{ "data": { "a": { "slug": "boldsign", "name": "BoldSign", "vendor": "Syncfusion, Inc.", "vendorUrl": "https://boldsign.com", "kind": "http-api", "category": "e-signatures", "summary": "BoldSign is Syncfusion's electronic signature service. Its REST API sends documents for signature from files or templates, embeds signing and requesting in other products, manages templates, users and teams, and reports events by webhook, with a hosted MCP server.", "url": "https://www.anchorterminal.com/tools/boldsign", "markdownUrl": "https://www.anchorterminal.com/tools/boldsign.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/boldsign.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/boldsign.json", "dns": "boldsign.grade.anchorterminal.com", "repo": "https://github.com/boldsign/boldsign-node-sdk", "license": "Proprietary hosted service under the BoldSign Terms of Use. The five official SDKs and the deprecated local MCP package on GitHub are MIT", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.boldsign.com/v1", "packages": [ { "registry": "npm", "name": "boldsign" }, { "registry": "pypi", "name": "boldsign" }, { "registry": "nuget", "name": "BoldSign.Api" } ], "auth": "mixed", "authNotes": "An API key in the X-API-KEY header, generated in the web app under API, API Key, with all scopes and an optional expiry date, at most four keys per account and two per environment (Live or Sandbox). Or OAuth 2.0 at account.boldsign.com with authorisation code and PKCE, client credentials and refresh tokens, and 20 scopes such as BoldSign.Documents.Create and BoldSign.Templates.Read. The hosted MCP server takes the same key as X-API-Key or OAuth sign-in from Claude Web and ChatGPT. Keys are self-serve; live API access needs the Enterprise API plan.", "pricing": "freemium", "pricingNotes": "The free sandbox gives full API access with no card. Documents are watermarked and deleted after 14 days. Live API access is the Enterprise API plan from $30 a month with 40 envelopes and $0.75 per additional envelope, with a 30-day trial and no card. Add-ons are priced per unit (bulk send $0.25 an envelope, SMS $0.20, ID verification $2, KBA $1.50 an attempt, QES $3 a signing attempt). Live MCP use needs the Enterprise API plan at the normal envelope charge (https://boldsign.com/electronic-signature-pricing/, checked 2026-11-03).", "priceSummary": "$30 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the Swagger file, the pricing page or the MCP docs (checked 2026-11-03). Plans are paid by card through Stripe in the web app.", "endpoints": [] }, "toolCount": 14, "popularity": { "githubStars": 1, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://developers.boldsign.com/", "llmsTxt": "https://developers.boldsign.com/llms.txt", "openapi": "https://api.boldsign.com/swagger/v1/swagger.json", "capabilities": [ "esign.send", "esign.templates", "esign.embed", "esign.status" ], "tags": [ "official", "hosted", "closed-source", "api-key", "oauth", "openapi", "llms-txt", "mcp", "remote-mcp", "webhooks", "sandbox", "free-tier", "freemium", "eu-region", "status-page", "security-txt", "soc2", "python", "typescript", "dotnet", "java", "php" ], "lastRelease": "2026-10-16", "graded": true, "anchor": { "graded": true, "score": 70.3, "grade": "BB", "agentReady": true, "rank": 190, "ranked": true, "rankOf": 1349, "categoryRank": 2, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 62, "maintenance": 78, "payments": 40, "reliability": 84, "schema": 85, "security": 63, "transparency": 77 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": 0, "verdict": "A public OpenAPI file, llms.txt, 20 OAuth scopes, published rate limits, a free sandbox and a clean 90-day status history. API keys carry every scope, there are no idempotency keys, the 2,000-an-hour account limit is low for bulk work, and the hosted MCP server's 14 tools include sending and revoking with no confirmation step of their own.", "bestFor": "A product team embedding signing, requesting and templates at a per-envelope price with regional hosting in the US, EU, Canada or Australia, and an agent that sends from templates and tracks status through the hosted MCP server.", "strengths": [ "OpenAPI 3.0.4 file with 87 operations, llms.txt and a Markdown twin of every docs page", "OAuth 2.0 with authorisation code and PKCE, client credentials, single-use refresh tokens and 20 scopes split by resource and action", "Rate limits published per account, 2,000 requests an hour live and 50 in the sandbox, with usage headers", "Free sandbox with full API access and no card, and live API from $30 a month with $0.75 per extra envelope", "No incident on status.boldsign.com between 5 August and 3 November 2026, with components per region", "Dated API changelog since April 2021 with breaking changes labelled, and five official SDKs updated in August to October 2026" ], "weaknesses": [ "API keys carry every scope and the docs say that is not customisable; only OAuth apps get narrower scopes, and there is no Documents.Read scope", "No idempotency keys, and no Retry-After documented for the 429", "64 of the 87 operation descriptions in the Swagger file are under 40 characters, and the file carries no examples", "The hosted MCP server's tool schemas are not published, it sends, reminds and revokes with no built-in confirmation, and it is not in the official MCP registry", "No SLA document was found. security.txt advertises a 99.999 per cent uptime SLA and the terms disclaim uninterrupted service" ], "agentNotes": [ "Send `X-API-KEY: $BOLDSIGN_API_KEY` to the regional base URL (api.boldsign.com, api-eu, api-ca or api-au); a key from one region fails on another, and the MCP endpoint must match too", "Build against a Sandbox key first. Sandbox documents are watermarked and deleted after 14 days, and the sandbox allows only 50 requests an hour", "Stay under 2,000 requests an hour per account in production and use webhooks instead of polling `document/properties`; on a 429 wait for the window to reset", "Don't retry a timed-out `document/send` blindly. There is no idempotency key, so list documents by title or search before sending again", "Verify `X-BoldSign-Signature` (HMAC-SHA256 with the endpoint secret) on every webhook before acting on its payload", "On the MCP server, start with `list_templates` and `get_document_properties`, and confirm with the person before `send_document_from_template`, `send_reminder_for_document_sign` or `revoke_document`" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 70.3 } ], "editorialScores": { "ergonomics": 62, "maintenance": 78, "payments": 40, "reliability": 84, "schema": 85, "security": 63, "transparency": 59 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install boldsign", "http": "curl -H \"X-API-KEY: $BOLDSIGN_API_KEY\" \"https://api.boldsign.com/v1/document/list?Page=1\u0026PageSize=10\"", "claudeCode": "claude mcp add boldsign --transport http https://mcp.boldsign.com/mcp --header \"X-API-Key: $BOLDSIGN_API_KEY\"", "config": { "mcpServers": { "boldsign": { "headers": { "X-API-Key": "${BOLDSIGN_API_KEY}" }, "type": "http", "url": "https://mcp.boldsign.