> You are reading the Docusign Developer Documentation. For clean Markdown of any page, append .md to the page URL.
>
> Documentation indexes by section:
> - APIs and SDKs: https://docusign.docs.buildwithfern.com/docs/llms.txt
> - Platform 101: https://docusign.docs.buildwithfern.com/platform/llms.txt
> - Extension Apps: https://docusign.docs.buildwithfern.com/extension-apps/llms.txt
> - Docusign CLI: https://docusign.docs.buildwithfern.com/docusign-cli/llms.txt
>
> Authentication (OAuth, JWT Grant, M2M): https://docusign.docs.buildwithfern.com/platform/auth
> Webhooks and Connect: https://docusign.docs.buildwithfern.com/platform/webhooks
>
> OpenAPI specifications: https://docusign.docs.buildwithfern.com/openapi.json
> MCP server: https://docusign.docs.buildwithfern.com/_mcp/server

# CFR Part 11 accounts

> Docusign supports authentication and signing workflows that enable customers to meet the requirements of the Food and Drug Administration (FDA) 21 CFR Part 11 regulation.

The eSignature REST API enables customers in the life sciences, pharmaceutical, and medical technology industries to meet the authentication and signature requirements of the Food and Drug Administration (FDA) 21 CFR Part 11 regulation. This requires sending [envelopes](/docs/esign-rest-api/esign101/concepts/envelopes) from a Docusign [CFR Part 11 account](/docs/esign-rest-api/esign101/concepts/cfr-part-11-accounts#account-prerequisite). If you send an envelope from a CFR Part 11 account, the workflow includes the following features that differ from non-CFR Part 11 envelopes:

* **Document access:** [Recipients](/docs/esign-rest-api/esign101/concepts/recipients) must authenticate via account login, SMS, or another supported method before viewing [documents](/docs/esign-rest-api/esign101/concepts/documents). See [Authentication options](/docs/esign-rest-api/esign101/concepts/cfr-part-11-accounts#authentication-options) for descriptions of the different ways recipients can authenticate. Even non-signing recipients must authenticate to access CFR Part 11 envelopes. This includes carbon copy and certified delivery [recipient types](/docs/esign-rest-api/esign101/concepts/recipients#recipient-types). To view a completed CFR Part 11 envelope, a signer must authenticate just as they did when accessing the document before signing it.

* **Signatures:** CFR Part 11 signatures include the following:

  * **Authentication:** By default, signers must authenticate when they sign or initial documents. This authentication step is in addition to the authentication required to view a document. See [Signing Experiences for Part 11 Accounts](https://support.docusign.com/s/document-item?bundleId=tja1628891649386\&topicId=zjj1626294860666.html&_LANG=enus) for information about an option that does not require authentication for each signature.
  * **Reason:** When they sign or initial, recipients must select a signing reason.
  * **Signature manifestation:** All completed signatures and initials are marked with required information, including the signer name, the signing reason, a timestamp, and a unique identifier, as shown below. See [Tall vs. Wide Signatures on Part 11 Envelopes](https://support.docusign.com/s/document-item?bundleId=tja1628891649386\&topicId=zly1626295138201.html&_LANG=enus) for information about different signature style options.

    ![Elements of a CFR Part 11 signature](/_fern-files/_img/e12006c9cf636e665f76b1d6554fb0dd534a11cf3985bd455a9c008ab00230ac.webp)

For details about how the Docusign CFR Part 11 solution enables customers to meet FDA regulatory requirements, see [Docusign Part 11 Compliance Information](https://support.docusign.com/s/document-item?bundleId=tja1628891649386\&topicId=dgf1583277465613.html&_LANG=enus).

## Account prerequisite

You can send CFR Part 11 [envelopes](/docs/esign-rest-api/esign101/concepts/envelopes) only from an [account](/platform/account) that has CFR Part 11 enabled. CFR Part 11 accounts are preconfigured with settings compatible with regulatory requirements, and certain account features are [not available with CFR Part 11](https://support.docusign.com/s/document-item?bundleId=tja1628891649386\&topicId=ezy1659124843196.html&_LANG=enus) to mitigate risk of noncompliance. You cannot use a CFR Part 11 account to send envelopes that do not require CFR Part 11 compliance. If you send both CFR Part 11 envelopes and envelopes that do not use this feature, you’ll need to use separate accounts to send each type.

To obtain a developer environment account that has CFR Part 11 enabled, contact your account manager or [Docusign Support](https://support.docusign.com/s/contactSupport). Production CFR Part 11 accounts are available only with commercial plans and not through Docusign web plans. Contact your account manager for more information.

