This release adds support for version v2.1-26.3.01.02 of the Docusign eSignature API. It includes new envelope sharing methods to update or delete shares on an envelope, update or delete a single share by its ID, and retrieve a filtered list of shared envelopes. It also adds prefilled tabs for bulk sending, new account settings properties, and the AnchorTabScope property across all tab model types.

• Raised minimum PHP version: The SDK now requires PHP ~8.2.35, ~8.3.36, ~8.4.27, or >=8.5.12 (previously 7.4) to address security vulnerabilities CVE-2026-109618 and CVE-2026-109619.
• Replaced JWT dependency: Switched from adhocore/jwt to firebase/php-jwt (^7.0). Token request method signatures are unchanged.
• RSA key requirement: JWT Grant now requires an RSA private key of at least 2048 bits. Shorter keys raise a DomainException.
• Lowercase response headers: Header arrays returned by the *WithHttpInfo methods and by ApiException::getResponseHeaders() now use lowercase keys (for example, content-type).
• Fixed: Removed deprecated utf8_decode() calls from Basic authorization headers in token generation methods, which caused deprecation warnings on PHP 8.2+.

• Raised minimum PHP version: The SDK now requires PHP ~8.2.35, ~8.3.36, ~8.4.27, or >=8.5.12 (previously 7.4) to address security vulnerabilities CVE-2026-109618 and CVE-2026-109619.
• Replaced JWT dependency: Switched from adhocore/jwt to firebase/php-jwt (^7.0). Token request method signatures are unchanged.
• RSA key requirement: JWT Grant now requires an RSA private key of at least 2048 bits. Shorter keys raise a DomainException.
• Lowercase response headers: Header arrays returned by the *WithHttpInfo methods and by ApiException::getResponseHeaders() now use lowercase keys (for example, content-type).
• Fixed: Removed deprecated utf8_decode() calls from Basic authorization headers in token generation methods, which caused deprecation warnings on PHP 8.2+.

• Raised minimum PHP version: The SDK now requires PHP ~8.2.35, ~8.3.36, ~8.4.27, or >=8.5.12 (previously 7.4) to address security vulnerabilities CVE-2026-109618 and CVE-2026-109619.
• Replaced JWT dependency: Switched from adhocore/jwt to firebase/php-jwt (^7.0). Token request method signatures are unchanged.
• RSA key requirement: JWT Grant now requires an RSA private key of at least 2048 bits. Shorter keys raise a DomainException.
• Lowercase response headers: Header arrays returned by the *WithHttpInfo methods and by ApiException::getResponseHeaders() now use lowercase keys (for example, content-type).
• Fixed: Removed deprecated utf8_decode() calls from Basic authorization headers in token generation methods, which caused deprecation warnings on PHP 8.2+.

• Raised minimum PHP version: The SDK now requires PHP ~8.2.35, ~8.3.36, ~8.4.27, or >=8.5.12 (previously 7.4) to address security vulnerabilities CVE-2026-109618 and CVE-2026-109619.
• Replaced JWT dependency: Switched from adhocore/jwt to firebase/php-jwt (^7.0). Token request method signatures are unchanged.
• RSA key requirement: JWT Grant now requires an RSA private key of at least 2048 bits. Shorter keys raise a DomainException.
• Lowercase response headers: Header arrays returned by the *WithHttpInfo methods and by ApiException::getResponseHeaders() now use lowercase keys (for example, content-type).
• Fixed: Removed deprecated utf8_decode() calls from Basic authorization headers in token generation methods, which caused deprecation warnings on PHP 8.2+.

Docusign is updating the domain structure for embedded signing URLs. When a recipient first opens an envelope, browsers are now directed to a unified domain (apps.docusign.com) instead of older site-specific URLs (such as www.docusign.net). This change primarily affects URLs generated by the createRecipientView API endpoint.

• URL length increase: The maximum length of the returned URL increases to 4,000 characters. Make sure your application can handle and redirect longer URL strings.
• No change to TTL: The time-to-live for these URLs remains 5 minutes.
• New URL format: Production URLs change from https://www.docusign.net/Signing/MTRedeem/v1/... to https://apps.docusign.com/authenticate?code=..., and demo URLs change from https://demo.docusign.net/... to https://apps-d.docusign.com/authenticate?code=....

