> You are reading the Docusign Developer Documentation. For clean Markdown of any page, append .md to the page URL.
>
> Documentation indexes by section:
> - APIs and SDKs: https://docusign.docs.buildwithfern.com/docs/llms.txt
> - Platform 101: https://docusign.docs.buildwithfern.com/platform/llms.txt
> - Extension Apps: https://docusign.docs.buildwithfern.com/extension-apps/llms.txt
> - Docusign CLI: https://docusign.docs.buildwithfern.com/docusign-cli/llms.txt
>
> Authentication (OAuth, JWT Grant, M2M): https://docusign.docs.buildwithfern.com/platform/auth
> Webhooks and Connect: https://docusign.docs.buildwithfern.com/platform/webhooks
>
> OpenAPI specifications: https://docusign.docs.buildwithfern.com/openapi.json
> MCP server: https://docusign.docs.buildwithfern.com/_mcp/server

# How to create a permission profile

> Demonstrates how to create a new permission profile.

This topic demonstrates how to create a new permission profile with the eSignature REST API.

> **Note**
>
> Run this code example from our [Quickstart](/docs/esign-rest-api/quickstart) or launcher projects: [Bash](https://github.com/docusign/code-examples-bash), [C#](https://github.com/docusign/code-examples-csharp), [Java](https://github.com/docusign/code-examples-java), [Node.js](https://github.com/docusign/code-examples-node), [PHP](https://github.com/docusign/code-examples-php), [PowerShell](https://github.com/docusign/code-examples-powershell), [Python](https://github.com/docusign/code-examples-python), or [Ruby](https://github.com/docusign/code-examples-ruby).

## Required data

Running the code in this how-to requires this data:

| Data element      | Description                                                                                                                                                                                                                                                                                                            |
| ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| \{API_ACCOUNT_ID} | A [GUID](http://guid.one/) value that identifies your account. This value is automatically generated by Docusign for any account you create. Copy the value from the **API Account ID** field on the [Apps and Keys](https://admindemo.docusign.com/authenticate?goTo=appsAndKeys) page.                               |
| \{BASE_PATH}      | A string value that forms the root of the URL required to make API calls. The base path value in the example code is set to target the developer environment at https\://\<domain>/restapi Where \<domain> is demo.docusign.net for the developer environment and is the result of the GetUserInfo call in production. |

## Step 1. Obtain your OAuth token

To make the API call shown in this how-to, you need a valid OAuth access token. Docusign supports access tokens for three different recommended OAuth grant types: Public Authorization Code Grant, Confidential Authorization Code Grant, and JSON Web Token (JWT) Grant. Choose the OAuth grant type appropriate for your scenario.

> **Note**
>
> See [Confidential Authorization Code Grant](/platform/auth/authcode#confidential-authorization-code-grant) for guidance on your options to get an Confidential Authorization Code Grant  OAuth token.

![Three icons that represent the three methods a user can use to obtain an OAuth token: JSON Web Token (JWT), Public Authorization Code Grant (ACG), and Confidential Authorization Code grant](/_fern-files/_img/64f473773042ee439449a096bf7673292b1585b86a4ccc55f82ba0dda41f61a1.webp)

## Step 2. Construct your API headers

After you have a valid OAuth access token, you are ready to construct the API headers that you will pass to the API call. Construct your headers like this, but make sure to substitute your valid OAuth access token for \{ACCESS_TOKEN}.

**`Bash`**

```bash title="Bash"
declare -a Headers=('--header' "Authorization: Bearer ${ACCESS_TOKEN}" \
					'--header' "Accept: application/json" \
					'--header' "Content-Type: application/json")
```

**`C#`**

```csharp title="C#"
var docuSignClient = new DocuSignClient(basePath);
docuSignClient.Configuration.DefaultHeader.Add("Authorization", "Bearer " + accessToken);
AccountsApi accountsApi = new AccountsApi(docuSignClient);
```

**`Java`**

```java title="Java"
ApiClient apiClient = new ApiClient(basePath);
apiClient.addDefaultHeader(HttpHeaders.AUTHORIZATION, BEARER_AUTHENTICATION + userAccessToken);
```