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/esign.send", "tool": "https://letme.dev/boldsign" }, "area": "business", "unitPrices": [ { "item": "Enterprise API plan", "unit": "month", "usd": 30, "note": "starting price with 40 envelopes and two application users" }, { "item": "Additional envelope, Enterprise API", "unit": "tx", "usd": 0.75, "note": "one envelope can hold several files, signers and CCs" }, { "item": "Bulk send or bulk link envelope", "unit": "tx", "usd": 0.25 }, { "item": "SMS envelope", "unit": "message", "usd": 0.2, "note": "WhatsApp $0.10 a message" }, { "item": "ID verification", "unit": "tx", "usd": 2, "note": "KBA $1.50 an attempt, QES $3 a signing attempt" } ], "provenance": { "legalEntity": "Syncfusion, Inc.", "domain": "boldsign.com", "domainRegistered": "2013-12-20", "endpointOnVendorDomain": true, "terms": "https://boldsign.com/terms-of-use/", "privacy": "https://boldsign.com/privacy-policy/", "statusPage": "https://status.boldsign.com/", "changelog": "https://developers.boldsign.com/api-overview/changelog", "securityTxt": "valid", "checked": "2026-11-03", "notes": [ "The Terms of Use (effective February 2025) name Syncfusion, Inc., a Delaware corporation in Morrisville, North Carolina, under North Carolina law with AAA arbitration in Raleigh. The privacy policy (effective July 2026) is Syncfusion-wide and covers BoldSign, BoldDesk, Bold BI and Bold Reports.", "The terms forbid robots, spiders, scrapers or other automated means to access or monitor BoldSign other than the Syncfusion-provided API, and forbid using the product to train or improve machine learning or AI algorithms. Recorded as a fact.", "boldsign.com/robots.txt disallows /responsible-disclosure/ and cdn-cgi paths with a crawl delay of 1 second and Content-Signal ai-train=yes, search=yes, ai-input=yes, so the responsible disclosure page was not read. developers.boldsign.com/robots.txt disallows /moreresults and /search. status.boldsign.com disallows /api/ and /embed/.", "boldsign.com/.well-known/security.txt is valid until 18 August 2027 with security@boldsign.com and a policy link to boldsign.com/security-policy/. Its comments claim SOC 2 Type 2, GDPR and a 99.999 per cent uptime SLA.", "The API answers on api.boldsign.com and regional subdomains, OAuth on account.boldsign.com and MCP on mcp.boldsign.com, all vendor subdomains.", "RDAP gives boldsign.com a registration date of 20 December 2013." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/boldsign.json", "live": { "slug": "boldsign", "probe": { "target": "https://api.boldsign.com/v1", "method": "get", "lastAt": "2026-11-04T20:46:36.22824902Z", "lastOk": false, "lastStatus": 500, "lastMs": 204, "lastNote": "server error", "authRequired": false, "uptime24h": 0, "uptime30d": 0, "p50ms24h": 0, "p95ms24h": 0, "samples24h": 55, "samples30d": 55, "days": [ { "date": "2026-11-04", "probes": 55, "ok": 0 } ], "outages": [ { "start": "2026-11-04T15:25:13.380401793Z", "end": "0001-01-01T00:00:00Z", "note": "HTTP 500 server error" } ] }, "vendorStatus": { "page": "https://status.boldsign.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-04T20:38:43.453813971Z" }, "versions": [ { "registry": "npm", "name": "boldsign", "version": "3.3.4", "seenAt": "2026-11-04T20:03:22.635714892Z" }, { "registry": "pypi", "name": "boldsign", "version": "3.3.4", "released": "2026-10-16", "seenAt": "2026-11-04T20:03:23.457188444Z" } ], "githubStars": 1, "npmWeekly": 36472, "pypiWeekly": 14652, "securityTxt": { "url": "https://boldsign.com/.well-known/security.txt", "state": "valid", "expires": "2027-08-18T00:00:00Z", "checkedAt": "2026-11-04T15:54:30.755542398Z" }, "updatedAt": "2026-11-04T20:46:36.22824902Z" } }, "answer": "BoldSign scores 70.3 (BB) on agent readiness against Docusign's 64.4 (B), and leads in 4 of 7 scored categories. Docusign leads on agent ergonomics and security \u0026 auth.", "b": { "slug": "docusign", "name": "Docusign", "vendor": "Docusign, Inc.", "vendorUrl": "https://www.docusign.com", "kind": "http-api", "category": "e-signatures", "summary": "Docusign is an e-signature and agreement management service. Its eSignature REST API creates envelopes from documents or templates, sends them to signers, embeds signing in an app and reports status. A hosted MCP server exposes a subset as tools.", "url": "https://www.anchorterminal.com/tools/docusign", "markdownUrl": "https://www.anchorterminal.com/tools/docusign.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/docusign.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/docusign.json", "dns": "docusign.grade.anchorterminal.com", "repo": "https://github.com/docusign/OpenAPI-Specifications", "license": "Proprietary service under Docusign's Master Services Agreement. The OpenAPI specifications repository and the eSignature SDKs on GitHub are MIT", "transports": [ "http" ], "remoteUrl": "https://mcp.docusign.com/mcp", "packages": [ { "registry": "npm", "name": "docusign-esign" }, { "registry": "pypi", "name": "docusign-esign" } ], "auth": "oauth", "authNotes": "OAuth 2.0 access tokens only, sent as a Bearer header. A developer creates an integration key in a free developer account and chooses authorisation code grant (with a secret or PKCE), JWT Grant for a service that impersonates a consenting user, or Implicit Grant. Moving to production means a Go-Live review of the key's API activity, a paid account and an administrator. Public integrations must join the partner programme. Since 30 September 2026, a production integration key used with the MCP server also needs Docusign's approval