User Guide Cancel

Create Technical Accounts to send agreements via API

 

Adobe Acrobat Sign Guide

What's New

Get Started

Administer

Send, Sign, and Manage Agreements

Advanced Agreement Capabilities and Workflows

Integrate with other products

Acrobat Sign Developer

Support and Troubleshooting

Adobe Acrobat Sign Technical Accounts

Acrobat Sign Technical Accounts are a vehicle to enable enterprise-level accounts with the ability to run their applications under the authority of a userID explicitly generated for that purpose (vs. using the admin’s personal userID).

Technical Accounts are available to enterprise customers (via the Adobe Developers Console) on the ETLA buying plan that manages their account through the Adobe Admin Console.

The product card for technical account access can be found on the Products tab of the Admin Console under the offer name Adobe Acrobat Sign Solutions - Enterprise (Look for the API Available flag):

Tech Account product cards

Note:

The below process describes the use of Technical Accounts through an API solution. Organizations that want to enable users to manually send agreements on behalf of a centralized party refer to the document for setting up technical accounts through manual connection.

Prerequisites

To enable a technical account, your Acrobat Sign account must:

  • Have enterprise tier ETLA service
  • Manage users on the Adobe Admin Console*
  • Have Advanced Account Sharing enabled

* A note on the Adobe Admin Console

The Adobe Admin Console provides a framework for user management and license allocation. Most customers have only one Admin Console.

However, some customers with complex user/licensing requirements can have multiple Admin Consoles, which may become confusing in a process like Technical Account creation, where one Admin Console may govern the federated user management, and another manages the Acrobat Sign licensing.

If you know you have multiple accounts or aren't sure, please read the below:

Overview

Creating a technical account is a multi-step process that requires administrator-level access to the Adobe Acrobat Console and account-level administrator authority in Acrobat Sign.

The process requires the admin:

  1. Enable admin or developer access for the user creating the technical account.
    • The user must be an admin or developer to configure the settings that create the technical account.
  2. Create a new Project on the Adobe Developer Console (Adobe.io).
    • The project is the required environment to hold the public/private key pair and access token that enables the functionality of the technical account.
  3. Create or Upload a public/private key pair and generate an access token.
    • Generating the access token creates the technical account userID in the Adobe Admin Console and populates it into the Acrobat Sign system.
  4. (Optional) Create a new Group in the Acrobat Sign system.
    • Creating a dedicated group for the technical account userID allows a very tight configuration of the agreement properties that may be too strict or different from other group configurations.
  5. Privilege the technical account userID in Acrobat Sign as a group-level administrator.
  6. Create a new Federated user in the Adobe Admin Console.
    • This creates a user email with your domain to proxy for the technical account useID when sending, providing an email address that is properly attributed to your company.
  7. Share the Federated user's account with the technical account.
    • The technical account userID is generated in the Licensing Admin Console with an adobe.com email address. By sharing the Federated user's account, you grant access to the technical account userID to send on behalf of the Federated userID, thereby providing a more human-friendly name/email address for the recipients.

    When completed, the API can be configured to use the technical account (via access code) to create and send agreements on behalf of a centralized user.

Enable users to access the Developers Console

Before being able to add a new technical account, the user must first be added to the Adobe Acrobat Sign Solutions - Enterprise product profile (in your Licensing Admin Console) as an Admin or Developer.

  1. Click on the Adobe Acrobat Sign Solutions - Enterprise link in the left-hand rail or products.

  2. Select the default product profile for the Acrobat Sign service.

    Select product profile

  3. The Add users to this product page opens:

    • Select either the Admin or Developer tab.
  4. Enter the email address of the user you want to grant access.

  5. Click Add Admin/Developer.

    Add Developer

  6. Enter the email address of the user you want to grant access.

  7. Enter the first and last name.

  8. Save when done.

    Enter developer information

Create a new project on the Adobe.io Console

  1. Navigate to https://console.adobe.io

    • If you belong to multiple Admin Console instances, make sure you are connected to the instance that aligns with your Licensing Admin Console by clicking the down arrow in the top-right corner of the window.
    Admin Console instances

  2. Select Create new project.

    Create a new project

  3. The new Project is displayed on the Projects tab of the console.

    Take a moment to name your Project by clicking the Edit Project button.

    • Provide a name your coworkers will understand
    • Provide a brief description
    • Save the edits
    Edit the project

  4. Select the new Project (on the Projects tab) to open it for configuration.

    On the Get started page:

    1. Select Add to Project
    2. Select API from the drop-down
    Add API

  5. On the Add an API page:

    1. Select the Document Cloud filter
    2. Select Acrobat Sign
    3. Click Next
    Select Acrobat Sign

Create a new JSON Web Token

You have the option to generate a new public/private key pair or to upload your public key. Choose the option that best suits your needs:

Select the product profile

The Configure API page refreshes to show the product profile(s) available for your account. You may have one or more depending on the profiles available to your account.

  1. Select the check box for your Default Adobe Acrobat Sign Solutions - Enterprise.
  2. Save Configured API when ready.
Save configured API

Generate an access token

Once saved, the technical account is created, and you are returned to the project home page.

In the Generate access token section, there is an input field for your private key. 

  1. Paste the private key you generated/uploaded earlier into the Private key field.

  2. Select Generate Token.

  3. After a moment, the Private key field refreshes to display the Access Token.

  4. Copy and save the access token.

    Generate the access token

  5. Lower on the same page, you have access to the:

    • Client ID
    • Client Secret
    • Technical Account ID
    • Technical Account email
    • Organization ID

    Copy and save the Technical Account email.

