Create Technical Accounts to send agreements via API

Last updated on Dec 1, 2023

Adobe Acrobat Sign Technical Accounts

Acrobat Sign Technical Accounts are a vehicle to enable enterprise-level accounts with the ability to run their applications under the authority of a userID explicitly generated for that purpose (vs. using the admin’s personal userID).

Technical Accounts are available to enterprise customers (via the Adobe Developers Console) on the ETLA buying plan that manages their account through the Adobe Admin Console.

The product card for technical account access can be found on the Products tab of the Admin Console under the offer name Adobe Acrobat Sign Solutions - Enterprise (Look for the API Available flag):

Note

The below process describes the use of Technical Accounts through an API solution. Organizations that want to enable users to manually send agreements on behalf of a centralized party refer to the document for setting up technical accounts through manual connection.

Prerequisites

To enable a technical account, your Acrobat Sign account must:

Have enterprise tier ETLA service
Manage users on the Adobe Admin Console*
Have Advanced Account Sharing enabled

* A note on the Adobe Admin Console

The Adobe Admin Console provides a framework for user management and license allocation. Most customers have only one Admin Console.

However, some customers with complex user/licensing requirements can have multiple Admin Consoles, which may become confusing in a process like Technical Account creation, where one Admin Console may govern the federated user management, and another manages the Acrobat Sign licensing.

If you know you have multiple accounts or aren't sure, please read the below:

The difficulty with multiple Admin Consoles is ensuring that you are in the correct console for the actions you are trying to perform.

To determine if you have multiple Admin Consoles:

1. Log in to the Admin Console.

2. In the upper-right corner of the console, click on the organization name.

If you have a drop-down menu with multiple organizations, you have multiple Admin Consoles.

If you only have one Admin Console, user creation and licensing operations occur in the same organization, and you don't need to worry about switching between consoles.

If you have multiple Admin Consoles, take a moment to determine which organization manages federated user creation and which governs the Acrobat Sign license provisioning.

Companies with multiple Admin Consoles may deploy Acrobat Sign from more than one. You must identify the correct Admin Console where you want to establish the API connection and Technical Account user.

You should inspect each organization to determine which should contain the technical account.

Select the organization.
Select Products from the top rail of options.
Look for the Adobe Sign - Enterprise product card with the API available flag.

For the purpose of this document, we will call this your Licensing Admin Console. This is the organization where:

You define the admin or developer user that will connect the API.
Your technical account user is created and managed.

Organizations that use federated user management must de-sync the federated solution to create a user outside of the federated environment.

To do this, you must inspect each organization to find which one controls the domains that enable the federated trust relationship. Multiple Admin Consoles can Trust a domain, but only one actively controls it.

Select the orgnaization
Select Settings from the top rail of options.
Select Identity from the left rail of options.
If there are directories listed with the Type being Federated ID and the Status is Trusted, click the row the directory is on to expose the Owning Organization.

The Owning Organization is the correct Admin Console to manipulate your federated ID synchronization controls.

An email is provided for the console admin if you do not currently have access.

If the Type is Federated ID and the Status is Active, click the Name of the directory to open the directory settings.

On the settings page, select the Sync tab, which opens the IDP sync information.

For the purpose of this document, we will call this your Federated Sync Admin Console.

Note

If you do not see a Sync tab, your account may have a Global Admin Console that you do not have access to.

You will need to contact your internal Adobe administrators to gain access.

Organizations that

utilize the User Sync Tool (UST) to automatically sync users between Adobe and their Active Directory
do not allow users to be manually added or created in Acrobat Sign

must create an "exception" group for all Technical Account userIDs. All Technical Account userIDs must have their primary group defined as the exempt group to ensure they are not deactivated and do not have their license removed by the automatic user sync.

The exception group must be configured as exempt from the sync within the UST configuration.

In cases where Adobe hosts the UST on behalf of the customer's organization, the customer admin must communicate the Group Name to their Success Manager, Technical Account Manager, or account representative so they can work with the Adobe Customer Solutions team to ensure this group is exempt from the sync.

Overview

Creating a technical account is a multi-step process that requires administrator-level access to the Adobe Acrobat Console and account-level administrator authority in Acrobat Sign.

The process requires the admin:

Enable admin or developer access for the user creating the technical account.
- The user must be an admin or developer to configure the settings that create the technical account.
Create a new Project on the Adobe Developer Console (Adobe.io).
- The project is the required environment to hold the public/private key pair and access token that enables the functionality of the technical account.
Create or Upload a public/private key pair and generate an access token.
- Generating the access token creates the technical account userID in the Adobe Admin Console and populates it into the Acrobat Sign system.
(Optional) Create a new Group in the Acrobat Sign system.
- Creating a dedicated group for the technical account userID allows a very tight configuration of the agreement properties that may be too strict or different from other group configurations.
Privilege the technical account userID in Acrobat Sign as a group-level administrator.
Create a new Federated user in the Adobe Admin Console.
- This creates a user email with your domain to proxy for the technical account useID when sending, providing an email address that is properly attributed to your company.
Share the Federated user's account with the technical account.
- The technical account userID is generated in the Licensing Admin Console with an adobe.com email address. By sharing the Federated user's account, you grant access to the technical account userID to send on behalf of the Federated userID, thereby providing a more human-friendly name/email address for the recipients.
When completed, the API can be configured to use the technical account (via access code) to create and send agreements on behalf of a centralized user.