**`Node.js`**

```javascript title="Node.js"
let dsApiClient = new docusign.ApiClient();
dsApiClient.setBasePath(args.basePath);

dsApiClient.addDefaultHeader('Authorization', 'Bearer ' + args.accessToken);
let accountsApi = new docusign.AccountsApi(dsApiClient);
```

**`PHP`**

```php title="PHP"
$config = new Configuration();
$config->setHost($args['base_path']);
$config->addDefaultHeader('Authorization', 'Bearer ' . $args['ds_access_token']);
$this->apiClient = new ApiClient($config);
```

**`PowerShell`**

```text title="PowerShell"
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers.add("Authorization", "Bearer $oAuthAccessToken")
$headers.add("Accept", "application/json")
$headers.add("Content-Type", "application/json")
```

**`Python`**

```python title="Python"
api_client = create_api_client(base_path=args["base_path"], access_token=args["access_token"])
```

**`Ruby`**

```ruby title="Ruby"
configuration = DocuSign_eSign::Configuration.new
configuration.host = args[:base_path]
api_client = DocuSign_eSign::ApiClient.new configuration

api_client.default_headers['Authorization'] = "Bearer #{args[:access_token]}"
```

## Step 3. Construct the request body

Next, create the request body. Include a unique permission profile name and a `settings` object with your permission settings.

**`Bash`**

```bash title="Bash"
printf \
'{
      "permissionProfileName": "'"${PROFILE_NAME}"'",
      "settings" : { 
        "useNewDocuSignExperienceInterface":0,
        "allowBulkSending":"true",
        "allowEnvelopeSending":"true",
        "allowSignerAttachments":"true",
        "allowTaggingInSendAndCorrect":"true",
        "allowWetSigningOverride":"true",
        "allowedAddressBookAccess":"personalAndShared",
        "allowedTemplateAccess":"share",
        "enableRecipientViewingNotifications":"true",
        "enableSequentialSigningInterface":"true",
        "receiveCompletedSelfSignedDocumentsAsEmailLinks":"false",
        "signingUiVersion":"v2",
        "useNewSendingInterface":"true",
        "allowApiAccess":"true",
        "allowApiAccessToAccount":"true",
        "allowApiSendingOnBehalfOfOthers":"true",
        "allowApiSequentialSigning":"true",
        "enableApiRequestLogging":"true",
        "allowDocuSignDesktopClient":"false",
        "allowSendersToSetRecipientEmailLanguage":"true",
        "allowVaulting":"false",
        "allowedToBeEnvelopeTransferRecipient":"true",
        "enableTransactionPointIntegration":"false",
        "powerFormRole":"admin",
        "vaultingMode":"none"
      }
}' >> $request_data
```

