Skip to main content
Technical Preview

Overview

Client-mode REST API connectors for DocuSign eSignature: send inspection reports, test certificates and permits for signature from MQTT, follow envelope and recipient status, read signed field values and download the signed PDF with its certificate of completion, authenticated with the OAuth 2.0 JWT grant; a server-mode companion connector receives DocuSign Connect webhooks. This is one of the templates in the DocuSign eSignature REST API app (docusign-esignature). Deploy it alongside the other connectors of that app when they depend on each other (for example a token connector plus an API connector).

Auth

  • schemes: [“JwtToken: POST /oauth/token on DocuSignOAuth, form body grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer (baked in) + assertion (JWT RS256 signed outside the broker with the integration key’s RSA private key; claims iss = integration key, sub = user ID GUID, aud = account-d.docusign.com / account.docusign.com without https://, iat, exp <= 1 h, scope ‘signature impersonation’); returns access_token, Bearer, expires_in 3600, no refresh token”, “UserInfo: GET /oauth/userinfo with Bearer -> accounts[].account_id + base_uri (sets BASE_ADDRESS and account_id)”, “Authorization: Bearer {value.json.access_token} on every eSignature event except ServiceInformation (no auth)”, “One-time consent (browser): https://account-d.docusign.com/oauth/auth?response_type=code&scope=signature%20impersonation&client_id=<key>&redirect_uri=<uri>, or organization admin consent”, “Authorization Code grant and the legacy X-DocuSign-Authentication header not packaged”]
  • secrets: [“DOCUSIGN_INTEGRATION_KEY”, “DOCUSIGN_USER_ID”, “DOCUSIGN_PRIVATE_KEY (for the external JWT signer only; never in the broker connector)”, “DOCUSIGN_ACCESS_TOKEN (optional, current token)”, “DOCUSIGN_ACCOUNT_ID”]
  • permissions: The token acts as the impersonated user (permission profile must allow sending envelopes; Connect reads need account admin).
  • note: Inject secrets with a LoT action (GET SECRET); never retain topics that carry a JWT or token; restrict finance/docusign-esignature/auth/# with ACLs. LoT cannot sign RS256, so a signer service publishes the JWT.
Auth headers used by the template: Authorization: Bearer {value.json.access_token}.

Template parameters

BASE_ADDRESS default: https://YOUR_BASE_URI.

Events

Deploy

Get the template card (JSON with template and metadata) from the broker, then deploy the connector:
The deployable connector from the REST API app, with BASE_ADDRESS already filled in:
Deploy it with -addConnector (do not include ADD METADATA).

Usage example

Call ServiceInformation by publishing a JSON payload to its request topic, and read the reply on the response topic:
Last modified on October 26, 2026