> You are reading the Docusign Developer Documentation. For clean Markdown of any page, append .md to the page URL.
>
> Documentation indexes by section:
> - APIs and SDKs: https://docusign.docs.buildwithfern.com/docs/llms.txt
> - Platform 101: https://docusign.docs.buildwithfern.com/platform/llms.txt
> - Extension Apps: https://docusign.docs.buildwithfern.com/extension-apps/llms.txt
> - Docusign CLI: https://docusign.docs.buildwithfern.com/docusign-cli/llms.txt
>
> Authentication (OAuth, JWT Grant, M2M): https://docusign.docs.buildwithfern.com/platform/auth
> Webhooks and Connect: https://docusign.docs.buildwithfern.com/platform/webhooks
>
> OpenAPI specifications: https://docusign.docs.buildwithfern.com/openapi.json
> MCP server: https://docusign.docs.buildwithfern.com/_mcp/server

# Access token

> Learn how to authenticate the Trust records API.

The Docusign Trust Records API uses OAUTH [Authentication](/platform/auth) to make secure API calls just as all Docusign APIs do.

Use the following scope parameters while generating the access token grant consent URL.

| Scope                | Description             |
| -------------------- | ----------------------- |
| `trust_records_read` | Reads the trust records |

Completion of this entire process is restricted to users with **administrative** privileges.

The API verifies that the authenticated user has the **manage_account** permission on the target account (identified by the accountId path parameter). All endpoints require a JWT Bearer token in the Authorization header, which must be a valid Docusign user access token. For more information about how to use the API to retrieve events and media, see the [Trust Records API How-tos.](/docs/trust-records-api/how-to)