Docusign Rest API, receiving “USER_LACKS_PERMISSIONS” when doing Send on behalf of

Question

I am creating envelopes and everything was working fine before I included the SendOnBehalfOf tag. I am receiving the error, "USER_LACKS_PERMISSIONS". I have checked my account permissions and the Send On Behalf Rights (API) is checked as well as the Account Wide Rights.

Here is the header created on the request:

POST https://demo.docusign.net/restapi/v2/accounts/49f49b40-fda4-4fbb-8db2-9326a7a1eb91/envelopes HTTP/1.1
Host: demo.docusign.net
X-DocuSign-Authentication: <DocuSignCredentials><SendOnBehalfOf>kelder@gennet.com</SendOnBehalfOf><Username>pserrate@gennet.com</Username><Password>*****</Password><IntegratorKey>FIRS-623bd271-aa91-40ca-9983-835c1586527b</IntegratorKey></DocuSignCredentials>
Content-Type: multipart/form-data; boundary=MY_BOUNDARY
Accept: application/json
Content-Length: 824511
Expect: 100-continue

Here is the response I get from DocuSign:

HTTP/1.1 401 Unauthorized
Cache-Control: no-cache
Content-Length: 126
Content-Type: application/json; charset=utf-8
Date: Tue, 03 Dec 2013 21:14:18 GMT
Strict-Transport-Security: max-age=7776000; includeSubDomains

{
  "errorCode": "USER_LACKS_PERMISSIONS",
  "message": "This user lacks sufficient permissions to access this resource."
}

Can you please let me know what I am missing or if this is a setting that needs to be updated/turned on on the DocuSign end?

Answer 1

Getting the "User Lacks Permissions" error when using "Send on behalf of" with the Create Envelope API request most likely indicates an issue with the send-on-behalf-of user account. A couple of things to check:

• The SendOnBehalfOf email address (kelder@gennet.com in your case) must correspond (exactly, perhaps may even be case-sensitive) to another member of the same DocuSign account. ie, if you login to the DocuSign web console with your (admin) credentials, and navigate to Preferences >> Users -- you should see an Active user that uses the SendOnBehalfOf email address.

• The membership that corresponds to the SendOnBehalfOf email address must have permissions to Send Envelopes. Verify this by navigating (in the DocuSign web console) to Preferences >> User >> [click link to Open user] >> Permissions (button) . For example, the following member would not be capable of sending an envelope, because he has Permission Profile = DocuSign Viewer and the Send Envelopes setting is not selected:

Update --- also verify the following:

• Both kelder@gennet.com and pserrate@gennet.com must be members of the same DocuSign account.

• The account number of the account in which kelder@gennet.com and pserrate@gennet.com are members must be the same as you're specifying in the URL (ie, in your example: 49f49b40-fda4-4fbb-8db2-9326a7a1eb91 ).

• The member with email address pserrate@gennet.com must have these permissions enabled: Account-Wide Rights , Send On Behalf Of Rights (API) , Sequential Signing (API) .

If you've verified all of the above, and it still isn't working, then to troubleshoot further, I'd suggest that you try sending an envelope (via the EXACT SAME URL and with the EXACT SAME REQUEST BODY) twice -- once as pserrate@gennet.com and once as kelder@gennet.com -- but both times, without using the <SendOnBehalfOf> element in the X-DocuSign-Authentication header. Once you do that, post the results here as a Comment, and I'll provide further feedback.