Authentication

Before your application can make calls to the Monitor API, it must authenticate and obtain an access token. You must submit this access token, which proves your app’s identity and authorization, with each request.

To get an access token with the appropriate credentials to make calls to the Monitor API, you must use JWT Grant. This is because:

The JWT Grant is the only OAuth2 Grant that enables you to impersonate a consenting user when making API calls, and
To obtain tracking data for your organization, the caller must be impersonating either an Organization Administrator or a Security Reports Administrator, and must not be administrator in any other organization. For information about permission profiles, see Docusign Admin permission profiles in Organization Administrators.

The process to authenticate to use the Monitor API is identical to the process for calling the eSignature REST API using the JWT Grant, with the following exceptions:

When you obtain consent to impersonate a user to make calls on their behalf, you must impersonate a user with the Organization Administrator or a Security Reports Administrator role for your organization. The User ID of this user will be included in the sub property of the body of the JWT.
The scopes that you request in the body of the JWT must include signature and impersonation. See Authentication scopes for the full list of scopes.

See How to get an access token with JWT Grant for a walkthrough of getting an access token using JWT Grant.

{
    "alg": "RS256",
    "typ": "JWT"
}

Next steps

See How to get an access token with JWT Grant for a walkthrough of getting an access token using JWT Grant.
Learn about Tracking data and handling alerts.
See How to get monitoring data.