Enable users to access the Developers Console

Before being able to add a new technical account, the user must first be added to the Adobe Acrobat Sign Solutions - Enterprise product profile (in your Licensing Admin Console) as an Admin or Developer.

Click on the Adobe Acrobat Sign Solutions - Enterprise link in the left-hand rail or products.
Select the default product profile for the Acrobat Sign service.
The Add users to this product page opens:
- Select either the Admin or Developer tab.
Enter the email address of the user you want to grant access.
Click Add Admin/Developer.
Enter the email address of the user you want to grant access.
Enter the first and last name.
Save when done.

Create a new project on the Adobe.io Console

Navigate to https://console.adobe.io
- If you belong to multiple Admin Console instances, make sure you are connected to the instance that aligns with your Licensing Admin Console by clicking the down arrow in the top-right corner of the window.
Select Create new project.
The new Project is displayed on the Projects tab of the console.

Take a moment to name your Project by clicking the Edit Project button.
- Provide a name your coworkers will understand
- Provide a brief description
- Save the edits
Select the new Project (on the Projects tab) to open it for configuration.

On the Get started page:
1. Select Add to Project
2. Select API from the drop-down
On the Add an API page:
1. Select the Document Cloud filter
2. Select Acrobat Sign
3. Click Next

Create a new JSON Web Token

You have the option to generate a new public/private key pair or to upload your public key. Choose the option that best suits your needs:

Select Generate a key pair.
Click Generate keypair.
Once the key pair is created, you are prompted to save the private key to your local system.

The public key is available to copy from the interface:
Select Next.

Select Upload your public key.
Drag your public key certificate to the upload field.
Select Next.

Your uploaded public key is displayed on the Configure API page. You can copy it from here.

You may upload additional keys, or generate new keys as needed.
Select Next when all of your keys have been added.

Select the product profile

The Configure API page refreshes to show the product profile(s) available for your account. You may have one or more depending on the profiles available to your account.

Select the check box for your Default Adobe Acrobat Sign Solutions - Enterprise.
Save Configured API when ready.

Generate an access token

Once saved, the technical account is created, and you are returned to the project home page.

In the Generate access token section, there is an input field for your private key.

Paste the private key you generated/uploaded earlier into the Private key field.
Select Generate Token.
After a moment, the Private key field refreshes to display the Access Token.
Copy and save the access token.
Lower on the same page, you have access to the:
- Client ID
- Client Secret
- Technical Account ID
- Technical Account email
- Organization ID
Copy and save the Technical Account email.

Clone the following repo: https://github.com/AdobeDocs/adobeio-auth/tree/stage/JWT/samples/adobe-jwt-java
In the config.properties file, set the technical account information:
- Apikey
- Technicalaccountid
- Orgid
- Secret
- expirationTime
- metascopes
- key_path
- imshost
- imsExchange
Store the secret.key in DER format inside the target folder.

Consider generating a unique group in Acrobat Sign for the application

Acrobat Sign groups allow for granular configuration of the security and experience settings for the recipient (as well as workflows, templates, reporting, etc.)

If you want to isolate the technical account userID in their own group:

Log in to Acrobat Sign as an account-level administrator.
Navigate to the Groups tab in the admin menu.
Click the plus icon to create a new group.
Enter an intuitive name for the group (perhaps the same name as the Project).
Save the group.
(Optional) Open the new group and configure the settings needed for the application.

Note

If your organization is

using the User Sync Tool (UST) to automatically sync users between Adobe and your Active Directory
not permitting users to be manually added or created in Acrobat Sign

you must create an exception group to be the primary group for all Technical Account userIDs.

The name of the group is added to your UST configuration to ensure the sync process does not impact the userIDs, causing them to be deactivated or to have their entitlement removed.

Privilege the Technical Account userID as a Group administrator in Acrobat Sign

Allow a few minutes for the newly created techacct.adobe.com user to be generated in the Acrobat Sign system.

Log in to your Acrobat Sign account as an Account level administrator.
Navigate to the Users tab of the admin menu.
Search for the new techacct.adobe.com email address (copied from the project home page).
Click on the user and select Edit User Details.
Click the plus icon in the Group Membership section and add the application’s group to the user’s profile.
Select the application’s group and click the Mark as Primary link.
Check the box to flag the userID as a Group Admin.
(Optional) Remove the technical account from the Default group.
Click Save when done.