through a form.", "pricing": "paid", "pricingNotes": "Developer API plans start at $50 a month billed annually (Starter, from 40 envelopes a month), then $300 (Intermediate) and $480 (Advanced), with larger plans through sales. A free developer account with no time limit lets an agent build and test in the demo environment without a contract, but envelopes sent there aren't legally binding. Workflow Builder and Agreement Manager need an IAM subscription (checked 2026-10-07).", "priceSummary": "$50 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs, the spec files or the pricing page (checked 2026-10-07).", "endpoints": [] }, "toolCount": 42, "popularity": { "githubStars": null, "npmWeekly": 542682, "pypiWeekly": 305902, "asOf": "2026-10-07" }, "docsUrl": "https://developers.docusign.com", "openapi": "https://raw.githubusercontent.com/docusign/OpenAPI-Specifications/master/esignature.rest.swagger-v2.1.json", "capabilities": [ "esign.send", "esign.templates", "esign.embed", "esign.status", "contracts.generate" ], "tags": [ "hosted", "paid", "sandbox", "oauth", "mcp", "openapi", "webhooks", "node", "python", "java", "csharp", "php", "ruby", "status-page", "soc2", "iso27001" ], "lastRelease": "2026-10-14", "graded": true, "anchor": { "graded": true, "score": 64.4, "grade": "B", "agentReady": false, "rank": 425, "ranked": true, "rankOf": 1349, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 70, "maintenance": 81, "payments": 30, "reliability": 62, "schema": 70, "security": 69, "transparency": 73 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-02" }, "negative": 0, "verdict": "The eSignature REST API has public Swagger files on GitHub, OAuth 2.0, a free developer sandbox, published rate limits and official SDKs in six languages released through October 2026. Production needs a paid plan from $50 a month and a Go-Live review, and no SLA, llms.txt or security.txt was found.", "bestFor": "Teams whose company already uses Docusign and needs an agent to send envelopes from templates, embed signing and track status with a full audit trail.", "strengths": [ "Public Spec files under MIT on GitHub for eSignature v2.1 (213 paths, 414 operations) and ten other APIs", "Free developer account with no time limit, on a separate demo environment (demo.docusign.net, mcp-d.docusign.com)", "Rate limits published with numbers (3,000 calls an hour per account, 500 per 30 seconds in production) and returned in response headers", "Each envelope has an audit_events endpoint, and Connect webhooks support HMAC signatures, OAuth and mutual TLS", "Sub-processor list updated 8 October 2026 with an RSS feed, and 30 days' notice of new sub-processors in the data protection attachment" ], "weaknesses": [ "The Python SDK's last stable release is 6.1.0 of 13 March 2026, with only release candidates since", "Production access needs a paid account and a Go-Live review, and custom MCP agents need an integration key that Docusign allowlists", "The eSignature spec is Swagger 2.0 with no enums, no required lists and no security definitions. Valid values sit in prose", "The SDKs request one `signature` scope for envelope work, with no read-only scope found, and MCP admin control is an on or off switch per account", "No llms.txt, no security.txt, and no bug bounty, written deprecation policy or SLA found in the pages reviewed" ], "agentNotes": [ "Call /oauth/userinfo once after sign-in, cache `base_uri` and the account ID, and send every eSignature call to that host under /restapi/v2.1", "Create and send an envelope in one Envelopes:create call with `status` set to `sent`, or `created` for a draft a person reviews before sending", "Subscribe to Connect or set `eventNotification` for status. Docusign asks apps not to request the same envelope, document or recipient status more than once every 15 minutes", "Set `transactionId` on envelope creation so a retry after a lost response can find the envelope. The ID is valid for seven days", "Read `X-RateLimit-Reset` and `X-BurstLimit-Remaining`, and stop calling until the reset after a 429" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 2.8, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 64.4 } ], "editorialScores": { "ergonomics": 70, "maintenance": 81, "payments": 30, "reliability": 62, "schema": 70, "security": 69, "transparency": 59 }, "provenanceScore": 86, "checked": { "categories": { "ergonomics": "2026-11-02", "maintenance": "2026-11-02", "payments": "2026-11-02", "reliability": "2026-11-02", "schema": "2026-11-02", "security": "2026-11-02", "transparency": "2026-11-02" }, "last": "2026-11-02", "lastMoved": "2026-11-02", "oldest": "2026-11-02", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install docusign-esign -save" }, "letme": { "capability": "https://letme.dev/esign.send", "tool": "https://letme.dev/docusign" }, "area": "business", "unitPrices": [ { "item": "Starter plan", "unit": "month", "usd": 50, "note": "Starting amount of 40 envelopes a month, $600 billed annually" }, { "item": "Intermediate plan", "unit": "month", "usd": 300, "note": "Starting amount of 100 envelopes a month, $3,600 billed annually" }, { "item": "Advanced plan", "unit": "month", "usd": 480, "note": "Adds PowerForms, Bulk Send, signer attachments and Connect, $5,760 billed annually" } ], "provenance": { "legalEntity": "Docusign, Inc.", "domain": "docusign.com", "domainRegistered": "1999-06-14", "endpointOnVendorDomain": true, "terms": "https://www.docusign.com/legal/terms-and-conditions/msa", "privacy": "https://www.docusign.com/privacy", "statusPage": "https://health.docusign.com", "changelog": "https://developers.docusign.com/changelog/", "securityTxt": "none", "checked": "2026-10-07", "notes": [ "The Master Services Agreement names Docusign, Inc., a Delaware corporation, and is dated 14 November 2022. The privacy notice (effective 9 October 2025) gives 221 Main Street, Suite 800, San Francisco, CA 94105.", "The eSignature API answers at docusign.net hosts, auth at account.docusign.com and the MCP server at mcp.docusign.com. We did not look up the registration of docusign.net.", "www.docusign.com/.well-known/security.txt and developers.docusign.com/.well-known/security.txt return 404.", "status.docusign.com redirects to health.docusign.com, which loads its incidents from a JSON feed on the same host.", "RDAP for docusign.com gives a registration date of 1999-06-14 and MarkMonitor Inc. as registrar." ], "score": 86 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/docusign.json", "live": { "slug": "docusign", "probe": { "target": "https://mcp.docusign.com/mcp", "method": "get", "lastAt": "2026-11-04T20:46:42.034843348Z", "lastOk": true, "lastStatus": 401, "lastMs": 144, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 96, "p95ms24h": 165, "samples24h": 246, "samples30d": 6818, "days": [ { "date": "2026-10-08", "probes": 93, "ok": 93 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 248, "ok": 248 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 214, "ok": 214 } ] }, "vendorStatus": { "page": "https://health.docusign.