To confirm whether an account has CFR Part 11 enabled, make a request to the [Accounts:get](/docs/esign-rest-api/reference/accounts/accounts/get) endpoint and confirm that the response includes a `status21CFRPart11` property set to `enabled`.  You can also log in to the eSignature web app on the [developer environment](https://account-d.docusign.com/) or [production environment](https://apps.docusign.com/send/home) to verify that the shield and **Part 11 Module Enabled** appear on the home page, as shown below.

![Part 11 Module Enabled label](/_fern-files/_img/638191c93790be518dff37edda1513167c0cbbb28b0f81b726729e6a0c43e49e.webp)

## Envelope access options

You can create CFR Part 11 [envelopes](/docs/esign-rest-api/esign101/concepts/envelopes) that use [remote signing](/docs/esign-rest-api/how-to/request-signature-email-remote), in which [recipients](/docs/esign-rest-api/esign101/concepts/recipients) access an envelope via an emailed link, or [embedded signing](/docs/esign-rest-api/esign101/concepts/embedding), in which recipients sign directly through your app’s UI. The API request that creates CFR Part 11 envelopes is the same [Envelopes:create](/docs/esign-rest-api/reference/envelopes/envelopes/create) call that’s used for non-CFR Part 11 envelopes, but additional properties may be required for CFR Part 11, depending on the authentication method. See [Implement CFR Part 11 envelopes](/docs/esign-rest-api/esign101/concepts/cfr-part-11-accounts#implement-cfr-part-11-envelopes) for details.

## Authentication options

The [envelope access method](/docs/esign-rest-api/esign101/concepts/cfr-part-11-accounts#envelope-access-options) you select determines which authentication methods are available. The authentication method determines how [recipients](/docs/esign-rest-api/esign101/concepts/recipients) verify their identities when viewing and signing [documents](/docs/esign-rest-api/esign101/concepts/documents). These authentication options are listed below.

* [Remote signing authentication methods](/docs/esign-rest-api/esign101/concepts/cfr-part-11-accounts#remote-signing-authentication-methods)
* [Embedded signing with SMS for access and signatures](/docs/esign-rest-api/esign101/concepts/cfr-part-11-accounts#embedded-signing-with-sms-for-access-and-signatures)

Implementation information for each authentication option appears in [Implement CFR Part 11 envelopes](/docs/esign-rest-api/esign101/concepts/cfr-part-11-accounts#implement-cfr-part-11-envelopes).

The default behavior for every authentication option is that recipients must authenticate every time they sign or initial. See [Signing Experiences for Part 11 Accounts](https://support.docusign.com/s/document-item?bundleId=tja1628891649386\&topicId=zjj1626294860666.html&_LANG=enus) for information about an option that does not require authentication each time. Docusign recommends consulting with your quality team when considering this option.

### Remote signing authentication methods

With [remote signing](/docs/esign-rest-api/how-to/request-signature-email-remote), these authentication methods are supported:

* **Account login for access and signatures:** To access a [document](/docs/esign-rest-api/esign101/concepts/documents), and each time they sign or initial, [recipients](/docs/esign-rest-api/esign101/concepts/recipients) must enter a Docusign account email address and password. Recipients who do not have a Docusign account can create one at no charge via a link from the authentication page. [Implement remote signing with account login for access and signatures](/docs/esign-rest-api/esign101/concepts/cfr-part-11-accounts#implement-remote-signing-with-account-login-for-access-and-signatures) has details about this option.
* **SMS for access and signatures:** To access a document, and each time they sign or initial, recipients must provide the last four digits of their phone number and then enter a security code received via SMS. Recipients do not need a Docusign account to authenticate using this method. [Implement remote signing with SMS for access and signatures](/docs/esign-rest-api/esign101/concepts/cfr-part-11-accounts#implement-remote-signing-with-sms-for-access-and-signatures) describes the API requests in this workflow.
* **Recipient authentication and account login for access, and account login for signatures:** To access a document, recipients must enter a Docusign account email address and password and then authenticate using one of the supported [recipient authentication](/docs/esign-rest-api/esign101/concepts/recipients/auth) methods. Recipients who do not have a Docusign account can create one at no charge via a link from the authentication page. Each time they sign or initial, recipients must re-enter their Docusign account email address and password. [Implement remote signing with account login and recipient authentication](/docs/esign-rest-api/esign101/concepts/cfr-part-11-accounts#implement-remote-signing-with-account-login-and-recipient-authentication) has details about this option.

