For a DocuSign integration, I'm working on allowing users to send on behalf of others. Using DocuSign's REST API, I am able to send on behalf of another DocuSign user by using the <SendOnBehalfOf> node inside the X-DocuSign-Authentication header of the request, as described here.
I've also found that to find any DocuSign users capable of sending on behalf of, I just need to check their apiAccountWideAccess and allowSendOnBehalfOf permissions.
This alone seems like a security concern for me. Is there a way for me to, first in DocuSign, restrict users for designated sending? For example, can I make it so John can send on behalf of Bob, but Jane cannot? If possible, can I then use the DocuSign REST API to check who a particular user can send on behalf of?
Or, does DocuSign allow any designated sender to send on behalf of any other user, so long as they have the aforementioned permissions? I can't find any documentation about this.
There is a Group called "DocuSign Viewer" that will restrict users from sending envelopes. You can assign the a new user to that group by using the group ID when making the call to create the user (or do it in the member console easily as well).
As far as sending on behalf of, the initiating sender will need Account Wide Rights (apiAccountWideAccess in the API). The only restriction for the user they are sending for is they must be able to send envelopes.
Related
Using the REST API for remote signing and it's been working great for about a year now.
We have a user of our system that wants to send documents for e-signature, and I'd like to limit their access to their own documents, let them get the notifications of document completion, etc.
I know I can create additional users in the admin section but I'm not sure of where to look from there. Is any of the rest possible?
Yes, add the person as a regular (not admin) sender in your DocuSign account. They'll only be able to see envelopes (transactions) that they sent.
They can also see envelopes that were explicitly shared with them by another sender
Added: authenticate as a different person
Your API application sends envelopes by using the credentials of an account member. If this is a non-person such as "finance#yourCompany.com" then we call that a "system user."
Your question was how to send envelopes from a sender who is not an administrator. The answer is to authenticate to the DocuSign API as that person. This can be done with the OAuth JWT or Authorize Code grant flows.
Ask a new question if you have more questions on how to do this.
I have been using DocuSign SOAP Based API calls to create and send envelopes and am using legacy authentication method in which I can specify email address and password of the DocuSign user who is going to create envelopes.
One our client have multiple DocuSign account with the same user. When I setup an authentication header thru the SOAP based API call, I do not have a way to specify which account I am making API calls against.
How do I make sure that I am making API calls against the specific account?
You have two ways of accomplishing this.
1) You can make a getlogin call to retrieve a list of the logins associated with an account and use the default.
OR
2) Instead of supplying the email address for the user you can supply the API UserName in the login headers, which is a unique number for that user. This can be retrieved from the API and Keys or Users section if they're using the New DocuSign Experience, or through the user Permission section if still using Classic.
While the ApiUserName or email address is usually supplied in the authentication header, the ID for the account is in the XML body for the call. the combination of apiUserName and AccountId should be sufficient in picking a specific user, even if they have the same email address associated with multiple accounts.
When using the Docusign API (in my case, via the Sandbox/demo env), in the signing view at the top of the screen it displays the name & company of the user account that was used to authenticate with the API.
However, because this is embedded signing from my app, I would have thought we'd only have one user account - for the app. So I want to change what appears at the top there - the information on the sender of the envelope. Either to be the user account that exists in my app that created the envelope, or just to state what company sent the document.
Are there options on the API to do this? I can't see any reference to anything like this in the envelopeDefinition JSON structure in the REST API docs.
You can use the DocuSign SOBO - Send On Behalf Of Functionality
The Send On Behalf Of feature permits automated sending through the API by one account user on behalf of another account user.
More information here
A followup to a question answered here regarding changing the email address of a user via the REST API:
DocuSign REST API, change account's email address? (ie, the users login name)
If, instead, we created a second docusign user login with a new email address and wanted to move all envelopes from the old user to the new user, what is the most efficient way to do this? Both users would be under the same parent docusign account.
Currently, I do not see an endpoint to move an envelope between users.
Does this entail downloading all envelopes, and then sending on behalf of them all (from parent to child account) to put the documents into the newly created user's account?
Interestingly, I see that the error ENVELOPE_TRANSFEREE_ALREADY_OWNS_ENVELOPE is documented in the REST API guide (https://08d1d92f490618f41c65-8fb00e97ac499a7066a18ce9c66b019b.ssl.cf2.rackcdn.com/REST_API_Guide_v2.pdf), but yet the guide contains no obvious documentation of a related REST API operation (i.e., one that would enable you to transfer ownership of an envelope).