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-04T17:13:37.013864141Z" }, "versions": [ { "registry": "github", "name": "docusign/OpenAPI-Specifications", "version": "20.1.00", "released": "2020-04-17", "seenAt": "2026-11-04T20:12:58.903870386Z" }, { "registry": "npm", "name": "docusign-esign", "version": "10.1.0", "seenAt": "2026-11-04T20:12:57.913185915Z" }, { "registry": "pypi", "name": "docusign-esign", "version": "6.1.0", "released": "2026-03-13", "seenAt": "2026-11-04T20:12:58.718475547Z" } ], "githubStars": 24, "npmWeekly": 489658, "pypiWeekly": 275801, "securityTxt": { "url": "https://docusign.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:53:07.716522141Z" }, "domain": { "domain": "docusign.com", "registered": "1999-06-14", "source": "https://rdap.verisign.com/com/v1/domain/docusign.com", "checkedAt": "2026-11-01T14:20:19.960922583Z" }, "pages": [ { "url": "https://developers.docusign.com/changelog/", "kind": "changelog", "status": 304, "checkedAt": "2026-11-04T08:18:47.150331258Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "0fbf96791151" }, { "url": "https://www.docusign.com/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-04T08:39:32.634033481Z", "changedAt": "2026-10-16T22:36:08.626468911Z", "fingerprint": "d9191e05454e" }, { "url": "https://www.docusign.com/legal/terms-and-conditions/msa", "kind": "terms", "status": 200, "checkedAt": "2026-11-04T08:39:29.404625515Z", "changedAt": "2026-10-16T22:36:05.610845922Z", "fingerprint": "f4574cb28d00" } ], "github": { "repo": "docusign/openapi-specifications", "checkedAt": "2026-11-02T08:45:04.250252975Z", "stars": 24, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-19T04:11:29Z", "openIssues": 15, "openPRs": 12, "issuesOpened90d": 0, "issuesClosed90d": 0, "prsMerged90d": 0, "ci": { "branch": "master", "runs": 9, "success": 8, "failure": 1, "other": 0, "latest": "success", "latestAt": "2026-07-03T13:25:30Z" }, "replies": { "sampled": 23, "unanswered": 15, "medianDays": 0.5 } }, "updatedAt": "2026-11-04T20:46:42.034843348Z" } }, "edges": [ { "by": 22, "category": "reliability", "leads": "boldsign", "name": "Reliability", "reasons": { "a": "Read with the hosted lines and scored on the REST API v1, the surface the SDKs and the hosted MCP server call. status.boldsign.com on Atlassian Statuspage has Web App and API components for Global, Europe, Canada and Australia plus Docs, with 90-day uptime and an incident history (20). The history feed, read on 3 November 2026, lists four one-hour scheduled maintenances between 19 and 27 September and no incident after a 20-minute partial disruption on 21 July 2026, so the 90 days from 5 August are clean (30). Rate limits are published per account, 2,000 requests an hour live and 50 an hour in the sandbox (15). The rate-limit page says 429 is returned with messages and usage is tracked in response headers, and the guide recommends webhooks over polling. No Retry-After is documented and there are no idempotency keys (6 of 15). No SLA document was found. security.txt advertises a 99.999 per cent uptime SLA, the terms disclaim uninterrupted service and refer to a support SLA available on request (3 of 10). v1 is the stable version with beta endpoints under v1-beta (10). 20 + 30 + 15 + 6 + 3 + 10 = 84.", "b": "Read with the hosted lines and scored on the eSignature REST API, with the MCP server noted. health.docusign.com is Docusign's own status centre with incidents and maintenances by product and site, severity levels and a history view (20). The page draws its incidents by script from a data feed on the same host. The 7 October count came from that feed, which this run's rules don't read, so it's struck, and the window from 4 August to 2 November is unread (5). Limits have numbers, 3,000 API calls an hour per account and a 500-call 30-second burst limit, in Docusign's developer blog, re-read on 2 November (15). The same post names the x-ratelimit headers and the burst reset, and the 23 June 2026 post moved hourly, burst and polling limit errors to HTTP 429 so standard backoff and retry applies. The spec's `transactionId` lets a sender check whether an envelope was created after a lost response, valid for seven days, but there's no general idempotency key (12 of 15). No SLA was found in the Master Services Agreement or the terms index (0). The eSignature API v2.1 is generally available (10). 20 + 5 + 15 + 12 + 0 + 10 = 62." }, "scores": { "a": 84, "b": 62 } }, { "by": 15, "category": "schema", "leads": "boldsign", "name": "Schema \u0026 documentation", "reasons": { "a": "A public Swagger file, OpenAPI 3.0.4, at api.boldsign.com/swagger/v1/swagger.json with 87 operations and two security schemes, X-API-KEY and Bearer, which the docs say generated the C# SDK (25). developers.boldsign.com serves llms.txt and a Markdown twin of every page (10). Every operation has a summary, but 64 of 87 are under 40 characters in the file, and the purpose and conditions of each call sit in the docs pages instead. The MCP docs say which tools read and which act (12 of 20). 186 enums and required fields in the schemas, with page and pageSize on lists (12 of 15). The Swagger file carries no examples. The docs pages carry curl and five SDK examples per call, and the troubleshooting page documents 400, 401, 402, 403, 404, 417 and 422 with causes and fixes, while the file documents 401 everywhere and 403, 422 and 400 on many operations (11 of 15). v1 in the path with v1-beta for previews, and a changelog dated from 20 April 2021 to 16 October 2026 that labels breaking changes (15). 