### Embedded signing with SMS for access and signatures

The only authentication method supported with [embedded signing](/docs/esign-rest-api/esign101/concepts/embedding) is SMS for access and signatures. To access a document, and each time they sign or initial, recipients must provide the last four digits of their phone number and then enter a security code received via SMS. Recipients do not need a Docusign account to authenticate using this method. [Implement embedded signing with SMS for access and signatures](/docs/esign-rest-api/esign101/concepts/cfr-part-11-accounts#implement-embedded-signing-with-sms-for-access-and-signatures) describes the API requests in this workflow.

## Implement CFR Part 11 envelopes

The sections below describe the API requests for the supported CFR Part 11 envelope access and authentication methods:

* [Remote signing with account login for access and signatures](/docs/esign-rest-api/esign101/concepts/cfr-part-11-accounts#implement-remote-signing-with-account-login-for-access-and-signatures)
* [Remote signing with SMS for access and signatures](/docs/esign-rest-api/esign101/concepts/cfr-part-11-accounts#implement-remote-signing-with-sms-for-access-and-signatures)
* [Remote signing with account login and recipient authentication](/docs/esign-rest-api/esign101/concepts/cfr-part-11-accounts#implement-remote-signing-with-account-login-and-recipient-authentication)
* [Embedded signing with SMS for access and signatures](/docs/esign-rest-api/esign101/concepts/cfr-part-11-accounts#implement-embedded-signing-with-sms-for-access-and-signatures)

Regardless of the implementation option you choose, you can use the [Docusign Connect](/platform/webhooks/connect) webhook service and a listener to receive envelope updates as they progress through the delivery and signing process.

### Implement remote signing with account login for access and signatures

To set up a CFR Part 11 [remote signing](/docs/esign-rest-api/how-to/request-signature-email-remote) workflow that requires [recipients](/docs/esign-rest-api/esign101/concepts/recipients) to enter a Docusign account email and password to view and sign, use a standard [Envelopes:create](/docs/esign-rest-api/reference/envelopes/envelopes/create) request. For each signer, define at least one required [signature tab](/docs/esign-rest-api/reference/envelopes/envelopes/create#schema__envelopedefinition_recipients_signers_tabs_signheretabs) or one required [initial tab](/docs/esign-rest-api/reference/envelopes/envelopes/create#schema__envelopedefinition_recipients_signers_tabs_initialheretabs). If a CFR Part 11 signer does not have at least one of these tabs, Docusign returns the error code `DIGITAL_CERTIFICATE_WITH_21CFR_MUST_HAVE_SIGNATURE_TAB`.

See [How to request a signature by email](/docs/esign-rest-api/how-to/request-signature-email-remote) for a walkthrough and code samples for remote signing.

### Implement remote signing with SMS for access and signatures

A basic CFR Part 11 [remote signing](/docs/esign-rest-api/how-to/request-signature-email-remote) workflow that requires SMS authentication to view and sign consists of these API requests:

1. [IdentityVerifications:list](/docs/esign-rest-api/reference/accounts/identityverifications/list): Returns a list of the workflow IDs associated with the [recipient authentication](/docs/esign-rest-api/esign101/concepts/recipients/auth) methods available to your account. For SMS authentication, the workflow ID you’ll need is the one with a `defaultName` of `SMS for access & signatures`.
2. [Envelopes:create](/docs/esign-rest-api/reference/envelopes/envelopes/create): Creates the [envelope](/docs/esign-rest-api/esign101/concepts/envelopes). It must specify the following for each [recipient](/docs/esign-rest-api/esign101/concepts/recipients):

   * An [identityVerification](/docs/esign-rest-api/reference/envelopes/envelopes/create#schema__envelopedefinition_recipients_signers_identityverification) property that includes:

     * The workflow ID obtained from the `IdentityVerifications:list` response.
     * The recipient’s phone number. When recipients authenticate, they enter the last four digits of this phone number and then enter a security code sent via SMS to this number.
   * The recipient name and email.
   * At least one required [signature tab](/docs/esign-rest-api/reference/envelopes/envelopes/create#schema__envelopedefinition_recipients_signers_tabs_signheretabs) or one required [initial tab](/docs/esign-rest-api/reference/envelopes/envelopes/create#schema__envelopedefinition_recipients_signers_tabs_initialheretabs) for each signer. If a CFR Part 11 signer does not have at least one of these tabs, Docusign returns the error code `DIGITAL_CERTIFICATE_WITH_21CFR_MUST_HAVE_SIGNATURE_TAB`.

