Getting invalid user permissions through DocuSign API

Question

I am attempting to use the DocuSign API and my master account to send on behalf of a sub user but I am getting the following error message:

HTTP/1.1 401 Unauthorized
Cache-Control: no-cache
Content-Length: 126
Content-Type: application/json; charset=utf-8
Date: Mon, 14 Jul 2014 08:00:13 GMT
Strict-Transport-Security: max-age=7776000; includeSubDomains

{
  "errorCode": "USER_LACKS_PERMISSIONS",
  "message": "This user lacks sufficient permissions to access this resource."
}

The code I am using is:

POST https://demo.docusign.net/restapi/v2/accounts/651932/envelopes HTTP/1.1
Content-Type: multipart/form-data; boundary=COMPANYBOUNDARY
Accept: application/json
Authorization: bearer ijj3DH7YYT4MH9mDh7HO/AYCltk=
X-DocuSign-Act-As-User: [email protected]
Host: demo.docusign.net
Content-Length: 13047
Expect: 100-continue
Connection: Keep-Alive

--COMPANYBOUNDARY
Content-Type: application/json
Content-Disposition: form-data

{"Status":"sent","emailBlurb":"Test e-mail body","emailSubject":"asd","documents":[{"name":"Test Document with ID.docx","documentId":1,"order":1}],"recipients":{"signers":[{"email":"[email protected]","name":"Dave","recipientId":0,"tabs":{"signHereTabs":[{"anchorString":"/customer/","anchorIgnoreIfNotPresent":false}]}}]}}
--COMPANYBOUNDARY
Content-Type: application/vnd.openxmlformats-officedocument.wordprocessingml.document
Content-Disposition: file; filename="Test Document with ID.docx"; documentid="1"

*byteshere*
--COMPANYBOUNDARY—

We have tried connecting to the online console with the sub user and have successfully sent an envelope, so the permissions for sending envelopes is correctly set.

The master account has "sent on behalf" permissions set to true as well:

permissions

Any help on how to sort this out would be greatly appreciated.

I just ran through my account mimicking this flow and only got errors in two situations but these don't seem to apply: 1) When the Authenticating User didn't have SOBO; and 2) when the Operating User didn't have send permission. I suspect something else is going on. Can you ensure the user "joffery@company" exists and is active? — Jeff Kyllo
Thanks for the comment. As I have stated: "We have tried connecting to the online console with the sub user and have successfully sent an envelope, so the permissions for sending envelopes is correctly set". So, yes. [email protected] exists and is active. Any other suggestion? Thanks a lot — aleafonso

Jeff Kyllo Jeff Kyllo · Accepted Answer · 2014-07-14T11:33:33

After further testing, I've confirmed that the operating user need not be identified in the X-DocuSign-Act-As-User header when the authorization token belongs to that user. Doing so when the user lacks SOBO permission will cause this 401 error even if the X-DocuSign-Act-As-User is set to the same user.

Getting invalid user permissions through DocuSign API

1 Answers