25 + 10 + 12 + 12 + 11 + 15 = 85.", "b": "Spec files for eSignature v2.1 (Swagger 2.0, 213 paths, 414 operations, re-read on 2 November; the repository's last commit is 3 July 2026, build 26.2.01.01) and ten other APIs are public under MIT in docusign/OpenAPI-Specifications. The MCP tool schemas sit behind sign-in, so the API carries this line (25). developers.docusign.com/llms.txt returns 404 on 2 November, and no Markdown copy of the docs was found (0). Operation descriptions are long and say what a call is for (the median is 179 characters and Envelopes:create explains drafts, templates and required fields), though 43 of 414 are under 40 characters (15 of 20). The eSignature spec has no `enum` and no `required` list on any schema, and no security definitions. Valid values are listed in prose (6 of 15). Docusign keeps code examples in six languages on GitHub, and its 23 June 2026 developer post lists 16 error codes with status, message and fix, but the spec documents only a 400 with `errorCode` and `message` on every operation (12 of 15). The API is versioned (v2.1, builds such as 26.3.01.02) and the SDK changelogs are dated (12 of 15). The Developer Center renders by script, and its guide, error-code and changelog pages were read on 1 and 7 October through the site's page data, which this run doesn't read, so those readings are struck and this note rests on the spec, the SDK repositories and Docusign's blog. 25 + 0 + 15 + 6 + 12 + 12 = 70." }, "scores": { "a": 85, "b": 70 } }, { "by": 10, "category": "payments", "leads": "boldsign", "name": "Payments \u0026 pricing", "reasons": { "a": "Read with the hosted rubric. No x402, MPP or L402 (0). The Enterprise API plan is public at $30 a month with 40 envelopes and $0.75 per additional envelope, and add-ons are priced per unit (20). The free sandbox gives full API access with no credit card, and the 30-day trial also needs no card per the pricing page (20). A person signs up in a browser and mints the key or registers the OAuth app in the web app (0). 0 + 20 + 20 + 0 = 40.", "b": "Read with the hosted rubric. No x402, MPP or L402 (0). Plan prices are public without login, re-read on 2 November, $50, $300 and $480 a month billed annually ($600, $3,600 and $5,760 a year) with a starting envelope allowance, and no per-envelope or overage price is shown (10). The developer account is free with no time limit and most capabilities enabled, on a demo environment where envelopes aren't legally binding. We didn't run the sign-up form to confirm no card is asked for (20). A person signs up in a browser, creates the integration key and grants consent, and production adds a Go-Live review (0). 0 + 10 + 20 + 0 = 30." }, "scores": { "a": 40, "b": 30 } }, { "by": 8, "category": "ergonomics", "leads": "docusign", "name": "Agent ergonomics", "reasons": { "a": "List calls take Page and PageSize and document properties return the full object; no field selection was found. The hosted MCP server has 14 compact tools, but the REST API is the graded surface (14 of 25). Page and PageSize on document, template, contact, user and team lists, with search, status, date, label and team filters on documents (16 of 20). The troubleshooting page gives a cause and a fix per status code, 401 covers a region mismatch, and 422 carries validation detail (14 of 20). No idempotency keys. Draft send and the sandbox make trial calls safe, and the MCP docs ask for a human confirmation before send, reminder and revoke, but the tools' annotations couldn't be read (5 of 20). A send needs files or a template, a title and signers with fields, and the SDKs cover .NET, Node, Python, Java and PHP (13 of 15). 14 + 16 + 14 + 5 + 13 = 62.", "b": "Envelope listing takes `count` and an `include` parameter to add recipients, folders and other detail, but there's no field selection and envelope objects are large, per the spec. The MCP tool list sits in the script-rendered Developer Center and wasn't read (15 of 25). `count`, `start_position`, `continuation_token`, and filters by date, status, folder, user and search text (20). Errors carry an upper-case `errorCode` and a message on every operation, and Docusign's 23 June 2026 post rewrote 16 messages to say what failed, why and how to fix it and moved rate-limit errors to 429. The full error-code page wasn't readable (15 of 20). `transactionId` guards envelope creation for seven days. There's no general idempotency key, and we couldn't see whether the MCP tools carry readOnlyHint or destructiveHint (8 of 20). Official SDKs in C#, Java, Node.js, PHP, Python and Ruby. A first call still needs the account ID and base URI from /oauth/userinfo (the SDKs' getUserInfo), and an envelope definition is verbose (12 of 15). Developer Center readings taken through the site's page data on 7 October are struck. 15 + 20 + 15 + 8 + 12 = 70." }, "scores": { "a": 62, "b": 70 } }, { "by": 6, "category": "security", "leads": "docusign", "name": "Security \u0026 auth", "reasons": { "a": "OAuth 2.0 with authorisation code and PKCE S256, client credentials, implicit, and single-use refresh tokens that last 30 days, with 20 scopes split by resource and action. API keys carry every scope, which the docs say is not customisable, with an optional expiry, four per account and two per environment, deleted to revoke (28 of 30). OAuth apps can be limited to Templates, Users, Teams or SenderIdentity read scopes, though no Documents.Read scope exists, and the sandbox and draft send limit what a call does. The MCP docs recommend a human confirmation before send, reminder and revoke, and the API has no approval step (10 of 20). Signer names, field values and uploaded documents come back through the API, and no guidance on untrusted content was found (3 of 15). Each document has an audit log with user, IP address and timestamp, downloadable by API, and a document history API. No log of API calls or key use was found (8 of 15). security.txt is valid with security@boldsign.com and a policy link, SOC 2 Type 2 per the security page, HMAC-SHA256 signed webhooks with IP allowlisting, third-party code reviews and penetration tests. No bug bounty was found, and the responsible disclosure page is disallowed by robots.txt so it was not read (14 of 20). 