For an example of a CFR Part 11 `Envelopes:create` request, see step 3 of [How to request a signature through your app (embedded signing) with a CFR Part 11 account](/docs/esign-rest-api/how-to/request-signature-in-app-embedded-cfrpart11). You can use the same properties in the remote signing request, but omit the `clientUserId` because that property defines a recipient as an embedded recipient.

### Implement remote signing with account login and recipient authentication

You can implement a CFR Part 11 [remote signing](/docs/esign-rest-api/how-to/request-signature-email-remote) workflow that requires [recipients](/docs/esign-rest-api/esign101/concepts/recipients) to do both of the following to view a [document](/docs/esign-rest-api/esign101/concepts/documents):

1. Enter a Docusign account email and password.
2. Authenticate via one of these recipient authentication methods:

   * [Access code authentication](/docs/esign-rest-api/esign101/concepts/recipients/auth#access-code)
   * [Phone authentication](/docs/esign-rest-api/esign101/concepts/recipients/auth#phone)
   * [Knowledge-based authentication (KBA)](/docs/esign-rest-api/esign101/concepts/recipients/auth#kba)
   * [ID verification](/docs/esign-rest-api/esign101/concepts/recipients/auth#idv)

Recipients must re-enter their Docusign account email and password each time they sign or initial.

#### Phone authentication, knowledge-based authentication, or ID verification

Below are the API requests that implement a basic CFR Part 11 [remote signing](/docs/esign-rest-api/how-to/request-signature-email-remote) workflow that requires Docusign account login followed by [phone authentication](/docs/esign-rest-api/esign101/concepts/recipients/auth#phone), [knowledge-based authentication](/docs/esign-rest-api/esign101/concepts/recipients/auth#kba), or [ID verification](/docs/esign-rest-api/esign101/concepts/recipients/auth#idv) to view a [document](/docs/esign-rest-api/esign101/concepts/documents).

1. [IdentityVerifications:list](/docs/esign-rest-api/reference/accounts/identityverifications/list): Returns a list of the workflow IDs associated with the [recipient authentication](/docs/esign-rest-api/esign101/concepts/recipients/auth) methods available to your account.
2. [Envelopes:create](/docs/esign-rest-api/reference/envelopes/envelopes/create): Creates the [envelope](/docs/esign-rest-api/esign101/concepts/envelopes). It must specify the following for each [recipient](/docs/esign-rest-api/esign101/concepts/recipients):

   * An [identityVerification](/docs/esign-rest-api/reference/envelopes/envelopes/create#schema__envelopedefinition_recipients_signers_identityverification) property that includes:

     * The workflow ID for the authentication method you want the recipient to use, obtained from the `IdentityVerifications:list` response.
     * The recipient’s phone number if using phone authentication. A security code will be sent to this number via phone call or SMS, depending on the recipient’s selection during authentication.
   * The recipient name and email.
   * At least one required [signature tab](/docs/esign-rest-api/reference/envelopes/envelopes/create#schema__envelopedefinition_recipients_signers_tabs_signheretabs) or one required [initial tab](/docs/esign-rest-api/reference/envelopes/envelopes/create#schema__envelopedefinition_recipients_signers_tabs_initialheretabs) for each signer. If a CFR Part 11 signer does not have at least one of these tabs, Docusign returns the error code `DIGITAL_CERTIFICATE_WITH_21CFR_MUST_HAVE_SIGNATURE_TAB`.

For code samples, see:

* [How to require phone authentication for a recipient](/docs/esign-rest-api/how-to/phone-auth)
* [How to require knowledge-based authentication (KBA) for a recipient](/docs/esign-rest-api/how-to/knowledge-based-authentication)
* [How to require ID verification (IDV) for a recipient](/docs/esign-rest-api/how-to/id-verification)

#### Access code authentication

For a basic CFR Part 11 [remote signing](/docs/esign-rest-api/how-to/request-signature-email-remote) workflow that requires Docusign account login followed by [access code authentication](/docs/esign-rest-api/esign101/concepts/recipients/auth#access-code) to view a [document](/docs/esign-rest-api/esign101/concepts/documents), use a standard [Envelopes:create](/docs/esign-rest-api/reference/envelopes/envelopes/create) request that does not include an [identityVerification](/docs/esign-rest-api/reference/envelopes/envelopes/create#schema__envelopedefinition_recipients_signers_identityverification) property. For each [recipient](/docs/esign-rest-api/esign101/concepts/recipients), the request must include an access code that the recipient enters in order to view the document. For each signer, define at least one required [signature tab](/docs/esign-rest-api/reference/envelopes/envelopes/create#schema__envelopedefinition_recipients_signers_tabs_signheretabs) or one required [initial tab](/docs/esign-rest-api/reference/envelopes/envelopes/create#schema__envelopedefinition_recipients_signers_tabs_initialheretabs). If a CFR Part 11 signer does not have at least one of these tabs, Docusign returns the error code `DIGITAL_CERTIFICATE_WITH_21CFR_MUST_HAVE_SIGNATURE_TAB`.