• Raised minimum PHP version: The SDK now requires PHP ~8.2.35, ~8.3.36, ~8.4.27, or >=8.5.12 (previously 7.4) to address security vulnerabilities CVE-2026-109618 and CVE-2026-109619.
• Replaced JWT dependency: Switched from adhocore/jwt to firebase/php-jwt (^7.0). Token request method signatures are unchanged.
• RSA key requirement: JWT Grant now requires an RSA private key of at least 2048 bits. Shorter keys raise a DomainException.
• Lowercase response headers: Header arrays returned by the *WithHttpInfo methods and by ApiException::getResponseHeaders() now use lowercase keys (for example, content-type).
• Fixed: Removed deprecated utf8_decode() calls from Basic authorization headers in token generation methods, which caused deprecation warnings on PHP 8.2+.

You can now use the eSignature REST API to share a single envelope with another user in your account. With Shared Access, the envelope owner (the principal) can grant another user (the agent) permission to manage a specific envelope without adding them as a recipient.

To share an envelope, call the POST /v2.1/accounts/{accountId}/envelopes/{envelopeId}/shares endpoint. The agent can then retrieve the envelopes shared with them using GET /v2.1/accounts/{accountId}/envelopes/shared. This feature is available in eSignature REST API v2.1 only.

• Raised minimum PHP version: The SDK now requires PHP ~8.2.35, ~8.3.36, ~8.4.27, or >=8.5.12 (previously 7.4) to address security vulnerabilities CVE-2026-109618 and CVE-2026-109619.
• Replaced JWT dependency: Switched from adhocore/jwt to firebase/php-jwt (^7.0). Token request method signatures are unchanged.
• RSA key requirement: JWT Grant now requires an RSA private key of at least 2048 bits. Shorter keys raise a DomainException.
• Fixed: Removed deprecated utf8_decode() calls from Basic authorization headers in token generation methods, which caused deprecation warnings on PHP 8.2+.

You can now send envelopes on behalf of another user with Bulk Send and, additionally, can perform batch-level correct, resend, void, or rename operations on behalf of another user.

Any customer with Shared Access for Sending will see the option to use Bulk Send when a user is sending on behalf of another user. Then, in the Bulk Send list view, users will see the option to correct, resend, void, or rename bulk send batches when viewing another user’s envelopes through Shared Access.

This release adds local PDF/DOCX upload in signing workflows, new CLM tools, admin enablement controls, entitlement-based tool gating, PLG URL generation, structured responses, session/trace identifiers, and large-result optimizations.

Learn More

Expanded Data I/O mapping to support Docusign currency values in numeric third-party fields, transform one-to-many objects into Workflow Builder data arrays, and map system-of-record checkbox and single-select dropdown fields to corresponding web form fields—with updates written back to the source system.

Learn More

Docusign Iris helps turn agreement context into insights and governed actions. This guide explains how builders can use Iris-powered agentic capabilities and related Docusign tools, including ready-to-deploy agents, Agent Studio, Workflow Builder, Worksheets, and the Docusign MCP Server, to build agreement workflows across Docusign and third-party AI tools.

This guide shows developers how to configure Agreement Manager as code using the Docusign CLI, test extraction accuracy against real agreements, and reuse validated configurations across accounts. Follow this walkthrough to create a repeatable, versioned workflow that moves from developer testing to production deployment.

Learn More

Learn how Docusign Agreement Manager, the Docusign CLI, and the Agreement Manager API work together to turn completed agreements into structured data you can search, analyze, and use in downstream workflows.

Learn More

Salesforce doesn’t yet have a native connector for the Docusign MCP Server. This guide shows how to connect the two using a custom Apex class that handles JSON-RPC messaging and OAuth 2.0 authentication.

Learn More

Highlights from the Docusign Developers Meetup in Bengaluru, where Docusign engineering and product leaders met with local developers and builders to talk through Intelligent Agreement Management (IAM), APIs, and agentic workflows.

Learn More

Learn how to build a secure, self-service account update workflow using a Docusign Data IO extension app, Docusign Workflow Builder, and Kong Konnect. This guide covers how to expose and secure the API, connect it to a backend system, and build the workflow in Docusign Workflow Builder.

Learn More

Learn how Fluidlabs built Docusign extension apps for Middesk and Smartsheet by starting with real customer workflows, validating requirements early, and designing for long-term adoption.

Learn More

Learn how to use data from conditional fields in your Docusign API integration when the fields may or may not have been visible to the signers.

Learn More