28 + 10 + 3 + 8 + 14 = 63.", "b": "OAuth 2.0 with scopes. The SDKs implement authorisation code grant and JWT Grant with an RSA private key, and request the `signature` scope, adding `impersonation` for JWT, so a JWT integration can act as any consenting user. Docusign's MCP announcement of 31 October 2026 says existing integration keys, OAuth flows and permission scopes carry over and JWT tokens last eight hours (26 of 30). No read-only eSignature scope was found. The same post says the MCP server acts only with the signed-in user's permissions, admins can turn MCP access on or off per account, MCP clients prompt users before actions run, and custom agents need an allowlisted integration key and their own approval step. Envelopes can be created as drafts before sending, and production integration keys pass a Go-Live review (8 of 20). Envelope and agreement content reaches the model. Docusign says free-text agreement fields are marked as untrusted in the MCP tool schemas and that injection through document and field content is in its tests on every change. The schemas sit behind sign-in, so this is Docusign's statement. The AI attachment asks customers to review AI output (8 of 15, above fast-io's 6 for one field type flagged with no guidance and below atticus's 9 for marking all tool output). Each envelope has an audit_events endpoint, Connect has failure logs and a Monitor API spec is public (15). ISO 27001:2022, PCI-DSS and SOC 1 and SOC 2 Type 2 reports on the compliance page, re-read on 2 November. security.txt returns 404 on developers.docusign.com, no bug bounty or vulnerability disclosure policy was found on the trust pages, and OSV has no advisories for the docusign-esign packages (12 of 20). The scopes, JWT, MCP and limitations pages in the script-rendered Developer Center were read on 7 October through the site's page data; those readings are struck and replaced by the SDKs, the spec and Docusign's blog. 26 + 8 + 8 + 15 + 12 = 69." }, "scores": { "a": 63, "b": 69 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Syncfusion, Inc.", "b": "Docusign, Inc.", "name": "Vendor" }, { "a": "https://api.boldsign.com/v1", "b": "https://mcp.docusign.com/mcp", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth", "name": "Auth" }, { "a": "Freemium", "b": "Paid", "name": "Pricing" }, { "a": "$0.25 per transaction", "b": "not published", "name": "Price for e-signatures" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary hosted service under the BoldSign Terms of Use. The five official SDKs and the deprecated local MCP package on GitHub are MIT", "b": "Proprietary service under Docusign's Master Services Agreement. The OpenAPI specifications repository and the eSignature SDKs on GitHub are MIT", "name": "Licence" }, { "a": "14", "b": "42", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "no", "name": "llms.txt" }, { "a": "2026-10-16", "b": "2026-10-14", "name": "Last release" }, { "a": "2025-02-01", "b": "no date given", "name": "Terms last updated" }, { "a": "2026-07-01", "b": "2025-10-09", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "yes, with an opt-out", "name": "Customer content may train models" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "yes", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "1 stars", "b": "543k npm/wk, 306k PyPI/wk", "name": "Popularity" }, { "a": "none", "b": "2.8/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "BoldSign scores 70.3 (BB) on agent readiness against Docusign's 64.4 (B), and leads in 4 of 7 scored categories. Docusign leads on agent ergonomics and security \u0026 auth.", "question": "Which is better for AI agents, BoldSign or Docusign?" }, { "answer": "BoldSign takes an API key or an OAuth sign-in. Docusign uses an OAuth sign-in.", "question": "Do BoldSign and Docusign need an API key?" }, { "answer": "Yes. BoldSign has a hosted endpoint at https://api.boldsign.com/v1 and Docusign at https://mcp.docusign.com/mcp.", "question": "Can an agent call BoldSign and Docusign without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 84 against 62", "Schema \u0026 documentation, 85 against 70", "Payments \u0026 pricing, 40 against 30" ], "also": [ "Agent-ready, a grade of BB or better" ], "goodFor": "A product team embedding signing, requesting and templates at a per-envelope price with regional hosting in the US, EU, Canada or Australia, and an agent that sends from templates and tracks status through the hosted MCP server.", "slug": "boldsign", "watchFor": "API keys carry every scope and the docs say that is not customisable; only OAuth apps get narrower scopes, and there is no Documents.Read scope" }, { "aheadOn": [ "Agent ergonomics, 70 against 62", "Security \u0026 auth, 69 against 63" ], "also": null, "goodFor": "Teams whose company already uses Docusign and needs an agent to send envelopes from templates, embed signing and track status with a full audit trail.", "slug": "docusign", "watchFor": "The Python SDK's last stable release is 6.1.0 of 13 March 2026, with only release candidates since" } ], "history": { "boldsign": null, "docusign": [ { "causes": [ "evidence", "correction" ], "date": "2026-11-02", "delta": 1.8, "from": 62.6, "fromGrade": "B", "to": 64.4, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 62.5, "fromGrade": "B", "to": 62.6, "toGrade": "B" } ] }, "job": { "capability": "esign.send", "name": "E-signatures" }, "others": [ { "json": "https://www.anchorterminal.com/compare/adobe-acrobat-sign-vs-boldsign.json", "title": "Adobe Acrobat Sign vs BoldSign", "url": "https://www.anchorterminal.com/compare/adobe-acrobat-sign-vs-boldsign" }, { "json": "https://www.anchorterminal.com/compare/adobe-acrobat-sign-vs-docusign.json", "title": "Adobe Acrobat Sign vs Docusign", "url": "https://www.anchorterminal.com/compare/adobe-acrobat-sign-vs-docusign" }, { "json": "https://www.anchorterminal.com/compare/boldsign-vs-documenso.json", "title": "BoldSign vs Documenso", "url": "https://www.anchorterminal.com/compare/boldsign-vs-documenso" }, { "json": "https://www.anchorterminal.com/compare/boldsign-vs-docuseal.json", "title": "BoldSign vs DocuSeal", "url": "https://www.anchorterminal.com/compare/boldsign-vs-docuseal" }, { "json": "https://www.anchorterminal.com/compare/boldsign-vs-dropbox-sign.json", "title": "BoldSign vs Dropbox Sign", "url": "https://www.anchorterminal.com/compare/boldsign-vs-dropbox-sign" }, { "json": "https://www.anchorterminal.com/compare/boldsign-vs-pandadoc.json", "title": "BoldSign vs