For code samples, see [How to require access code authentication for a recipient](/docs/esign-rest-api/how-to/require-access-code-recipient).

### Implement embedded signing with SMS for access and signatures

A basic CFR Part 11 [embedded signing](/docs/esign-rest-api/esign101/concepts/embedding) workflow that requires SMS authentication to view and sign consists of these API requests:

1. [IdentityVerifications:list](/docs/esign-rest-api/reference/accounts/identityverifications/list): Returns a list of the workflow IDs associated with the [recipient authentication](/docs/esign-rest-api/esign101/concepts/recipients/auth) methods available to your account. For SMS authentication, the workflow ID you’ll need is the one with a `defaultName` of `SMS for access & signatures`.
2. [Envelopes:create](/docs/esign-rest-api/reference/envelopes/envelopes/create): Creates the [envelope](/docs/esign-rest-api/esign101/concepts/envelopes). It must specify the following for each [recipient](/docs/esign-rest-api/esign101/concepts/recipients):

   * An [identityVerification](/docs/esign-rest-api/reference/envelopes/envelopes/create#schema__envelopedefinition_recipients_signers_identityverification) property that includes:

     * The workflow ID obtained from the `IdentityVerifications:list` response.
     * The recipient’s phone number. When recipients authenticate, they enter the last four digits of this phone number and then enter a security code sent via SMS to this number.
   * The recipient name, email, and `clientUserId`. The `clientUserId` property identifies the recipient as an embedded signing recipient.
   * At least one required [signature tab](/docs/esign-rest-api/reference/envelopes/envelopes/create#schema__envelopedefinition_recipients_signers_tabs_signheretabs) or one required [initial tab](/docs/esign-rest-api/reference/envelopes/envelopes/create#schema__envelopedefinition_recipients_signers_tabs_initialheretabs) for each signer. If a CFR Part 11 signer does not have at least one of these tabs, Docusign returns the error code `DIGITAL_CERTIFICATE_WITH_21CFR_MUST_HAVE_SIGNATURE_TAB`.
3. [EnvelopeViews:createRecipient](/docs/esign-rest-api/reference/envelopes/envelopeviews/createrecipient): Generates the signing URL. This request must include a name, email, and `clientUserId` that match the values from the `Envelopes:create` request.

See [How to request a signature through your app (embedded signing) with a CFR Part 11 account](/docs/esign-rest-api/how-to/request-signature-in-app-embedded-cfrpart11) for a walkthrough and code samples.

## Account settings that affect CFR Part 11

Several account settings enable you to customize the CFR Part 11 signing process. They include:

* [Rapid Part 11 signing](https://support.docusign.com/s/document-item?bundleId=tja1628891649386\&topicId=zjj1626294860666.html&_LANG=enus): Requires [recipients](/docs/esign-rest-api/esign101/concepts/recipients) to authenticate only to access and complete an [envelope](/docs/esign-rest-api/esign101/concepts/envelopes), but not every time they sign or initial.
* [Wide signatures](https://support.docusign.com/s/document-item?bundleId=tja1628891649386\&topicId=zly1626295138201.html&_LANG=enus): Changes the layout of the signature and accompanying signing information.
* [Recipient lockout notifications](https://support.docusign.com/s/document-item?bundleId=tja1628891649386\&topicId=mxe1626294309234.html&_LANG=enus): Notifies an envelope sender if a recipient becomes locked out of their Docusign account after exceeding the permitted number of login attempts.

## Next steps

* See [How to request a signature through your app (embedded signing) with a CFR Part 11 account](/docs/esign-rest-api/how-to/request-signature-in-app-embedded-cfrpart11) for a walkthrough and code samples for CFR Part 11 envelopes.
* See [Docusign Part 11 Module Overview](https://support.docusign.com/s/document-item?bundleId=tja1628891649386\&topicId=jku1583277398949.html&_LANG=enus) for general information about CFR Part 11 features.
* See [Recipient authentication](/docs/esign-rest-api/esign101/concepts/recipients/auth) for information about methods you can use with both CFR Part 11 and non-CFR Part 11 accounts to verify a recipient’s identity.