and the essential business documents needed for banking, hiring, and taxes are issued.
  • Online EIN processing: 1–2 business days, when doola can apply online: the company is an LLC, the responsible party supplies an SSN and an address with a phone number, and the business address is in the US. See When signing applies
  • EIN processing by fax: 8–11 weeks (6–9 weeks with Expedite EIN); the upper end applies during IRS peak season, December 15 – April 30
Signing requirements depend on the submitted identifier, not residency: if no person supplies an SSN in a valid format, SS-4 is required. An ITIN does not waive signing. Read signatureRequirements; see SS-4 and Form 8821 signing.
4

US bank account opened — 3–5 business days

Once the business documents are ready, your customer can apply for a US bank account with a bank of their choice. doola doesn’t open accounts or decide approvals, and the Partner Portal has no banking feature. International clients need a passport.
5

Run & grow the business

The company is fully set up and compliant. Optional bookkeeping and tax services support ongoing operations.
These are typical estimates, not guarantees. State filing time varies by state and current volume, and EIN issuance follows the IRS’s own timeline. The last two steps (bank account, ongoing operations) sit outside the Partner API and are shown only so you can share the full client journey.
Yes. Develop and test against https://api.test.doola.com before going to production (https://api.doola.com). Sandbox keys never trigger real state filings or charges. Sandbox also includes a playground that triggers the formation and EIN webhooks on demand.
Yes. A mailing address is included as part of the registered agent service. Incoming mail is opened, scanned, uploaded, and delivered to you through the document_mail_uploaded webhook — all State and government notices are included, plus the first 5 pieces of non-official mail. The address accepts letter mail only, so no packages. Physical mail forwarding, when you need it, carries a separate fee.
When you form a company through the API, each company address entry (mailing and business) takes a provider: registeredAgent (doola supplies its registered agent address for the formation state) or customer (you supply your user’s own address); see Addresses. We recommend registeredAgent for both. In Indiana and Illinois, use customer with the founder’s own address for both entries instead: those states reject the registered agent’s address, and a request that uses it is held behind a Founder address needed action.If you list the customer’s own address instead, official state correspondence and compliance notices are sent directly to that address rather than to doola. doola then has no visibility into the entity’s compliance status and cannot notify you of upcoming filings, state notices, or issues with formation. If the address is a home address, it also becomes part of the public record on state government websites. The IRS EIN letter is the exception: it reaches doola whichever provider you choose; see Addresses.Using doola’s registered agent address ensures all compliance documents are received and tracked (and delivered to you through the document_mail_uploaded webhook), and allows doola to support you and your customer if issues arise during or after formation. It is included in the standard service at no extra charge.
The formation charge applies at submission, so you are charged when the API request is made. doola then processes the formation and checks name availability. If all of your submitted names are unavailable, doola raises a required action on the company and sends you a company_name_options_required webhook, whose reason usually names the rejected names. Collect new names from your user and submit them through the API; the formation resumes from there, and the charge stays in place throughout.Fewer than 5% of formations hit a name conflict, and name-availability checking is coming to the API. Until then, submit all three name options to minimize the chance of a conflict.
Usually for one of two reasons: the name is too close to a company already on the state’s records, or it uses a restricted word, such as “Bank” or “Insurance”, that the state allows only with a regulator’s approval. Each state applies its own rules. Make your three name options genuinely different, not small variations of one name, so that at least one is likely to clear.
Not through the API, which has no endpoint to edit a company. The one exception is the company name after the state rejects every option, which you replace through the new company names required action.For any other change, send your doola contact the company ID as soon as you spot the mistake. A correction is simplest before doola files with the state and submits the SS-4. Once the company is filed, changing its name, address or members is an amendment filed with the state, with its own state fee, and the IRS record may need updating too. Your doola contact confirms what is needed and what it costs before anything is filed.
Not through the API, which has no cancel endpoint. A production request is charged on submission and doola starts work straight away, so build and test your integration in the sandbox, where nothing is filed or charged. If you submitted a company by mistake, send your doola contact the company ID immediately. Refunds follow your partner agreement.A company submitted through the Embedded SDK is different: nothing is filed until you confirm payment, and doola can cancel it before then. See the SDK FAQ.
Renewal is not handled through the API, and no webhook announces it. Your partner agreement sets the renewal terms, so agree them with your doola contact before the first anniversary of each formation.