**`C#`**

```csharp title="C#"
var accountRoleSettings = new global::ESignature.Examples.CreatePermissionProfile.AccountRoleSettingsExtension();
accountRoleSettings.UseNewDocuSignExperienceInterface = "1";
accountRoleSettings.EnableSequentialSigningInterface = true.ToString();
accountRoleSettings.PowerFormRole = "admin";
accountRoleSettings.VaultingMode = "none";
accountRoleSettings.AllowTaggingInSendAndCorrect = true.ToString();
accountRoleSettings.AllowedAddressBookAccess = "personalAndShared";
accountRoleSettings.AllowedTemplateAccess = "share";
accountRoleSettings.SigningUiVersion = "2";

// Present on PermissionProfileView.
accountRoleSettings.AllowBulkSending = permissionProfileModel.AccountRoleSettingsModel.AllowBulkSending.ToString();
accountRoleSettings.AllowEnvelopeSending = permissionProfileModel.AccountRoleSettingsModel.AllowEnvelopeSending.ToString();
accountRoleSettings.AllowSignerAttachments = permissionProfileModel.AccountRoleSettingsModel.AllowSignerAttachments.ToString();
accountRoleSettings.AllowApiAccess = permissionProfileModel.AccountRoleSettingsModel.AllowApiAccess.ToString();
accountRoleSettings.AllowApiAccessToAccount = permissionProfileModel.AccountRoleSettingsModel.AllowApiAccessToAccount.ToString();
accountRoleSettings.AllowApiSequentialSigning = permissionProfileModel.AccountRoleSettingsModel.AllowApiSequentialSigning.ToString();
accountRoleSettings.EnableApiRequestLogging = permissionProfileModel.AccountRoleSettingsModel.EnableApiRequestLogging.ToString();
accountRoleSettings.AllowApiSendingOnBehalfOfOthers = permissionProfileModel.AccountRoleSettingsModel.AllowApiSendingOnBehalfOfOthers.ToString();
accountRoleSettings.AllowWetSigningOverride = permissionProfileModel.AccountRoleSettingsModel.AllowWetSigningOverride.ToString();
accountRoleSettings.EnableRecipientViewingNotifications = permissionProfileModel.AccountRoleSettingsModel.EnableRecipientViewingNotifications.ToString();
accountRoleSettings.ReceiveCompletedSelfSignedDocumentsAsEmailLinks = permissionProfileModel.AccountRoleSettingsModel.ReceiveCompletedSelfSignedDocumentsAsEmailLinks.ToString();
accountRoleSettings.UseNewSendingInterface = permissionProfileModel.AccountRoleSettingsModel.UseNewSendingInterface.ToString();
accountRoleSettings.AllowDocuSignDesktopClient = permissionProfileModel.AccountRoleSettingsModel.AllowDocuSignDesktopClient.ToString();
accountRoleSettings.AllowSendersToSetRecipientEmailLanguage = permissionProfileModel.AccountRoleSettingsModel.AllowSendersToSetRecipientEmailLanguage.ToString();
accountRoleSettings.AllowVaulting = permissionProfileModel.AccountRoleSettingsModel.AllowVaulting.ToString();
accountRoleSettings.AllowedToBeEnvelopeTransferRecipient = permissionProfileModel.AccountRoleSettingsModel.AllowedToBeEnvelopeTransferRecipient.ToString();
accountRoleSettings.EnableTransactionPointIntegration = permissionProfileModel.AccountRoleSettingsModel.EnableTransactionPointIntegration.ToString();
```

**`Java`**

```java title="Java"
Gson gson = new Gson();
String signingUiVersion = "1";
AccountRoleSettings settings = DsModelUtils.createDefaultRoleSettings();
AccountRoleSettingsPatch newSettings = gson.fromJson(gson.toJson(settings), AccountRoleSettingsPatch.class);
newSettings.signingUiVersion(signingUiVersion);
PermissionProfile profile = new PermissionProfile()
        .permissionProfileName(permissionProfileName)
        .settings(newSettings);
```

**`Node.js`**

```javascript title="Node.js"
const requestBody = {
  permissionProfile: {
    permissionProfileName: args.profileName,
    settings: {
      useNewDocuSignExperienceInterface: 0,
      allowBulkSending: 'true',
      allowEnvelopeSending: 'true',
      allowSignerAttachments: 'true',
      allowTaggingInSendAndCorrect: 'true',
      allowWetSigningOverride: 'true',
      allowedAddressBookAccess: 'personalAndShared',
      allowedTemplateAccess: 'share',
      enableRecipientViewingNotifications: 'true',
      enableSequentialSigningInterface: 'true',
      receiveCompletedSelfSignedDocumentsAsEmailLinks: 'false',
      signingUiVersion: 'v2',
      useNewSendingInterface: 'true',
      allowApiAccess: 'true',
      allowApiAccessToAccount: 'true',
      allowApiSendingOnBehalfOfOthers: 'true',
      allowApiSequentialSigning: 'true',
      enableApiRequestLogging: 'true',
      allowDocuSignDesktopClient: 'false',
      allowSendersToSetRecipientEmailLanguage: 'true',
      allowVaulting: 'false',
      allowedToBeEnvelopeTransferRecipient: 'true',
      enableTransactionPointIntegration: 'false',
      powerFormRole: 'admin',
      vaultingMode: 'none',
    },
  },
};
```

**`PHP`**

```php title="PHP"
$accounts_api = $clientService->getAccountsApi();
$permission_profile = new PermissionProfile($args['permission_args']);
```