    Save the Tech Account email

Consider generating a unique group in Acrobat Sign for the application

Acrobat Sign groups allow for granular configuration of the security and experience settings for the recipient (as well as workflows, templates, reporting, etc.)

If you want to isolate the technical account userID in their own group:

  1. Log in to Acrobat Sign as an account-level administrator.

  2. Navigate to the Groups tab in the admin menu.

  3. Click the plus icon to create a new group.

  4. Enter an intuitive name for the group (perhaps the same name as the Project).

  5. Save the group.

  6. (Optional) Open the new group and configure the settings needed for the application.

    Create a group

Note:

If your organization is

  • using the User Sync Tool (UST) to automatically sync users between Adobe and your Active Directory
  • not permitting users to be manually added or created in Acrobat Sign

you must create an exception group to be the primary group for all Technical Account userIDs.

The name of the group is added to your UST configuration to ensure the sync process does not impact the userIDs, causing them to be deactivated or to have their entitlement removed.

Privilege the Technical Account userID as a Group administrator in Acrobat Sign

Allow a few minutes for the newly created techacct.adobe.com user to be generated in the Acrobat Sign system.

  1. Log in to your Acrobat Sign account as an Account level administrator.

  2. Navigate to the Users tab of the admin menu.

  3. Search for the new techacct.adobe.com email address (copied from the project home page).

  4. Click on the user and select Edit User Details.

    Edit user details

  5. Click the plus icon in the  Group Membership section and add the application’s group to the user’s profile.

  6. Select the application’s group and click the Mark as Primary link.

  7. Check the box to flag the userID as a Group Admin.

  8. (Optional) Remove the technical account from the Default group.

  9. Click Save when done.

    Save the user settings

Create a Reply-To user/email

Sending agreements using the userID/email tied to the technical account is problematic due to the email not being within your company domain.

To solve this issue:

  • A new federated userID has to be created in the Licensing Admin Console.
  • The technical account userID has to be shared with the new federated userID (via advance account sharing).

Once configured, the API calls must be configured to use the technical account token as the Authorization value, and the userId or email of the shared userID as the x-on-behalf-of-user value.

Create a new federated userID

Before creating the new userID, you must identify an email address that can be used for inbound replies/questions from your recipients.

To create the new userId:

  1. Log in to your (Federated Sync) Admin Console as an administrator.

  2. Navigate to:  Settings → Identity

    Select a directory to create the new user.

    Active domain

  3. Select the Sync tab.

  4. Select Go to Settings and click Enable Editing.

    When editing is enabled, your Adobe Admin Console allows edits to the user data within the admin console only. Your IdP is not updated with the edits.

    Directory settings - sync tab

    Note:

    Editing will remain enabled for one hour only, or until manually disabled.

    Tech Account

  5. Log in to your Licensing Admin Console (if you are working with multiple Admin Consoles).

  6. Navigate to: Users → Add user.

  7. Configure your new userID with:

    • Email or username: Use the email address that you want to capture any reply-to eamils from your recipients.
    • ID Type: Federated ID
    • First/Last name: this value is used in the Acrobat Sign system and is reflected in the audit report. USe a value that provides context. e.g.: Human Resources
    • SSO username: Use the same email value.
    • Country/Region: Select the appropriate country or region for your company.
    • Select the Acrobat Sign product/profile that the technical userID is associated with.
    • Set the users role to User.

    Click Save when done.

    Tech Account

  8. Log back into the Federated Sync Admin Console to enable the synching of your IdP data.

  9. Navigate back to Settings → Identity → {Directory} → Sync → Go to Settings.

    Click Disable editing to re-enable the syncing of data with your IdP.

  10. Your new userID will automatically be generated in the Acrobat Sign system.

Share the technical account with the new federated userID

To gain access to the content for a userID you can log in to, the 

  1. Log in to Acrobat Sign as an account administrator.

  2. Navigate to the Users tab in the admin menu.

  3. Single click the new user, and Edit User Details.

  4. Select Sharing Status in the left menu.

    Ensure the Users's Account Shared With tab is selected.

  5. Select the Shared With User tab at the top of the Sharing Status page.

  6. Share the new userID's account with the technical account

    1. Click the plus icon in the top right row to open the selector interface.
    2. Click the three lines icon to the right of the search box.
    3. Expand the group where the technical account userID resides.
    4. Click the plus icon next to the technical account userID to select it.
    5. Check the Additional Permission to allow Sending.
    6. Click Save.
    Tech Account

Test your new technical account

To test that your access code is functioning correctly:

  1. Select the GET /users method.

  2. In the Authorization field:

    1. Type in the word Bearer followed by a space
    2. Paste in the Access Code
    3. Click Try it out!
    Try it out!

  3. The response body will return with a listing of the users in the account and a Response Code of 200:

    Response body

Test sending an agreement using the technical account on behalf of the new userID via API

  1. Obtain a transientDocumentId or have another method to attach a file ready.

  2. In the Authorization field:

    1. Type in the word Bearer followed by a space
    2. Paste in the technical account's Access Token
    3. In the x-on-behalf-of-user field, enter the email address of the new userID
    4. Complete the rest of the AgreementInfo with the transientDocumentId, name of the agreement, signature type, and state.
    5. Click Try it out!
    Try it out!

  3. Log in to Acrobat Sign as the new userID and navigate to the Manage tab.

  4. Reviewing the agreement audit log, you will see that the agreement was sent by the technical account on behalf of the new userID.

Review the content generated on behalf of the new userID via the Acrobat Sign interface

When the technical account creates an agreement on behalf of the Federated userID, the agreement is published to the Federated userID's Manage page.

It is on the Federated UserIDs Manage page that you can view and manage the agreement.

Agreement sent on behalf of the user

Get help faster and easier

New user?