PandaDoc", "url": "https://www.anchorterminal.com/compare/boldsign-vs-pandadoc" }, { "json": "https://www.anchorterminal.com/compare/boldsign-vs-signnow.json", "title": "BoldSign vs airSlate SignNow", "url": "https://www.anchorterminal.com/compare/boldsign-vs-signnow" }, { "json": "https://www.anchorterminal.com/compare/boldsign-vs-signwell.json", "title": "BoldSign vs SignWell", "url": "https://www.anchorterminal.com/compare/boldsign-vs-signwell" }, { "json": "https://www.anchorterminal.com/compare/boldsign-vs-youtrust.json", "title": "BoldSign vs Youtrust", "url": "https://www.anchorterminal.com/compare/boldsign-vs-youtrust" }, { "json": "https://www.anchorterminal.com/compare/documenso-vs-docusign.json", "title": "Documenso vs Docusign", "url": "https://www.anchorterminal.com/compare/documenso-vs-docusign" }, { "json": "https://www.anchorterminal.com/compare/docuseal-vs-docusign.json", "title": "DocuSeal vs Docusign", "url": "https://www.anchorterminal.com/compare/docuseal-vs-docusign" }, { "json": "https://www.anchorterminal.com/compare/docusign-vs-dropbox-sign.json", "title": "Docusign vs Dropbox Sign", "url": "https://www.anchorterminal.com/compare/docusign-vs-dropbox-sign" }, { "json": "https://www.anchorterminal.com/compare/docusign-vs-pandadoc.json", "title": "Docusign vs PandaDoc", "url": "https://www.anchorterminal.com/compare/docusign-vs-pandadoc" }, { "json": "https://www.anchorterminal.com/compare/docusign-vs-signnow.json", "title": "Docusign vs airSlate SignNow", "url": "https://www.anchorterminal.com/compare/docusign-vs-signnow" }, { "json": "https://www.anchorterminal.com/compare/docusign-vs-signwell.json", "title": "Docusign vs SignWell", "url": "https://www.anchorterminal.com/compare/docusign-vs-signwell" }, { "json": "https://www.anchorterminal.com/compare/docusign-vs-youtrust.json", "title": "Docusign vs Youtrust", "url": "https://www.anchorterminal.com/compare/docusign-vs-youtrust" } ], "panel": null, "scores": [ { "boldsign": 84, "by": 22, "docusign": 62, "edge": "boldsign", "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "boldsign": 85, "by": 15, "docusign": 70, "edge": "boldsign", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "boldsign": 62, "by": 8, "docusign": 70, "edge": "docusign", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "boldsign": 63, "by": 6, "docusign": 69, "edge": "docusign", "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "boldsign": 40, "by": 10, "docusign": 30, "edge": "boldsign", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "boldsign": 78, "by": 3, "docusign": 81, "edge": "docusign", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "boldsign": 77, "by": 4, "docusign": 73, "edge": "boldsign", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "BoldSign scores 70.3 (BB) on agent readiness against Docusign's 64.4 (B), and leads in 4 of 7 scored categories. Docusign leads on agent ergonomics and security \u0026 auth. Both do e-signatures.", "tasks": null, "tutorials": [], "verdicts": { "boldsign": "A public OpenAPI file, llms.txt, 20 OAuth scopes, published rate limits, a free sandbox and a clean 90-day status history. API keys carry every scope, there are no idempotency keys, the 2,000-an-hour account limit is low for bulk work, and the hosted MCP server's 14 tools include sending and revoking with no confirmation step of their own.", "docusign": "The eSignature REST API has public Swagger files on GitHub, OAuth 2.0, a free developer sandbox, published rate limits and official SDKs in six languages released through October 2026. Production needs a paid plan from $50 a month and a Go-Live review, and no SLA, llms.txt or security.txt was found." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/boldsign-vs-docusign", "json": "https://www.anchorterminal.com/compare/boldsign-vs-docusign.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/boldsign-vs-docusign.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/boldsign-vs-docusign.min.md" }, "markdown": "BoldSign scores 70.3 (BB) on agent readiness against Docusign's 64.4 (B), and leads in 4 of 7 scored categories. Docusign leads on agent ergonomics and security \u0026 auth. Both do e-signatures.\n\n- BoldSign: grade BB, 70.3/100, rank #190 of 1349. Markdown https://www.anchorterminal.com/tools/boldsign.md · JSON https://www.anchorterminal.com/api/v1/tools/boldsign.json\n- Docusign: grade B, 64.4/100, rank #425 of 1349. Markdown https://www.anchorterminal.com/tools/docusign.md · JSON https://www.anchorterminal.com/api/v1/tools/docusign.json\n- Best contract, proposal and e-signature APIs for AI agents: https://www.anchorterminal.com/best/e-signatures/index.md\n- All 45 e-signatures comparisons: https://www.anchorterminal.com/compare/e-signatures/index.md\n\n## Which one, for what\n\n### BoldSign (BB)\n\nGood for: A product team embedding signing, requesting and templates at a per-envelope price with regional hosting in the US, EU, Canada or Australia, and an agent that sends from templates and tracks status through the hosted MCP server.\n\nAhead on:\n- Reliability, 84 against 62\n- Schema \u0026 documentation, 85 against 70\n- Payments \u0026 pricing, 40 against 30\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n\nWatch for: API keys carry every scope and the docs say that is not customisable; only OAuth apps get narrower scopes, and there is no Documents.Read scope\n\n### Docusign (B)\n\nGood for: Teams whose company already uses Docusign and needs an agent to send envelopes from templates, embed signing and track status with a full audit trail.\n\nAhead on:\n- Agent ergonomics, 70 against 62\n- Security \u0026 auth, 69 against 63\n\nWatch for: The Python SDK's last stable release is 6.1.0 of 13 March 2026, with only release candidates since\n\n\n## Why the edge\n\n### Reliability: BoldSign +22\n\n- BoldSign (84): Read with the hosted lines and scored on the REST API v1, the surface the SDKs and the hosted MCP server call. status.boldsign.com on Atlassian Statuspage has Web App and API components for Global, Europe, Canada and Australia plus Docs, with 90-day uptime and an incident history (20). The history feed, read on 3 November 2026, lists four one-hour scheduled maintenances between 19 and 27 September and no incident after a 20-minute partial disruption on 21 July 2026, so the 90 days from 5 August are clean (30). Rate limits are published per account, 2,000 requests an hour live and 50 an hour in the sandbox (15). The rate-limit page says 429 is returned with messages and usage is tracked in response headers, and the guide recommends webhooks over polling. No Retry-After is documented and there are no idempotency keys (6 of 15). No SLA document was found. security.txt advertises a 99.999 per cent uptime SLA, the terms disclaim uninterrupted service and refer to a support SLA available on request (3 of 10). v1 is the stable version with beta endpoints under v1-beta (10). 