Docusign

You can connect Docusign to Opal to manage and review access to your Docusign users, groups, and permission profiles.

​

Supported resources

With Opal’s Docusign integration:

• Users can request time-bound access to Docusign groups and permission profiles, and have it granted automatically on approval.
• Admins can sync users, groups, and permission profiles into Opal; provision and deprovision Docusign users; manage group membership; and assign the permission profile that governs what a user can do.
• Reviewers can run periodic access reviews over Docusign access and revoke anything that is no longer needed.

Opal grants and revokes access as follows:

• Groups — granting adds the user to the Docusign group; revoking removes them.
• Permission profiles — a Docusign user always has exactly one permission profile. Granting assigns the user to the requested profile. Revoking reassigns the user to the connection’s default permission profile. See Set the default permission profile.
• Users — provisioning creates the Docusign user; deprovisioning closes it.

​

Requirements

Before you begin, you must:

• Be an Opal Admin.
• Have a Docusign account that belongs to a Docusign Organization (organization-managed). Opal provisions users through the Docusign Admin API, which is only available to org-managed accounts.
• Have a Docusign user who is an organization administrator. Opal impersonates this user, and organization administrator is a stronger role than account admin — the connection cannot be created without it.
• Be able to create an integration key (app) in Docusign, generate an RSA keypair for it, and grant it one-time consent.

​

1. Create a Docusign integration key

In Docusign, go to Admin > Settings > Apps and Keys, then:

1. Create an integration key. This is your client ID. For more detail, see Docusign’s JWT Grant documentation.
2. On the integration key, click Generate RSA. Docusign keeps the public key and shows the private key once — copy it, because you paste it into Opal. Opal never needs the public key.
3. Add https://www.docusign.com as a redirect URI on the integration key.
4. Note the User ID of the organization administrator that Opal impersonates, found under My Account Information > User ID. Note your API Account ID on the same screen if you want to pin the connection to a specific account.

​

2. Create the Docusign app in Opal

In Opal, go to Inventory > +App and select Docusign.

​

3. Configure the connection in Opal

In the Opal create form, enter:

​

4. Grant consent

JWT Grant requires the impersonated user to approve the integration key once. In the Opal form, once the required fields are filled in, click Open the Docusign consent page, sign in as the impersonated user, and click Accept. Consent is persistent, so you only do this once.

​

5. Test the connection and create the app

Click Test connection. Opal verifies that it can read your directory and that the impersonated user is a Docusign organization administrator. When the check passes, the Create button is enabled. Editing any credential after a successful test re-runs the check. After you save the app, you can import your Docusign users, groups, and permission profiles from … > Import items.

​

Additional information

​

Set the default permission profile

Because a Docusign user always has exactly one permission profile, Opal cannot simply remove one on revoke — it reassigns the user to a default permission profile that you choose. If this isn’t set, permission profile revokes fail with a message asking you to configure one, so set it before you start managing permission profile access. To set the default permission profile:

1. Import your permission profiles first. The default is chosen from profiles Opal has already synced, so the dropdown is empty until an import has run. Open the connection in Inventory, then import (or wait for the first sync) so its permission profiles appear in Opal.
2. Open the Docusign connection in Inventory and go to its settings.
3. Click Edit. The Default permission profile field is read-only until you do.
4. In the Default permission profile dropdown, pick the profile that users should fall back to when their access to another permission profile is revoked. The dropdown is searchable and shows up to 100 synced profiles.
5. Save the connection settings.

Choose a low-privilege profile, such as a basic sender or viewer profile, so that a revoke lands users in a least-privilege state rather than leaving them with anything elevated. You can change the default at any time from the same screen.

​

Silent activation vs. activation emails

Opal provisions users silently, with no activation email, when the user’s email domain is a verified reserved domain in your Docusign Organization. Users whose email domain is not verified are created through Docusign’s standard activation email flow instead.

---