Bad request when calling DocuSign API for JWT user token. Consent?

0
votes

I'm using the DocuSign API to request a JWT user token:

with open('docusign.pem', mode='rb') as privatefile:
    private_key_bytes = privatefile.read()
api_client = ApiClient()
oauth_host_name = 'account-d.docusign.com'
# not real, random:
client_id = 'dff16ff1-de93-477d-a73d-3774ac9932dc'
user_id = '7401f22e-ff2c-4777-9117-5932ace2e71a'
expires_in = 3600
result = api_client.request_jwt_user_token(client_id, user_id,
                                       oauth_host_name,
                                       private_key_bytes,
                                       expires_in,
                                       scopes=(OAuth.SCOPE_SIGNATURE,))

This returns:

(400)
Reason: Bad Request
HTTP response headers: HTTPHeaderDict({'Cache-Control': 'no-cache', 'Pragma': 'no-cache',
'Content-Type': 'application/json; charset=utf-8', 'Expires': '-1', 'Server':
'Microsoft-IIS/10.0', 'X-AspNetMvc-Version': '5.2', 'X-DocuSign-TraceToken':
'c1d090b7-cefd-4881-80c6-3f1c55ccc5b4', 'X-Content-Type-Options': 'nosniff',
'Strict-Transport-Security': 'max-age=31536000; includeSubDomains; preload,
max-age=15768000', 'X-Frame-Options': 'SAMEORIGIN', 'X-XSS-Protection': '1; mode=block;
report=/client-errors/xss', 'X-DocuSign-Node': 'DA2DFE179', 'Date':
'Sun, 23 Aug 2020 15:18:46 GMT', 'Content-Length': '28'})
HTTP response body: b'{"error":"consent_required"}'

So how to obtain "consent". This page has two sections "Admin consent for internal applications" and "Admin consent for external applications":

DocuSign obtaining consent

I'm not sure how to get consent in the sandbox. It already say "DS Admin" under "permission profile" for the user in DocuSign.

Update

I used the second technique "Admin consent for internal applications" to obtain consent with the settings:

admin_consent_scope=impersonation
response_type=code
scope=openid

And instead of the login I got the message at the DocuSign website: "You are not an organization admin. Please contact your DocuSign Administrator."

How do I ask DocuSign to enable this feature on my developer account?

2
pythonpython-3.xdocusignapi

2 Answers

0
votes

See this blog post on granting consent.

Note that the user being impersonated needs to consent to both the signature scope (if you're using the eSignature features), and the impersonation scope.

For individual consent, the two scopes are separated by a space which should be entered as %20, the encoded value.

Example:

https://account-d.docusign.com/oauth/auth?
response_type=code
&scope=signature%20impersonation
&client_id=YOUR_INTEGRATION_KEY
0
votes

To use admin consent you must have an organization. This requires you to register a domain name and confirm it with DNS records. While this is the recommended approach, it's a bit more complex. I would consider using individual consent to get you unblocked for now. To do that, you just construct a URL like this one:

https://account-d.docusign.com/oauth/auth?
response_type=code
&scope=YOUR_REQUESTED_SCOPES
&client_id=YOUR_INTEGRATION_KEY
&redirect_uri=YOUR_REDIRECT_URI

And proceed to agree and just ignore the code you get back. After that you can use JWT to obtain a token. &redirect_uri=YOUR_REDIRECT_URI