**`PowerShell`**

```text title="PowerShell"
$body = @"
{
    "permissionProfileName": "${PROFILE_NAME}",
    "settings" : {
        "useNewDocuSignExperienceInterface":0,
        "allowBulkSending":"true",
        "allowEnvelopeSending":"true",
        "allowSignerAttachments":"true",
        "allowTaggingInSendAndCorrect":"true",
        "allowWetSigningOverride":"true",
        "allowedAddressBookAccess":"personalAndShared",
        "allowedTemplateAccess":"share",
        "enableRecipientViewingNotifications":"true",
        "enableSequentialSigningInterface":"true",
        "receiveCompletedSelfSignedDocumentsAsEmailLinks":"false",
        "signingUiVersion":"v2",
        "useNewSendingInterface":"true",
        "allowApiAccess":"true",
        "allowApiAccessToAccount":"true",
        "allowApiSendingOnBehalfOfOthers":"true",
        "allowApiSequentialSigning":"true",
        "enableApiRequestLogging":"true",
        "allowDocuSignDesktopClient":"false",
        "allowSendersToSetRecipientEmailLanguage":"true",
        "allowVaulting":"false",
        "allowedToBeEnvelopeTransferRecipient":"true",
        "enableTransactionPointIntegration":"false",
        "powerFormRole":"admin",
        "vaultingMode":"none"
    }
}
"@
```

**`Python`**

```python title="Python"
permission_profile = PermissionProfile(
    permission_profile_name=args["permission_profile_name"],
    settings=args["settings"]
)
```

**`Ruby`**

```ruby title="Ruby"
def make_permission_profile_settings
  {
    useNewDocuSignExperienceInterface: 0,
    allowBulkSending: 'true',
    allowEnvelopeSending: 'true',
    allowSignerAttachments: 'true',
    allowTaggingInSendAndCorrect: 'true',
    allowWetSigningOverride: 'true',
    allowedAddressBookAccess: 'personalAndShared',
    allowedTemplateAccess: 'share',
    enableRecipientViewingNotifications: 'true',
    enableSequentialSigningInterface: 'true',
    receiveCompletedSelfSignedDocumentsAsEmailLinks: 'false',
    signingUiVersion: 'v2',
    useNewSendingInterface: 'true',
    allowApiAccess: 'true',
    allowApiAccessToAccount: 'true',
    allowApiSendingOnBehalfOfOthers: 'true',
    allowApiSequentialSigning: 'true',
    enableApiRequestLogging: 'true',
    allowDocuSignDesktopClient: 'false',
    allowSendersToSetRecipientEmailLanguage: 'true',
    allowVaulting: 'false',
    allowedToBeEnvelopeTransferRecipient: 'true',
    enableTransactionPointIntegration: 'false',
    powerFormRole: 'admin',
    vaultingMode: 'none'
  }
end
```

## Step 4. Call the eSignature REST API

Now that you have constructed your API headers and request body, you can make a request to the eSignature REST API and include the request body to create the permission profile for your user groups. Here’s how you make the call, but make sure to substitute your API account ID for \{ACCOUNT_ID}

> **Note**
>
> View the source code for this how-to on GitHub: [Bash](https://github.com/docusign/code-examples-bash/blob/master/examples/eSignature/eg024CreatingPermissionProfiles.sh), [C#](https://github.com/docusign/code-examples-csharp/blob/master/launcher-csharp/eSignature/Examples/CreatePermissionProfile.cs), [Java](https://github.com/docusign/code-examples-java/blob/master/src/main/java/com/docusign/controller/eSignature/examples/EG024ControllerPermissionCreate.java), [Node.js](https://github.com/docusign/code-examples-node/blob/master/lib/eSignature/examples/createPermission.js), [PHP](https://github.com/docusign/code-examples-php/blob/master/src/Services/Examples/eSignature/PermissionCreateService.php), [PowerShell](https://github.com/docusign/code-examples-powershell/blob/main/examples/eSignature/eg024CreatingPermissionProfiles.ps1), [Python](https://github.com/docusign/code-examples-python/blob/master/app/eSignature/examples/eg024_permissions_creating.py), or [Ruby](https://github.com/docusign/code-examples-ruby/blob/main/app/services/e_sign/eg024_permission_create_service.rb).

