> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# DocuSign

Oleria provides identity security and access management teams with visibility and intelligence into who has access to what, where they got that access, how they use it, and whether they should even have it. As part of that promise, we deeply integrate your DocuSign environment into the Oleria platform. This document provides step-by-step guidance for integrating DocuSign with your Oleria workspace.

A single Oleria connection covers your **entire DocuSign organization** - Oleria discovers every account the connection can reach and inventories each one.

## Prerequisites

* A **DocuSign organization** with organization administration enabled (DocuSign Admin). One account can belong to only one organization; an organization can contain many accounts.
* An **organization administrator** who can register an integration key, grant admin consent, and identify the admin user Oleria will act as.
* An **impersonated admin user** - an existing DocuSign user whose permission profile grants account administration. Oleria acts as this user for both reads and remediation. A dedicated service user is recommended over an employee account.

<Note>Use a service account (not an employee account) for the integration to ensure continuity. The impersonated user's permission profile must grant account administration for remediation actions to be available.</Note>

## What Oleria collects

| Area               | Detail                                                                                                                                                                                      |
| :----------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Users**          | Organization users (DocuSign Admin API) plus per-account users (eSignature API). Users in an account but not in the org directory are flagged as **shadow users**.                          |
| **Groups & Roles** | DocuSign groups and permission profiles (as Roles) with per-account membership.                                                                                                             |
| **Resources**      | Templates and folders per account, plus who has access to each (direct user grants and group grants) and folder containment. Envelopes are transactional documents and are not inventoried. |
| **Delegation**     | Send-on-behalf-of (SOBO) grants - who can act as whom.                                                                                                                                      |
| **Activity**       | Security events from DocuSign Monitor. Requires the Monitor add-on; all other data is unaffected if absent.                                                                                 |
| **Risk signals**   | Admins without single sign-on (SSO), non-human identity (NHI) admins, shadow users, and users without SSO configuration.                                                                    |

## Set up the integration

DocuSign authentication uses **JWT Grant** with an RSA key pair. You register an app (integration key) in DocuSign, grant it consent to act on behalf of your admin user, and provide the credentials to Oleria.

<Steps>
  <Step title="Create an integration key">
    1. Log in to DocuSign and go to **Settings** → **Apps and Keys** (requires organization or account admin).

    2. Select **Add App and Integration Key**, give the app a name (e.g. `Oleria`), and select **Create App**.

    3. Copy the **Integration Key** (the app's client ID) - you will enter this in Oleria.
  </Step>

  <Step title="Generate an RSA key pair and add a redirect URI">
    1. In the app, under **Service Integration**, select **Generate RSA**.

    2. **Save the private key** immediately and securely - DocuSign displays it only once. You will paste it into Oleria.

    3. Under **Additional Settings** → **Redirect URLs**, select **Add URI** and enter:

    ```
    https://www.docusign.com
    ```

    Select **Save**. This redirect URI is required for the one-time admin consent step - you do not need to handle the callback. **CORS settings and HTTP methods are not required** and can be left blank.

    <Warning>If you lose the private key, you must generate a new RSA key pair. The existing key cannot be recovered.</Warning>
  </Step>

  <Step title="Grant admin consent">
    The integration key must be consented to impersonate users with the scopes Oleria needs. Before opening either URL below, replace `YOUR_INTEGRATION_KEY` with the integration key from Step 1. Then open the consent URL in a browser, signed in as an **organization administrator**, and approve.

    **Production:**

    ```
    https://account.docusign.com/oauth/auth?response_type=code&scope=signature%20impersonation%20organization_read%20account_read%20user_read%20permission_read%20group_read&client_id=YOUR_INTEGRATION_KEY&redirect_uri=https://www.docusign.com
    ```

    **Demo (developer sandbox):**

    ```
    https://account-d.docusign.com/oauth/auth?response_type=code&scope=signature%20impersonation%20organization_read%20account_read%20user_read%20permission_read%20group_read&client_id=YOUR_INTEGRATION_KEY&redirect_uri=https://www.docusign.com
    ```

    This is a one-time grant for the entire organization.

    <Note>After approving, DocuSign redirects to `www.docusign.com` - this is expected. Consent is recorded even if the redirect shows an error page.</Note>
  </Step>

  <Step title="Identify the impersonated user">
    1. In DocuSign Admin, go to **Users** and open the admin user Oleria should act as.

    2. Copy the user's **API Username** - a GUID in the format `bd75353b-52ed-44c6-b408-829fc56f4664`. This is the **Impersonated User GUID**.

    3. Confirm this user's permission profile grants **account administration** (required for remediation actions - see [Permissions for remediation](#permissions-for-remediation-optional) below).
  </Step>
</Steps>

## Connect DocuSign to Oleria

<Steps>
  <Step title="Open the integration">
    Log in to your Oleria workspace and navigate to **Integrations** → **DocuSign** → **Connect**.
  </Step>

  <Step title="Provide your credentials">
    Provide the following and select **Authenticate**:

    | Field                      | Value                                     |
    | :------------------------- | :---------------------------------------- |
    | **Integration Key**        | The integration key from Step 1           |
    | **RSA Private Key**        | The PEM private key from Step 2           |
    | **Impersonated User GUID** | The admin user's API Username from Step 4 |
    | **Environment**            | `production` or `demo`                    |
  </Step>

  <Step title="Complete the connection">
    Oleria validates the connection, discovers your DocuSign accounts, and begins the first sync.
  </Step>
</Steps>

## Verify the integration

Confirm DocuSign appears in your Oleria workspace connected integrations. After the first sync completes, you can review the discovered users, groups, permission profiles, and access in your Oleria workspace.

## Permissions for remediation (optional)

Read-only inventory requires only the read scopes granted in Step 3. To run **remediation actions**, the impersonated user's permission profile must authorize the relevant writes.

| Action                                    | Required Permission                                    |
| :---------------------------------------- | :----------------------------------------------------- |
| Disable / Enable user                     | Account administration or Manage Users                 |
| Assign / Remove role (permission profile) | Account administration or Manage Users                 |
| Add / Remove from group                   | Account administration, Manage Users, or Manage Groups |

Oleria checks these permissions before offering an action - an under-privileged connection shows the action as unavailable rather than failing mid-run.

### Supported remediation actions

* **Disable / Enable user** - closes or reactivates the user's membership across **every account** they belong to in the organization. Reactivation sends the user a DocuSign activation email, which they must click to become fully active.
* **Add / Remove from group** - targets the specific group you selected in its owning account. Does not affect same-named groups in other accounts.
* **Assign / Remove role** - changes the user's permission profile in the account that owns that role.

## Notes and limitations

* **Multi-account:** one connection manages the entire organization. Disable/enable is organization-wide by design - a user is closed in each account they belong to. Per-account-only disable is not currently supported.
* **Activity** requires the DocuSign Monitor add-on. Without it, activity data is empty; all other data remains unaffected.
* **Resources:** templates and folders are treated as durable, ACL-governed resources and are inventoried with their access grants. DocuSign envelopes are transactional documents and are not inventoried.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).