> You are reading the Docusign Developer Documentation. For clean Markdown of any page, append .md to the page URL. > > Documentation indexes by section: > - APIs and SDKs: https://docusign.docs.buildwithfern.com/docs/llms.txt > - Platform 101: https://docusign.docs.buildwithfern.com/platform/llms.txt > - Extension Apps: https://docusign.docs.buildwithfern.com/extension-apps/llms.txt > - Docusign CLI: https://docusign.docs.buildwithfern.com/docusign-cli/llms.txt > > Authentication (OAuth, JWT Grant, M2M): https://docusign.docs.buildwithfern.com/platform/auth > Webhooks and Connect: https://docusign.docs.buildwithfern.com/platform/webhooks > > OpenAPI specifications: https://docusign.docs.buildwithfern.com/openapi.json > MCP server: https://docusign.docs.buildwithfern.com/_mcp/server # Authentication scopes > Lists and describes the scopes used by each API in the Docusign platform. The Docusign platform defines the following scopes. Each scope is required to perform a set of actions associated with its originating API. | Scope name | Originating API | Description | | --------------------------------- | -------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `impersonation` | N/A | Required for applications that impersonate users to perform API calls. Used in [JWT Grant authentication](/platform/auth/jwt). | | `extended` | N/A | Used when requesting an access token using Authorization Code Grant. If you request the `extended` scope using Authorization Code Grant, a new refresh token is issued with a full lifetime (typically 30 days). Otherwise, the issued refresh token will have the same expiration date as the original token (typically 30 days from the first login). | | `signature` | [eSignature REST API](/docs/esign-rest-api) | Required to call most eSignature REST API endpoints | | `openid` | [eSignature REST API](/docs/esign-rest-api) | Enables you to grant consent to an external app on behalf of your users. See [Obtain and revoke consent](/platform/auth/consent) for details. | | `cors` | [eSignature REST API](/docs/esign-rest-api) | Required for single-page applications (SPAs) and other browser-based applications that send eSignature API requests directly from scripts running in a browser. See [Single-page applications and CORS](/platform/single-page-applications-cors) for details. | | `click.manage` | [Click API](/docs/click-api) | Enables all elastic template operations, including creating, sending, and updating elastic templates; getting a list of elastic templates, creating user agreements, getting a list of users, and retrieving responses | | `click.send` | [Click API](/docs/click-api) | Required to send a new elastic template or check for a previously sent one | | `content` | [CLM API](/docs/clm-api) | Read and write access to CLM document content | | `spring_read` | [CLM API](/docs/clm-api) | Read access to all types of CLM objects | | `spring_write` | [CLM API](/docs/clm-api) | Write access to all types of CLM objects | | `adm_store_unified_repo_read` | [Connected Fields API overview](/docs/connected-fields-api) and [Agreement Manager API](/docs/agreement-manager-api) | Required to read agreement data from the Navigator and Connected Fields APIs. | | `organization_read` | [Docusign Admin API](/docs/admin-api) | Required to get lists of organizations and organization data | | `group_read` | [Docusign Admin API](/docs/admin-api) | Required to get lists of groups associated with an account | | `permission_read` | [Docusign Admin API](/docs/admin-api) | Required to get lists of permission profiles associated with an account | | `user_read` | [Docusign Admin API](/docs/admin-api) | Required to read user data | | `user_write` | [Docusign Admin API](/docs/admin-api) | Required to update, create, or delete users | | `account_read` | [Docusign Admin API](/docs/admin-api) | Required to get account data | | `domain_read` | [Docusign Admin API](/docs/admin-api) | Required to get data on claimed domains for the organization | | `identity_provider_read` | [Docusign Admin API](/docs/admin-api) | Required to get data on already-defined identity providers for an organization | | `user_data_redact` | [Docusign Admin API](/docs/admin-api) | Deletes personal data for closed user accounts | | `asset_group_account_read` | [Docusign Admin API](/docs/admin-api) | Gets a list of organization accounts that indicates which accounts are [eligible to be cloned](/docs/admin-api/admin101/clone-accounts#source-accounts-must-be-compliant) | | `asset_group_account_clone_write` | [Docusign Admin API](/docs/admin-api) | Initiates an [account cloning process](/docs/admin-api/admin101/clone-accounts#cloning-request-processing) | | `asset_group_account_clone_read` | [Docusign Admin API](/docs/admin-api) | Gets status and results for [account cloning processes](/docs/admin-api/admin101/clone-accounts#cloning-request-processing) | | `connect_org_config_read_api` | [Docusign Admin API](/docs/admin-api) | Reads data for an Organization-Level Connect configuration | | `connect_org_config_write_api` | [Docusign Admin API](/docs/admin-api) | Writes data for an Organization-Level Connect configuration | | `connect_org_oauth_read_api` | [Docusign Admin API](/docs/admin-api) | Reads data for your Organization-Level Connect configuration OAuth settings | | `connect_org_oauth_write_api` | [Docusign Admin API](/docs/admin-api) | Writes data for your Organization-Level Connect configuration OAuth settings | | `connect_org_hmac_read_api` | [Docusign Admin API](/docs/admin-api) | Read a list of the HMAC keys for your organization | | `connect_org_hmac_write_api` | [Docusign Admin API](/docs/admin-api) | Create new HMAC keys for your organization | | `dtr.rooms.read` | [Rooms API](/docs/rooms-api) and [Workspaces API](/docs/workspaces-api) | Read Docusign room or workspace data | | `dtr.rooms.write` | [Rooms API](/docs/rooms-api) and [Workspaces API](/docs/workspaces-api) | Update the data of a Docusign room or workspace | | `dtr.documents.read` | [Rooms API](/docs/rooms-api) | Read documents from Docusign rooms | | `dtr.documents.write` | [Rooms API](/docs/rooms-api) and [Workspaces API](/docs/workspaces-api) | Write documents to Docusign rooms or workspaces | | `dtr.profile.read` | [Rooms API](/docs/rooms-api) | Read profile data for accounts or signers associated with your company | | `dtr.profile.write` | [Rooms API](/docs/rooms-api) | Write profile data to accounts or signers associated with your company | | `dtr.company.read` | [Rooms API](/docs/rooms-api) | Read information from all rooms and profiles associated with your company | | `dtr.company.write` | [Rooms API](/docs/rooms-api) | Write information to all rooms and profiles associated with your company | | `room_forms` | [Rooms API](/docs/rooms-api) | Use endpoints related to the [Forms](/docs/rooms-api/rooms101/forms) feature | | `aow_manage` | [Workflow Builder API](/docs/workflow-builder-api) | Required for every Maestro API call. | | `notary_write` | [Notary API](/docs/notary-api) | Required to update Notary API data | | `notary_read` | [Notary API](/docs/notary-api) | Required to read Notary API data | | `webforms_read` | [Web Forms API](/docs/web-forms-api) | Required to retrieve information about [web form configurations](/docs/web-forms-api/web-forms-101/concepts#web-form-configurations) defined in an account | | `webforms_instance_read` | [Web Forms API](/docs/web-forms-api) | Required to retrieve information about [web form instances](/docs/web-forms-api/web-forms-101/concepts#web-form-instances) | | `webforms_instance_write` | [Web Forms API](/docs/web-forms-api) | Required to create web form instances and refresh [instance tokens](/docs/web-forms-api/plan-integration/expirations-timeouts#instance-token-expiration) | | `adm_store_unified_repo_read` | [Agreement Manager API](/docs/agreement-manager-api) | Required for getting agreement data from Navigator API | | `models_read` | [Agreement Manager API](/docs/agreement-manager-api) | Used to the read model schema. Not currently required for any Navigator API endpoint methods, but it should be requested by apps making Navigator API calls to support forward-compatibility, as a best practice. | | `document_uploader_read` | [Agreement Manager API](/docs/agreement-manager-api) | Required for reading documents when uploading with Navigator API calls | | `document_uploader_write` | [Agreement Manager API](/docs/agreement-manager-api) | Required for updating documents when uploading with Navigator API calls | ## Next steps * Learn more about [Authenticate](/platform/auth) on the Docusign platform. * See examples of how to obtain an access token using the [Authorization Code Grant](/platform/auth/confidential-authcode-get-token), [Implicit Grant](/platform/auth/implicit-get-token), and [JWT Grant](/platform/auth/jwt-get-token), including example syntax showing how scopes are used. * Learn about options for [obtaining and revoking consent](/platform/auth/consent).