Create a Reply-To user/email

Sending agreements using the userID/email tied to the technical account is problematic due to the email not being within your company domain.

To solve this issue:

A new federated userID has to be created in the Licensing Admin Console.
The technical account userID has to be shared with the new federated userID (via advance account sharing).

Once configured, the API calls must be configured to use the technical account token as the Authorization value, and the userId or email of the shared userID as the x-on-behalf-of-user value.

Create a new federated userID

Before creating the new userID, you must identify an email address that can be used for inbound replies/questions from your recipients.

To create the new userId:

Log in to your (Federated Sync) Admin Console as an administrator.
Navigate to: Settings → Identity

Select a directory to create the new user.
Select the Sync tab.
Select Go to Settings and click Enable Editing.

When editing is enabled, your Adobe Admin Console allows edits to the user data within the admin console only. Your IdP is not updated with the edits.

Note

Editing will remain enabled for one hour only, or until manually disabled.
Log in to your Licensing Admin Console (if you are working with multiple Admin Consoles).
Navigate to: Users → Add user.
Configure your new userID with:
- Email or username: Use the email address that you want to capture any reply-to eamils from your recipients.
- ID Type: Federated ID
- First/Last name: this value is used in the Acrobat Sign system and is reflected in the audit report. USe a value that provides context. e.g.: Human Resources
- SSO username: Use the same email value.
- Country/Region: Select the appropriate country or region for your company.
- Select the Acrobat Sign product/profile that the technical userID is associated with.
- Set the users role to User.
Click Save when done.
Log back into the Federated Sync Admin Console to enable the synching of your IdP data.
Navigate back to Settings → Identity → {Directory} → Sync → Go to Settings.

Click Disable editing to re-enable the syncing of data with your IdP.
Your new userID will automatically be generated in the Acrobat Sign system.

Share the technical account with the new federated userID

To gain access to the content for a userID you can log in to, the

Log in to Acrobat Sign as an account administrator.
Navigate to the Users tab in the admin menu.
Single click the new user, and Edit User Details.
Select Sharing Status in the left menu.

Ensure the Users's Account Shared With tab is selected.
Select the Shared With User tab at the top of the Sharing Status page.
Share the new userID's account with the technical account
1. Click the plus icon in the top right row to open the selector interface.
2. Click the three lines icon to the right of the search box.
3. Expand the group where the technical account userID resides.
4. Click the plus icon next to the technical account userID to select it.
5. Check the Additional Permission to allow Sending.
6. Click Save.

Test your new technical account

To test that your access code is functioning correctly:

Navigate to the API methods: https://secure.na1.adobesign.com/public/docs/restapi/v6
Select the GET /users method.
In the Authorization field:
1. Type in the word Bearer followed by a space
2. Paste in the Access Code
3. Click Try it out!
The response body will return with a listing of the users in the account and a Response Code of 200:

Navigate to the API methods: https://secure.na1.adobesign.com/public/docs/restapi/v6
Select the POST /users/{userId}/views method.
In the Authorization field:
1. Type in the word Bearer followed by a space.
2. Paste in the Access Code.
In the userId field, enter me.
Click on the Complete Model Schema link.
Click into the yellow field to transfer the schema to the UserViewInfo field.
Edit the UserViewInfo field:
- For the name value, enter ALL.
- For the autoLoginUser value, change it to true.
Click Try it out!

The returned Response Body field contains the URL needed to log in as the user:
Copy the URL and paste it into a browser.
You will be challenged to confirm the login.

Click Yes.

Test sending an agreement using the technical account on behalf of the new userID via API

Obtain a transientDocumentId or have another method to attach a file ready.
Navigate to the API methods: https://secure.na1.adobesign.com/public/docs/restapi/v6#!/agreements/createAgreement
In the Authorization field:
1. Type in the word Bearer followed by a space
2. Paste in the technical account's Access Token
3. In the x-on-behalf-of-user field, enter the email address of the new userID
4. Complete the rest of the AgreementInfo with the transientDocumentId, name of the agreement, signature type, and state.
5. Click Try it out!
Log in to Acrobat Sign as the new userID and navigate to the Manage tab.
Reviewing the agreement audit log, you will see that the agreement was sent by the technical account on behalf of the new userID.

Review the content generated on behalf of the new userID via the Acrobat Sign interface

When the technical account creates an agreement on behalf of the Federated userID, the agreement is published to the Federated userID's Manage page.

It is on the Federated UserIDs Manage page that you can view and manage the agreement.

Streamline your work with Acrobat Sign
Manage and sign documents online quickly and easily.

Open the app

Move a user from one Admin Console organization to another

Create Service Accounts to send agreements under a functional entity

Learn

Learn with step-by-step video tutorials and hands-on guidance right in the app.

Community

Join discussions, find answers, learn from experts, and share your knowledge.

Adobe Home

Access your favorite Creative Cloud apps, services, file management, and more.