Overview
Client-mode REST API connectors for DocuSign eSignature: send inspection reports, test certificates and permits for signature from MQTT, follow envelope and recipient status, read signed field values and download the signed PDF with its certificate of completion, authenticated with the OAuth 2.0 JWT grant; a server-mode companion connector receives DocuSign Connect webhooks. This is one of the templates in the DocuSign eSignature REST API app (docusign-esignature). Deploy it alongside the other connectors of that app when they depend on each other (for example a token connector plus an API connector).
Not yet verified against the live vendor API: No DocuSign developer account, integration key, RSA keypair or consented user, so no authenticated live HTTP call or broker round-trip could run. Keyless probes of demo.docusign.net, www.docusign.net, account-d.docusign.com and account.docusign.com (27/27) confirmed the hosts, the /restapi/v2.1 paths and the documented OAuth and eSignature error shapes (service_information 200; /oauth/token 400 invalid_grant user_not_found / issuer_not_found / unsupported_grant_type; userinfo 400 / 401; 401 PARTNER_AUTHENTICATION_FAILED without a token and 401 AUTHORIZATION_INVALID_TOKEN with a bad token on every packaged path). Static 411/411, spec 150/150, examples 141/141, mock 38/38, controls 69/69 and connect 7/7 pass; lot_lint ok. Lint and keyless probes do not clear the ready gate.
Auth
- schemes: [“JwtToken: POST /oauth/token on DocuSignOAuth, form body grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer (baked in) + assertion (JWT RS256 signed outside the broker with the integration key’s RSA private key; claims iss = integration key, sub = user ID GUID, aud = account-d.docusign.com / account.docusign.com without https://, iat, exp <= 1 h, scope ‘signature impersonation’); returns access_token, Bearer, expires_in 3600, no refresh token”, “UserInfo: GET /oauth/userinfo with Bearer -> accounts[].account_id + base_uri (sets BASE_ADDRESS and account_id)”, “Authorization: Bearer {value.json.access_token} on every eSignature event except ServiceInformation (no auth)”, “One-time consent (browser): https://account-d.docusign.com/oauth/auth?response_type=code&scope=signature%20impersonation&client_id=<key>&redirect_uri=<uri>, or organization admin consent”, “Authorization Code grant and the legacy X-DocuSign-Authentication header not packaged”]
- secrets: [“DOCUSIGN_INTEGRATION_KEY”, “DOCUSIGN_USER_ID”, “DOCUSIGN_PRIVATE_KEY (for the external JWT signer only; never in the broker connector)”, “DOCUSIGN_ACCESS_TOKEN (optional, current token)”, “DOCUSIGN_ACCOUNT_ID”]
- permissions: The token acts as the impersonated user (permission profile must allow sending envelopes; Connect reads need account admin).
- note: Inject secrets with a LoT action (GET SECRET); never retain topics that carry a JWT or token; restrict finance/docusign-esignature/auth/# with ACLs. LoT cannot sign RS256, so a signer service publishes the JWT.
Authorization: Bearer {value.json.access_token}.
Template parameters
BASE_ADDRESS default: https://YOUR_BASE_URI.
Events
Deploy
Get the template card (JSON withtemplate and metadata) from the broker, then deploy the connector:
BASE_ADDRESS already filled in:
-addRoute (do not include ADD METADATA).
Usage example
CallServiceInformation by publishing a JSON payload to its request topic, and read the reply on the response topic:

