Envelope Views

Returns a URL to the recipient view UI. For signer recipients, returns the embedded signing view. Can also be used for other recipient types

POST
/v2.1/accounts/{accountId}/envelopes/{envelopeId}/views/recipient

Returns a URL that enables you to embed the recipient view of the DocuSign UI in your applications. If the recipient is a signer, then the view will provide the signing ceremony.

This method is only used with envelopes in the sent status.

The returned URL

The URL returned in this method's response is intended to be used immediately to redirect the signer to the recipient view. You can open the recipient view in the current browser or in a new tab. After the signer is redirected to the recipient view, they must interact with the Docusign system periodically or their session will time out.

If you want to invite someone to an embedded signing session via email, the email invitation's URL must be to your application. When invoked, your app should request a recipientView URL from Docusign and then redirect the signer to that URL.

How to specify the default language

You can append the locale query parameter to the URL returned by this method to specify a language.

The language for the recipient view follows this order or precedence:

  • The language specified by the sender for the recipient.
  • The locale parameter appended to the URL.
  • The account language if the signer has a Docusign account.
  • The language used in a previous signing if the signer is return signer.
  • The browser language.

For example, to set the default language to Canadian French, you would add this query parameter to the returned URL:

...&locale=fr_CA

Authentication

Your application is responsible for authenticating the identity of the recipient or signer when you use this method. Use the following parameters to record how the recipient was authenticated.

  • assertionId
  • authenticationInstant
  • authenticationMethod
  • clientUserId
  • securityDomain

At a minimum, authenticationMethod and clientUserId are required. The information that you provide is included in the envelope's certificate of completion.

Sending to a remote signer

You can request a signing session for a remote recipient who has a Docusign account.

Authenticate the request using the recipient's credentials, and do not specify a clientUserId. This differs from the typical behavior where the request is authenticated using the sender's credentials, and the recipient has a clientUserId defined.

Redirecting back to returnUrl

After the signer completes or ends the signing ceremony, Docusign redirects the user's browser back to your app via the returnUrl that you supplied in the request.

The signer may be redirected through various Docusign subdomains, depending on the region of the account sending the envelope. Please consult Allowlists for Docusign eSignature service in Security for Docusign eSignature when setting up your allowlists

The event status parameter

Docusign appends an event query parameter to the returnUrl with the outcome of the signing ceremony. Your app can use this event parameter to determine the next step for the envelope. Do not fetch the envelope status by using Envelopes: get or a similar method because doing so will probably hit request and polling limits.

event query parameterMeaning
signing_completeThe recipient has signed the document.
cancelThe recipient decided to finish later.
declineThe recipient declined to sign the document.
exceptionAn exception has occurred on the server during the signing session.
fax_pendingRecipient has a fax pending.
session_timeoutThe recipient did not sign the document in time. The timeout is set to 20 minutes.
ttl_expiredThe token was not used within the timeout period or the token has already been accessed.
viewing_completeThe recipient did not need to sign but has completed the viewing ceremony.

Maintaining State

After the recipient completes the recipient view (or signing ceremony), they are redirected to your application. Your application can recover state information about the transaction by storing information in a cookie, or by including query parameters in the returnUrl field. For example. https://myapp.example.com/docusign_return?myState=12345 When the user is redirected to your app, the event query parameter will be appended. In this example, prevent spoofing by not using a guessable value as the state value.

Related topics

Authorization

OAuth2
AuthorizationBearer <token>

OAuth 2.0 access token obtained via Authorization Code Grant or JWT Grant.

In: header

Path Parameters

accountId*string

The external account number (int) or account ID GUID.

envelopeId*string

The ID of the draft envelope or template to preview.

Request Body

application/json

assertionId?string

A unique identifier of the authentication event executed by the client application.

authenticationInstant?string

A sender-generated value that indicates the date and time that the signer was authenticated.

authenticationMethod?string

Required. Choose a value that most closely matches the technique your application used to authenticate the recipient / signer.

Choose a value from this list:

  • Biometric
  • Email
  • HTTPBasicAuth
  • Kerberos
  • KnowledgeBasedAuth
  • None
  • PaperDocuments
  • Password
  • RSASecureID
  • SingleSignOn_CASiteminder
  • SingleSignOn_InfoCard
  • SingleSignOn_MicrosoftActiveDirectory
  • SingleSignOn_Other
  • SingleSignOn_Passport
  • SingleSignOn_SAML
  • Smartcard
  • SSLMutualAuth
  • X509Certificate

This information is included in the Certificate of Completion.

clientURLs?
clientUserId?string

A sender-created value. If provided, the recipient is treated as an embedded (captive) recipient or signer.

Use your application's client ID (user ID) for the recipient. Doing so enables the details of your application's authentication of the recipient to be connected to the recipient's signature if the signature is disputed or repudiated.

Maximum length: 100 characters.

displayFormat?string
email?string

(Required) Specifies the email of the recipient. You can use either email and userName or userId to identify the recipient.

frameAncestors?array<string>

An array of ancestors that can embed the frame. This property is required when using focus view.

In the demo environment, include your site URL and https://apps-d.docusign.com. You can use http://localhost for local development and testing. Example: ["https://my.site.com", "https://apps-d.docusign.com"]

In the production environment, include your site URL and https://apps.docusign.com. HTTPS must be enabled on your site. Example: ["https://my.site.com", "https://apps.docusign.com"]

messageOrigins?array<string>

The originating domain for the signature request message. This property is required when using focus view.

In the demo environment, the value must be https://apps-d.docusign.com. In production, the value must be https://apps.docusign.com.

pingFrequency?string

Only used if pingUrl is specified. This is the interval, in seconds, between pings on the pingUrl. The default is 300 seconds. Valid values are 60-1200 seconds.

pingUrl?string

The client URL that the Docusign Signing experience should ping to indicate to the client that Signing is active. An HTTP GET call is executed against the client. The response from the client is ignored. The intent is for the client to reset its session timer when the request is received.

recipientId?string

Unique for the recipient. It is used by the tab element to indicate which recipient is to sign the Document.

returnUrl?string

(Required) The URL to which the user should be redirected after the signing session has ended.

Maximum Length: 470 characters. If the returnUrl exceeds this limit, the user is redirected to a truncated URL Be sure to include https:// in the URL or redirecting might fail on some browsers.

When Docusign redirects to this URL, it will include an event query parameter that your app can use:

  • access_code_failed: Recipient used incorrect access code.
  • cancel: Recipient canceled the signing operation, possibly by using the Finish Later option.
  • decline: Recipient declined to sign.
  • exception: A system error occurred during the signing process.
  • fax_pending: Recipient has a fax pending.
  • id_check_failed: Recipient failed an ID check.
  • session_timeout: The session timed out. An account can control this timeout by using the Signer Session Timeout option.
  • signing_complete: The recipient completed the signing ceremony.
  • ttl_expired: The Time To Live token for the envelope has expired. After being successfully invoked, these tokens expire after five minutes.
  • viewing_complete: The recipient completed viewing an envelope that is in a read-only/terminal state, such as completed, declined, or voided.
securityDomain?string

The domain in which the user authenticated.

userId?string

The user ID of the recipient. You can use either the user ID or email and user name to identify the recipient.

If userId is used and a clientUserId is provided, the value in the userId property must match a recipientId (which you can retrieve with a GET recipients call) for the envelope.

If a userId is used and a clientUserId is not provided, the userId must match the user ID of the authenticating user.

userName?string

The username of the recipient. You can use either email and userName or userId to identify the recipient.

xFrameOptions?string

Specifies whether a browser should be allowed to render a page in a frame or IFrame. Setting this property ensures that your content is not embedded into unauthorized pages or frames.

Valid values are:

  • deny: The page cannot be displayed in a frame.
  • same_origin: The page can only be displayed in a frame on the same origin as the page itself.
  • allow_from: The page can only be displayed in a frame on the origin specified by the xFrameOptionsAllowFromUrl property.
xFrameOptionsAllowFromUrl?string

When the value of xFrameOptions is allow_from, this property specifies the origin on which the page is allowed to display in a frame. If the value of xFrameOptions is allow_from, you must include a value for this property.

Response Body

application/json

application/json

curl -X POST "https://example.com/v2.1/accounts/string/envelopes/string/views/recipient" \  -H "Content-Type: application/json" \  -d '{}'
{  "url": "string"}

Returns a URL to the edit view UI. Use before an envelope has been sent POST

This API method has been replaced by the [EnvelopeViews:createSender](https://developers.docusign.com/docs/esign-rest-api/reference/envelopes/envelopeviews/createsender/) API method. The two API methods work exactly the same, **Migration required** To solve an application security issue, you must migrate to the new API request format. See the [EnvelopeViews:createSender](https://developers.docusign.com/docs/esign-rest-api/reference/envelopes/envelopeviews/createsender/) API method for more information. Backwards compatibility will be provided for a limited time.

Returns a URL to the sender view UI. Used before an envelope has been sent POST

Returns a URL that enables you to embed the envelope sender view of the Docusign UI. You can customize the appearance of the view via the settings request attribute. You can embed the view in an iframe. **API request update** The request object for this API method was updated in June 2024. The new API request format is described below. Existing applications must update to the new version; it solves a security issue with the old version. The deprecation schedule has been announced in the [Docusign Core Release Notes](https://support.docusign.com/s/document-item?language=en_US&bundleId=adp1720620778794_24-2-02-00-demo&topicId=wcz1616195757589.html&_LANG=enus). While backwards compatibility will be provided for a while for existing applications, all applications must be updated to be secure. See below for migration information. **Best practices** The returned URL expires after 10 minutes. Therefore, request the URL immediately before you redirect your user to it. Due to screen space issues, do not use an iframe for embedded operations on mobile devices. For mobile applications, use a [WebView](https://developer.android.com/reference/android/webkit/WebView) (Android) or [WKWebView](https://developer.apple.com/documentation/webkit/wkwebview) (iOS). ## Customizing the user experience By default, the view includes two pages: the **Prepare** and **Tagger** pages. The settings object is used to control the user experience. For example, to limit the user to the **Tagger** page, and not allow the user to change the recipient information: * `"startingScreen": "Tagger"` * `"showBackButton": "false"` * `"showEditRecipients": "false"` Use the [Embedded Views Test Too](https://docusign.github.io/app-examples/embedded-views-v2/) to try the different UX controls. Some UI settings attributes are not yet implemented. ### The envelope must be in the correct state for the Embedded View To use the Sender View, the envelope **must** be in the `created` state. Otherwise, a 400 error will be returned with an error message in the response body: ``` { "errorCode": "ENVELOPE_INVALID_STATUS", "message": "Invalid envelope status. Sender view cannot be created for an envelope that is not in a draft state." } ``` ### Closing the view's iframe If you choose to embed the view in your application via an iframe, Docusign recommends this software pattern to close the iframe after the view has completed: * (One time) create a standalone “return” page that you will use as the `returnUrl` target for the view. The view will redirect the iframe to this URL when it has completed. Here's an [example return page](https://github.com/docusign/docusign.github.io/blob/master/jsfiddleDsResponse.html). In this page, use JavaScript and the [postMessage](https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage) method to send a message to your application with the results of the view. * In your application, use `window.addEventListener("message", function_name)` to register a listener for incoming messages. * To show the view, use this API method, then set the iframe to load the URL from the API response. * In your application, receive the completion message, validate it, and then close the iframe. ### Information security This view only has write access to the specific envelope referenced in the API call. It also has read access to templates and other secondary information that a user can access to modify the envelope. The read access corresponds to the access rights of the user associated with the access token used for the API call. >**Recommendations:** >* Use the access token of a service user who can access the templates appropriate for your use case. >* Do not use the access token of a user with administrator privileges. ## Migrating to the current version of the request object This section only applies to existing applications that use the older version of the request object. Migrating from the old API request object to the new version will take under a day of developer time. **Step 1.** Does your application set the `returnUrl` attribute? Yes: continue with step 2. No: In this case, your users first update the envelope, and then the Docusign eSignature home screen is shown. To accomplish this UI pattern with the new API request format: * Set the `returnUrl` to a new endpoint for your application. You can use query parameters or session data to manage state. Remember to authenticate the incoming requests. * When the new endpoint is called, use the [EnvelopeViews:createConsole](https://developers.docusign.com/docs/esign-rest-api/reference/envelopes/envelopeviews/createconsole/) API call to obtain and then display the Docusign eSignature home page to your application's user. **Step 2.** Does your application modify the default UI of the view? No: continue with step 3. Yes: With the new API request object, UI controls for the view are now set when you make the API call via the `settings` attribute. * Note the UI settings your application is currently modifying by adding and updating query parameters on the URL _returned_ by the API method. * Using the reference documentation below, create a settings object that accomplishes your UI goals. You can use the [Embedded Views Test tool](https://docusign.github.io/app-examples/embedded-views-v2/) to check your UI settings. Note that the `settings` object includes multiple objects and subobjects for various UI settings. * **Delete the code** in your application that modifies and adds query parameters to the URL returned by the API. With the new API format, your application will not make any changes to the returned URL. Exception: If you set the view's locale specifically, that is still accomplished by appending the `locale` query parameter. **Step 3.** Is the envelope always in the right state before you call the Embedded View? If your software may try to create the Embedded View when the envelope is not in the right state (see above), then you must add additional checks and logic to prevent this. **Step 4.** Check that these API attributes are set: * `"view" = "envelope"` * The `returnUrl` is set **Step 5.** All done! Test your application.