List envelopes in the account changed since a given date (status, recipients, subject). (docs)
GET /restapi/v2.1/accounts/{accountId}/envelopes
🟢 low
— no
Get the status and metadata of a single envelope by id. (docs)
GET /restapi/v2.1/accounts/{accountId}/envelopes/{envelopeId}
🟢 low
— no
What the agent can do
Capability
API call
Risk
Needs approval
Create and send an envelope for signature (status=sent) — a document, signer email/name, and a signHere tab. (docs)
POST /restapi/v2.1/accounts/{accountId}/envelopes
🔴 high
✅ yes
Void an in-process (sent) envelope with a reason (status=voided). (docs)
PUT /restapi/v2.1/accounts/{accountId}/envelopes/{envelopeId}
🔴 high
✅ yes
Connecting it
You provide: DocuSign account (OAuth)
Where to get it: In your DocuSign Developer account: Settings → Apps and Keys → Add App and Integration Key → under Authentication add a secret key (Confidential) and a Redirect URI, and use the Authorization Code Grant flow. Customers connect via the OAuth web flow against account-d.docusign.com (demo) / account.docusign.com (production); after the token exchange we call GET /oauth/userinfo to obtain the account_id and base_uri (the regional API host) that every REST call must target.
Permissions/scopes:signature, extended
Account setup
Account needed: A DocuSign Developer (demo) account — free at https://developers.docusign.com — and, for live use, a production DocuSign eSignature plan with API access.
App registration: OAuth: Settings → Apps and Keys → add an Integration Key (client id) → add a secret key (Confidential) and a Redirect URI → use Authorization Code Grant with scopes 'signature extended'. After the token exchange, GET /oauth/userinfo returns the account_id and base_uri that all REST calls target.
Verification required: An app built in the demo environment must pass DocuSign's Go-Live review (a 20-call API request-signature check) before it can be promoted to production. The same Integration Key is then enabled on the production account; no code change beyond pointing OAuth + base_uri at the production hosts.
Testing: Build and test against the demo environment (account-d.docusign.com for OAuth; demo.docusign.net base_uri) at no cost before Go-Live promotion.
Limits
Per-account hourly API request limit (default 1,000 requests/hour on many accounts; viewable via the X-RateLimit-Limit response header). A 30-second burst limit also applies (max ~200 calls in the demo environment, ~500 in production). On exceed DocuSign returns HTTP 429 Too Many Requests with X-RateLimit-Reset (epoch seconds) indicating when the window refreshes. Docs: https://developers.docusign.com/docs/esign-rest-api/esign101/rules-and-limits/