Docu Sign OAuth

Beta

Beta. This REST API app template is beta. Hub metadata sets WITH STATUS "beta". The deployable .lot file does not include ADD METADATA.

Overview

Client-mode REST API connectors for DocuSign eSignature: send inspection reports, test certificates and permits for signature from MQTT, follow envelope and recipient status, read signed field values and download the signed PDF with its certificate of completion, authenticated with the OAuth 2.0 JWT grant; a server-mode companion connector receives DocuSign Connect webhooks. This is one of the templates in the DocuSign eSignature REST API app (docusign-esignature). Deploy it alongside the other connectors of that app when they depend on each other (for example a token connector plus an API connector).

Not yet verified against the live vendor API: No DocuSign developer account, integration key, RSA keypair or consented user, so no authenticated live HTTP call or broker round-trip could run. Keyless probes of demo.docusign.net, www.docusign.net, account-d.docusign.com and account.docusign.com (27/27) confirmed the hosts, the /restapi/v2.1 paths and the documented OAuth and eSignature error shapes (service_information 200; /oauth/token 400 invalid_grant user_not_found / issuer_not_found / unsupported_grant_type; userinfo 400 / 401; 401 PARTNER_AUTHENTICATION_FAILED without a token and 401 AUTHORIZATION_INVALID_TOKEN with a bad token on every packaged path). Static 411/411, spec 150/150, examples 141/141, mock 38/38, controls 69/69 and connect 7/7 pass; lot_lint ok. Lint and keyless probes do not clear the ready gate.

Auth

schemes: [“JwtToken: POST /oauth/token on DocuSignOAuth, form body grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer (baked in) + assertion (JWT RS256 signed outside the broker with the integration key’s RSA private key; claims iss = integration key, sub = user ID GUID, aud = account-d.docusign.com / account.docusign.com without https://, iat, exp <= 1 h, scope ‘signature impersonation’); returns access_token, Bearer, expires_in 3600, no refresh token”, “UserInfo: GET /oauth/userinfo with Bearer -> accounts[].account_id + base_uri (sets BASE_ADDRESS and account_id)”, “Authorization: Bearer {value.json.access_token} on every eSignature event except ServiceInformation (no auth)”, “One-time consent (browser): https://account-d.docusign.com/oauth/auth?response_type=code&scope=signature%20impersonation&client_id=<key>&redirect_uri=<uri>, or organization admin consent”, “Authorization Code grant and the legacy X-DocuSign-Authentication header not packaged”]
secrets: [“DOCUSIGN_INTEGRATION_KEY”, “DOCUSIGN_USER_ID”, “DOCUSIGN_PRIVATE_KEY (for the external JWT signer only; never in the broker connector)”, “DOCUSIGN_ACCESS_TOKEN (optional, current token)”, “DOCUSIGN_ACCOUNT_ID”]
permissions: The token acts as the impersonated user (permission profile must allow sending envelopes; Connect reads need account admin).
note: Inject secrets with a LoT action (GET SECRET); never retain topics that carry a JWT or token; restrict finance/docusign-esignature/auth/# with ACLs. LoT cannot sign RS256, so a signer service publishes the JWT.

Auth headers used by the template: Authorization: Bearer {value.json.access_token}.

Template parameters

Placeholder	Type	Description	Required
`RouteName`	string	Name of the Docu Sign OAuth connector	no
`BaseUrl`	string	Docu Sign OAuth base URL without trailing slash (e.g. https://account-d.docusign.com)	yes

BASE_ADDRESS default: https://account-d.docusign.com.

Events

Event	Method	Endpoint	Request topic	Response topic	Payload fields
`JwtToken`	POST	`/oauth/token`	`finance/docusign-esignature/auth/token`	`finance/docusign-esignature/auth/token/response`	`assertion`
`UserInfo`	GET	`/oauth/userinfo`	`finance/docusign-esignature/auth/userinfo`	`finance/docusign-esignature/auth/userinfo/response`	`access_token`

Deploy

Get the template card (JSON with template and metadata) from the broker, then deploy the connector:

mosquitto_pub -t '$SYS/Coreflux/Command' -m "-routeCode DOCU_SIGN_OAUTH"

The deployable connector from the REST API app, with BASE_ADDRESS already filled in:

DEFINE ROUTE DocuSignOAuth WITH TYPE REST_API
    ADD REST_API_CONFIG
        WITH BASE_ADDRESS "https://account-d.docusign.com"
        WITH ENABLE_CLIENT "true"
        WITH USE_SSL "true"
        WITH REQUEST_TIMEOUT '60'
        WITH DEFAULT_CONTENT_TYPE "application/json"
    ADD EVENT JwtToken
        WITH SOURCE_TOPIC "finance/docusign-esignature/auth/token"
        WITH DESTINATION_TOPIC "finance/docusign-esignature/auth/token/response"
        WITH METHOD "POST"
        WITH ENDPOINT "/oauth/token"
        WITH HEADERS
            ADD "Accept" "application/json"
            ADD "User-Agent" "Coreflux-Broker REST_API route (https://www.coreflux.org)"
            ADD "Content-Type" "application/x-www-form-urlencoded"
        WITH BODY "grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion={value.json.assertion}"
    ADD EVENT UserInfo
        WITH SOURCE_TOPIC "finance/docusign-esignature/auth/userinfo"
        WITH DESTINATION_TOPIC "finance/docusign-esignature/auth/userinfo/response"
        WITH METHOD "GET"
        WITH ENDPOINT "/oauth/userinfo"
        WITH HEADERS
            ADD "Accept" "application/json"
            ADD "User-Agent" "Coreflux-Broker REST_API route (https://www.coreflux.org)"
            ADD "Authorization" "Bearer {value.json.access_token}"

Deploy it with -addRoute (do not include ADD METADATA).

Usage example

Call JwtToken by publishing a JSON payload to its request topic, and read the reply on the response topic:

mosquitto_sub -t 'finance/docusign-esignature/auth/token/response' &
mosquitto_pub -t 'finance/docusign-esignature/auth/token' -m '{"assertion": "<assertion>"}'

Quick Start

Coreflux MQTT Broker

LoT Language

Coreflux HUB

VS Code - LoT Notebooks

Coreflux Portal

Using AI with Coreflux

Product Updates

Overview

Auth

Template parameters

Events

Deploy

Usage example

​Overview

​Auth

​Template parameters

​Events

​Deploy

​Usage example

​Related

Overview

Auth

Template parameters

Events

Deploy

Usage example

Related