**`Bash`**

```bash title="Bash"
Status=$(curl -w '%{http_code}' -i --request POST ${base_path}/v2.1/accounts/${account_id}/permission_profiles \
     "${Headers[@]}" \
     --data-binary @${request_data} \
     --output ${response})
```

**`C#`**

```csharp title="C#"
var permissionProfiles = accountsApi.CreatePermissionProfileWithHttpInfo(accountId, newPermissionProfile);
permissionProfiles.Headers.TryGetValue("X-RateLimit-Remaining", out string remaining);
permissionProfiles.Headers.TryGetValue("X-RateLimit-Reset", out string reset);

if (reset != null && remaining != null)
{
    DateTime resetDate = DateTimeOffset.FromUnixTimeSeconds(long.Parse(reset)).UtcDateTime;
    Console.WriteLine("API calls remaining: " + remaining);
    Console.WriteLine("Next Reset: " + resetDate);
}

return permissionProfiles.Data;
```

**`Java`**

```java title="Java"
var permissionProfile = accountsApi.createPermissionProfileWithHttpInfo(accountId, profile,
        accountsApi.new CreatePermissionProfileOptions());
Map<String, List<String>> headers = permissionProfile.getHeaders();
java.util.List<String> remaining = headers.get("X-RateLimit-Remaining");
java.util.List<String> reset = headers.get("X-RateLimit-Reset");

if (remaining != null & reset != null) {
    Instant resetInstant = Instant.ofEpochSecond(Long.parseLong(reset.get(0)));
    System.out.println("API calls remaining: " + remaining);
    System.out.println("Next Reset: " + resetInstant);
}
return permissionProfile.getData();
```

**`Node.js`**

```javascript title="Node.js"
let results = await accountsApi.createPermissionProfile(
  args.accountId,
  requestBody,
  (error, data, response) => {
    const headers = response?.headers;

    const remaining = headers?.['x-ratelimit-remaining'];
    const reset = headers?.['x-ratelimit-reset'];

    if (remaining && reset) {
      const resetInstant = new Date(Number(reset) * 1000);

      console.log(`API calls remaining: ${remaining}`);
      console.log(`Next Reset: ${resetInstant.toISOString()}`);
    }
});
```

**`PHP`**

```php title="PHP"
$permissionProfile = $accounts_api->createPermissionProfileWithHttpInfo(
    $args['account_id'],
    $permission_profile
);

$remaining = $permissionProfile[2]['X-RateLimit-Remaining'] ?? null;
$reset = $permissionProfile[2]['X-RateLimit-Reset'] ?? null;

if ($remaining !== null && $reset !== null) {
    $resetInstant = (new DateTime())->setTimestamp((int)$reset);
    error_log("API calls remaining: $remaining");
    error_log("Next Reset: " . $resetInstant->format(\DateTime::ATOM));
}
```

**`PowerShell`**

```text title="PowerShell"
$uri = "https://demo.docusign.net/restapi/v2.1/accounts/$APIAccountId/permission_profiles/"

try {
    Write-Output "Response:"
    $response = Invoke-WebRequest -uri $uri -headers $headers -body $body -method POST
    $($response.Content | ConvertFrom-Json).permissionProfileId > .\config\PROFILE_ID
    $response.Content
}
catch {
    Write-Output "Unable to create a new permissions profile."
    # On failure, display a notification, X-DocuSign-TraceToken, error message, and the command that triggered the error
    foreach ($header in $_.Exception.Response.Headers) {
        if ($header -eq "X-DocuSign-TraceToken") { Write-Output "TraceToken : " $_.Exception.Response.Headers[$int] }
        $int++
    }
    Write-Output "Error : "$_.ErrorDetails.Message
    Write-Output "Command : "$_.InvocationInfo.Line
}
```