​
Tracking status and documents

There are two separate signals, and they answer different questions:To detect a formed company, watch the company_formation_completed webhook. From that moment formationSubmissionStatus reads COMPLETED and the Formation service reads Completed.
Check these, in order:
  1. Required actions. One call to the open list, GET /v1/partner/required-actions, covers every company you own. An open action for the company means it is waiting on you, or on doola refiling with the state; see Statuses.
  2. The company itself. Read it once. An SS4 or FORM8821 entry in signatureRequirements with status PENDING means the founder has not signed yet, and the EIN waits for it: create a fresh signing session and present it. adminNotes carries flags from the doola operations team, such as a state filing delay.
If neither explains it, the company is most likely in the state’s or the IRS’s queue; compare against the typical timeline under “How long does formation take?” above. If it is well past that, send your doola contact the company ID.
If doola’s system can’t complete the formation (for example a state filing issue), it retries automatically up to 4 times, at 5, 15, 30, and 60 minutes, before marking the company FAILED. When that happens:
  • The company status is set to FAILED
  • You receive a company_formation_failed webhook
  • The doola team is alerted internally
From there, reach your doola account contact to resolve it.
Subscribe to the company_ein_issued webhook, then fetch the company to read the ein field. The IRS confirmation letter follows separately via document_einletter_uploaded once it is ready to download. The two events arrive independently, so don’t assume an order.
After a document_* webhook fires, call the documents endpoints to list a company’s documents and fetch a temporary signed download URL (valid about 1 hour). Don’t cache the URL; request a fresh one each time you need to download.

​
Webhooks

Webhooks are HTTP notifications doola sends to your server whenever something meaningful happens, so you don’t have to keep polling “is it done yet?”. doola sends a POST with a JSON payload to your HTTPS endpoint, and your server responds 200 OK.
Use the Sandbox playground. Two sandbox-only endpoints complete a test company’s formation and EIN issuance on demand, firing company_formation_completed, document_aoo_uploaded, company_ein_issued, and document_einletter_uploaded through the normal delivery pipeline: signed once you have generated a signing secret, retried, and logged in the Partner Portal.
All of them: there are no per-event subscriptions. Handle the ones you need and answer the rest with a 2xx, so they are not retried. The full list, with a sample payload for each, is in Webhooks.
A 4xx, a 5xx, a timeout (no answer within 60 seconds) or a connection error is retried up to 5 times, at 1 minute, 15 minutes, 1 hour, 12 hours, and 24 hours. A 3xx is not followed or retried, so point the webhook URL at the final host. See Delivery and retries.
When an event exhausts its retries, doola disables your webhook endpoint. No notification is sent, and events that fire while it is disabled are not queued, so keep an eye on the Partner Portal’s Events page. Once you have fixed your endpoint, re-enable delivery in the Partner Portal and run a reconciliation sweep.
Yes, both. Settings → Webhook URL in the Partner Portal holds your endpoint, its delivery status, and your signing secret. Generate or rotate the secret there; it is shown once, and a rotation invalidates the previous secret immediately, so treat it as a cutover for your signature verification and deploy the new value promptly. Generating a secret requires an active API key on the tenant.
Nothing is lost. Every state a webhook announces is also readable from the API, so you can always catch up by fetching the company and the open required-actions list. Reconciliation maps each event to the field that carries the same information, and outlines a sweep to run on a schedule and after any incident on your side.
Yes. Every delivery attempt from the last 90 days is visible on the Partner Portal’s Events page (timestamp, event name, HTTP status, payload and your endpoint’s response body).
Once you have generated a signing secret, each delivery carries an x-doola-signature header, an HMAC-SHA256 hex digest of the raw request body, keyed with that secret. Until then deliveries are unsigned, so generate the secret before you go live and reject any request whose signature is missing. Recompute the digest on your side and compare using a constant-time comparison (for example timingSafeEqual or compare_digest), never plain string equality. See Verifying the signature.
In rare cases you may receive a duplicate document_* event for the same document (for example when ops re-issues a document after an IRS correction). The event does not carry the document’s ID, so list the company’s documents and dedupe on the document id.

​
Partner Portal

The Partner Portal (partners-portal.doola.com) is a ready-to-use web dashboard for your team, with no technical setup, just log in. It shows a searchable list of all your companies and customers, full company details (status, EIN, filing date, state, entity type, members, addresses), a Formation / EIN / Registered Agent status stepper, downloadable documents, and any notes left by the doola team. It is also where you self-manage your API keys, webhook URL, and signing secret, and review delivery logs.Company and customer data is read-only in the portal. To create or change those, use the API.
The portal currently shows doola branding. White-labeling is not a standard offering today, but can be discussed for enterprise partners case by case. If you want a fully custom experience, build your own UI on top of the API.
Not directly. doola does not host a customer-facing interface for partner-created companies. You build whatever your end-users see, pulling current status from the API and displaying it in your own product.

​
Data and privacy

doola stores the registration info you submit (email, first name, last name, country of residence, and optionally phone number) plus the company formation details. SSNs, when submitted as part of responsible-party or member information, are masked in all API responses. Only a redacted version is ever returned (for example ****-**-1234). doola uses the raw value to apply for the company’s EIN and to provide the doola services the company uses. It is never returned in full, through the API or webhooks.

​
Quick reference: what’s available

Last modified on October 21, 2026