With the SOAP API, you can use the TransferEnvelope operation (page 178: https://10226ec94e53f4ca538f-0035e62ac0d194a46695a3b225d72cc8.ssl.cf2.rackcdn.com/soap-api-guide.pdf) to transfer an envelope from one user to another.
Based on the fact that "TransferEnvelope" is missing from this list of all SOAP API operations that are supported in the REST API, I'd suspect that Transferring Envelopes isn't (yet) supported via the REST API:
https://www.docusign.com/p/RESTAPIGuide/RESTAPIGuide.htm#Appendix/DocuSign API to REST API.htm
A 3rd party website is offering our service to their members. When they sign up, members have to agree to our contract. Currently this is handled manually, with envelopes being sent through email. We want to streamline this process allowing members to enter their information into the web site, and then immediately be presented with a contract to review and sign.
The 3rd party web site will collect the member information, then use the REST API to create a draft envelope based on a Template and information the the member enters on the website. The application will then display the contract in the web page so that the user can review and sign it. The document workflow will ensure that signed copies are routed to appropriate parties within our company via email for completion.
We want the 3rd party web site to have access to an account to which we can share templates. We want the 3rd party application to have very limited capabilities trhough the API:
Submit requests using a User ID and Integrator Key that we provide. These credentials need be different from other User Ids and Integrator Keys under our account
Create a draft envelope based on the templates we provide
Post a Recipient View allowing the application to display the document for review and siganture (in an IFrame)
Receive the signing status via the return URL provided in the Recipient View post
Possibly request status for an envelope
The external application should not have access to other templates, documents, or unnecessry API calls.
We want to be able to cancel the application's access at any time.
Question: Permissions and API Limitations
Is the above scenario feasible with respect to establishing limited access to the DocuSign REST API? How would we set this up?
Do account user permissions limit API use, if the API is enabled for the user? I found these settings in the user permissions section of the documentation. I can make guesses as to how to set them, but I need guidance on the actual implications of some settings.
Submit DocuSign API Requests: true
Manage Account: false
Send Envelope: true
Manage Templates: Use
DocuSign Desktop Client: false
Transfer Envelopes to User: false
Allow sender to set email language for recipients: false
I assume "Account-Wide Rights" should be false, but under that option in the documentation, it lists RequestStatus as one of calls covered. Will an application embedding the signing process still have sufficient permissions to complete the tasks listed above if "Account-Wide Rights" is false?
Are there other settings or issues I need to consider?
Firstly, thanks for using DocuSign. The answer to your question is in a few different parts. To clarify, I am answering assuming:
1.) You are a current customer (or about to be one) of DocuSign.
2.) You have a plan that is set up to allow integration (IE you aren't trying to do all of this with a personal plan, or something like that).
There are a couple of terms I will use... Sender and Recipient. In this scenario, the THird Party Website is "the sender" and they are Sending the documents through YOUR DocuSign account, using the API. The people who are signing up for your service are going to be Envelope Recipients.
Just like with the post office, someone has to send, and someone gets the envelope.
So far so good.
So what will happen is that the third party website will write some code that knows how to talk to the DocuSign API, and you will need to know:
-DocuSIgn Account ID (this is your DocuSign account)
-The Integrator Key (this is the key that you will need to certify before going live, which identifies all those API calls as coming from them)
-Credentials to access your account (this can be either the actual creds, or a token, etc).
Now, there are two ways to do it. You can either have the third party website make the and send all of the envelopes as if they all came from a single "user" in DocuSign (likely) or if you know that a particular user should send out things, you can do that too.
I am going to assume that all of the sign up packets will be sent as if they came from something like Signup#company.com.
So you will make sure you have a user in your DocuSIgn account with that Email address and name, and make sure that user has the ability to send via the API (there's a setting in DocuSign admin), and all envelopes will be sent as if that "person" sent them.
You will need the settings for that user (the one that will "send" all the envelopes), set as you showed above. You would need the Account Wide access if you wanted to send "on behalf of" a different user. But you aren't doing that, so you should be cool.
The last thing is that you will need to make sure you have an envelope based plan (as opposed to a seat based plan) because otherwise, that one mega-user will look suspicious (sending hundreds of envelopes in an automated fashion).
I hope this answers the question?
-Dan