**`Python`**

```python title="Python"
account_api = AccountsApi(api_client)
(response, status, headers) = account_api.create_permission_profile_with_http_info(
    account_id=args["account_id"],
    permission_profile=permission_profile
)

remaining = headers.get("X-RateLimit-Remaining")
reset = headers.get("X-RateLimit-Reset")

if remaining is not None and reset is not None:
    reset_date = dt.fromtimestamp(int(reset), tz=timezone.utc)
    print(f"API calls remaining: {remaining}")
    print(f"Next Reset: {reset_date}")
```

**`Ruby`**

```ruby title="Ruby"
accounts_api = create_account_api(args)
permission_profile_name = args[:permission_profile_name]
permission_profile_settings = make_permission_profile_settings
results, _status, headers = accounts_api.create_permission_profile_with_http_info(args[:account_id], { permissionProfileName: permission_profile_name,
                                                                                                       settings: permission_profile_settings },
                                                                                  DocuSign_eSign::CreatePermissionProfileOptions.default)

remaining = headers['X-RateLimit-Remaining']
reset = headers['X-RateLimit-Reset']

if remaining && reset
  reset_date = Time.at(reset.to_i).utc
  puts "API calls remaining: #{remaining}"
  puts "Next Reset: #{reset_date}"
end

results
```

## Expected response

If you run this code example from our Quickstart or launcher projects, you should see a JSON response similar to the code shown.

**`Sample response`**

```json title="Sample response"
{
  "permissionProfileId": "10xxxx46",
  "permissionProfileName": "Ipsum Reader",
  "modifiedDateTime": "2020-08-10T18:15:47.9200000Z",
  "modifiedByUsername": "Any Name",
  "settings":
  {
    "allowAccountManagement": "false",
    "useNewDocuSignExperienceInterface": "never",
    "canCreateWorkspaces": "false",
    "allowBulkSending": "true",
    "allowEnvelopeSending": "true",
    "allowESealRecipients": "false",
    "allowSignerAttachments": "true",
    "allowTaggingInSendAndCorrect": "true",
    "allowWetSigningOverride": "true",
    "allowedAddressBookAccess": "personalAndShared",
    "allowedClickwrapsAccess": "none",
    "allowedTemplateAccess": "share",
    "enableRecipientViewingNotifications": "true",
    "enableSequentialSigningInterface": "true",
    "receiveCompletedSelfSignedDocumentsAsEmailLinks": "false",
    "signingUiVersion": "v2",
    "useNewSendingInterface": "true",
    "allowSupplementalDocuments": "true",
    "supplementalDocumentsMustView": "true",
    "supplementalDocumentsMustAccept": "true",
    "supplementalDocumentsMustRead": "true",
    "disableDocumentUpload": "false",
    "disableOtherActions": "false",
    "allowAutoTagging": "false",
    "allowApiAccess": "true",
    "allowApiAccessToAccount": "true",
    "allowApiSendingOnBehalfOfOthers": "true",
    "allowApiSequentialSigning": "true",
    "enableApiRequestLogging": "true",
    "allowDocuSignDesktopClient": "false",
    "allowSendersToSetRecipientEmailLanguage": "true",
    "allowVaulting": "false",
    "allowedToBeEnvelopeTransferRecipient": "false",
    "enableTransactionPointIntegration": "false",
    "powerFormRole": "admin",
    "allowPowerFormsAdminToAccessAllPowerFormEnvelopes": "false",
    "vaultingMode": "none"
  }
}
```

## Next steps

* Run this code example from our [Quickstart](/docs/esign-rest-api/quickstart) or launcher projects:    [Bash](https://github.com/docusign/code-examples-bash), [C#](https://github.com/docusign/code-examples-csharp), [Java](https://github.com/docusign/code-examples-java), [Node.js](https://github.com/docusign/code-examples-node), [PHP](https://github.com/docusign/code-examples-php), [PowerShell](https://github.com/docusign/code-examples-powershell), [Python](https://github.com/docusign/code-examples-python), or [Ruby](https://github.com/docusign/code-examples-ruby).
* See [Permissions](/docs/esign-rest-api/esign101/concepts/permissions) for more information about permission profiles.
* See how to [Go-Live](/docs/esign-rest-api/go-live) with a completed app and find the base path for API calls in the production environment.