Authentication scopes | Docusign

The Docusign platform defines the following scopes. Each scope is required to perform a set of actions associated with its originating API.

Scope name	Originating API	Description
`impersonation`	N/A	Required for applications that impersonate users to perform API calls. Used in JWT Grant authentication.
`extended`	N/A	Used when requesting an access token using Authorization Code Grant. If you request the `extended` scope using Authorization Code Grant, a new refresh token is issued with a full lifetime (typically 30 days). Otherwise, the issued refresh token will have the same expiration date as the original token (typically 30 days from the first login).
`signature`	eSignature REST API	Required to call most eSignature REST API endpoints
`openid`	eSignature REST API	Enables you to grant consent to an external app on behalf of your users. See Obtain and revoke consent for details.
`cors`	eSignature REST API	Required for single-page applications (SPAs) and other browser-based applications that send eSignature API requests directly from scripts running in a browser. See Single-page applications and CORS for details.
`click.manage`	Click API	Enables all elastic template operations, including creating, sending, and updating elastic templates; getting a list of elastic templates, creating user agreements, getting a list of users, and retrieving responses
`click.send`	Click API	Required to send a new elastic template or check for a previously sent one
`content`	CLM API	Read and write access to CLM document content
`spring_read`	CLM API	Read access to all types of CLM objects
`spring_write`	CLM API	Write access to all types of CLM objects
`adm_store_unified_repo_read`	Connected Fields API overview and Agreement Manager API	Required to read agreement data from the Navigator and Connected Fields APIs.
`organization_read`	Docusign Admin API	Required to get lists of organizations and organization data
`group_read`	Docusign Admin API	Required to get lists of groups associated with an account
`permission_read`	Docusign Admin API	Required to get lists of permission profiles associated with an account
`user_read`	Docusign Admin API	Required to read user data
`user_write`	Docusign Admin API	Required to update, create, or delete users
`account_read`	Docusign Admin API	Required to get account data
`domain_read`	Docusign Admin API	Required to get data on claimed domains for the organization
`identity_provider_read`	Docusign Admin API	Required to get data on already-defined identity providers for an organization
`user_data_redact`	Docusign Admin API	Deletes personal data for closed user accounts
`asset_group_account_read`	Docusign Admin API	Gets a list of organization accounts that indicates which accounts are eligible to be cloned
`asset_group_account_clone_write`	Docusign Admin API	Initiates an account cloning process
`asset_group_account_clone_read`	Docusign Admin API	Gets status and results for account cloning processes
`connect_org_config_read_api`	Docusign Admin API	Reads data for an Organization-Level Connect configuration
`connect_org_config_write_api`	Docusign Admin API	Writes data for an Organization-Level Connect configuration
`connect_org_oauth_read_api`	Docusign Admin API	Reads data for your Organization-Level Connect configuration OAuth settings
`connect_org_oauth_write_api`	Docusign Admin API	Writes data for your Organization-Level Connect configuration OAuth settings
`connect_org_hmac_read_api`	Docusign Admin API	Read a list of the HMAC keys for your organization
`connect_org_hmac_write_api`	Docusign Admin API	Create new HMAC keys for your organization
`dtr.rooms.read`	Rooms API and Workspaces API	Read Docusign room or workspace data
`dtr.rooms.write`	Rooms API and Workspaces API	Update the data of a Docusign room or workspace
`dtr.documents.read`	Rooms API	Read documents from Docusign rooms
`dtr.documents.write`	Rooms API and Workspaces API	Write documents to Docusign rooms or workspaces
`dtr.profile.read`	Rooms API	Read profile data for accounts or signers associated with your company
`dtr.profile.write`	Rooms API	Write profile data to accounts or signers associated with your company
`dtr.company.read`	Rooms API	Read information from all rooms and profiles associated with your company
`dtr.company.write`	Rooms API	Write information to all rooms and profiles associated with your company
`room_forms`	Rooms API	Use endpoints related to the Forms feature
`aow_manage`	Workflow Builder API	Required for every Maestro API call.
`notary_write`	Notary API	Required to update Notary API data
`notary_read`	Notary API	Required to read Notary API data
`webforms_read`	Web Forms API	Required to retrieve information about web form configurations defined in an account
`webforms_instance_read`	Web Forms API	Required to retrieve information about web form instances
`webforms_instance_write`	Web Forms API	Required to create web form instances and refresh instance tokens
`adm_store_unified_repo_read`	Agreement Manager API	Required for getting agreement data from Navigator API
`models_read`	Agreement Manager API	Used to the read model schema. Not currently required for any Navigator API endpoint methods, but it should be requested by apps making Navigator API calls to support forward-compatibility, as a best practice.
`document_uploader_read`	Agreement Manager API	Required for reading documents when uploading with Navigator API calls
`document_uploader_write`	Agreement Manager API	Required for updating documents when uploading with Navigator API calls

Next steps

Learn more about Authenticate on the Docusign platform.
See examples of how to obtain an access token using the Authorization Code Grant, Implicit Grant, and JWT Grant, including example syntax showing how scopes are used.
Learn about options for obtaining and revoking consent.