20 + 30 + 15 + 6 + 3 + 10 = 84.\n- Docusign (62): Read with the hosted lines and scored on the eSignature REST API, with the MCP server noted. health.docusign.com is Docusign's own status centre with incidents and maintenances by product and site, severity levels and a history view (20). The page draws its incidents by script from a data feed on the same host. The 7 October count came from that feed, which this run's rules don't read, so it's struck, and the window from 4 August to 2 November is unread (5). Limits have numbers, 3,000 API calls an hour per account and a 500-call 30-second burst limit, in Docusign's developer blog, re-read on 2 November (15). The same post names the x-ratelimit headers and the burst reset, and the 23 June 2026 post moved hourly, burst and polling limit errors to HTTP 429 so standard backoff and retry applies. The spec's `transactionId` lets a sender check whether an envelope was created after a lost response, valid for seven days, but there's no general idempotency key (12 of 15). No SLA was found in the Master Services Agreement or the terms index (0). The eSignature API v2.1 is generally available (10). 20 + 5 + 15 + 12 + 0 + 10 = 62.\n\n### Schema \u0026 documentation: BoldSign +15\n\n- BoldSign (85): A public Swagger file, OpenAPI 3.0.4, at api.boldsign.com/swagger/v1/swagger.json with 87 operations and two security schemes, X-API-KEY and Bearer, which the docs say generated the C# SDK (25). developers.boldsign.com serves llms.txt and a Markdown twin of every page (10). Every operation has a summary, but 64 of 87 are under 40 characters in the file, and the purpose and conditions of each call sit in the docs pages instead. The MCP docs say which tools read and which act (12 of 20). 186 enums and required fields in the schemas, with page and pageSize on lists (12 of 15). The Swagger file carries no examples. The docs pages carry curl and five SDK examples per call, and the troubleshooting page documents 400, 401, 402, 403, 404, 417 and 422 with causes and fixes, while the file documents 401 everywhere and 403, 422 and 400 on many operations (11 of 15). v1 in the path with v1-beta for previews, and a changelog dated from 20 April 2021 to 16 October 2026 that labels breaking changes (15). 25 + 10 + 12 + 12 + 11 + 15 = 85.\n- Docusign (70): Spec files for eSignature v2.1 (Swagger 2.0, 213 paths, 414 operations, re-read on 2 November; the repository's last commit is 3 July 2026, build 26.2.01.01) and ten other APIs are public under MIT in docusign/OpenAPI-Specifications. The MCP tool schemas sit behind sign-in, so the API carries this line (25). developers.docusign.com/llms.txt returns 404 on 2 November, and no Markdown copy of the docs was found (0). Operation descriptions are long and say what a call is for (the median is 179 characters and Envelopes:create explains drafts, templates and required fields), though 43 of 414 are under 40 characters (15 of 20). The eSignature spec has no `enum` and no `required` list on any schema, and no security definitions. Valid values are listed in prose (6 of 15). Docusign keeps code examples in six languages on GitHub, and its 23 June 2026 developer post lists 16 error codes with status, message and fix, but the spec documents only a 400 with `errorCode` and `message` on every operation (12 of 15). The API is versioned (v2.1, builds such as 26.3.01.02) and the SDK changelogs are dated (12 of 15). The Developer Center renders by script, and its guide, error-code and changelog pages were read on 1 and 7 October through the site's page data, which this run doesn't read, so those readings are struck and this note rests on the spec, the SDK repositories and Docusign's blog. 25 + 0 + 15 + 6 + 12 + 12 = 70.\n\n### Payments \u0026 pricing: BoldSign +10\n\n- BoldSign (40): Read with the hosted rubric. No x402, MPP or L402 (0). The Enterprise API plan is public at $30 a month with 40 envelopes and $0.75 per additional envelope, and add-ons are priced per unit (20). The free sandbox gives full API access with no credit card, and the 30-day trial also needs no card per the pricing page (20). A person signs up in a browser and mints the key or registers the OAuth app in the web app (0). 0 + 20 + 20 + 0 = 40.\n- Docusign (30): Read with the hosted rubric. No x402, MPP or L402 (0). Plan prices are public without login, re-read on 2 November, $50, $300 and $480 a month billed annually ($600, $3,600 and $5,760 a year) with a starting envelope allowance, and no per-envelope or overage price is shown (10). The developer account is free with no time limit and most capabilities enabled, on a demo environment where envelopes aren't legally binding. We didn't run the sign-up form to confirm no card is asked for (20). A person signs up in a browser, creates the integration key and grants consent, and production adds a Go-Live review (0). 0 + 10 + 20 + 0 = 30.\n\n### Agent ergonomics: Docusign +8\n\n- BoldSign (62): List calls take Page and PageSize and document properties return the full object; no field selection was found. The hosted MCP server has 14 compact tools, but the REST API is the graded surface (14 of 25). Page and PageSize on document, template, contact, user and team lists, with search, status, date, label and team filters on documents (16 of 20). The troubleshooting page gives a cause and a fix per status code, 401 covers a region mismatch, and 422 carries validation detail (14 of 20). No idempotency keys. Draft send and the sandbox make trial calls safe, and the MCP docs ask for a human confirmation before send, reminder and revoke, but the tools' annotations couldn't be read (5 of 20). A send needs files or a template, a title and signers with fields, and the SDKs cover .NET, Node, Python, Java and PHP (13 of 15). 14 + 16 + 14 + 5 + 13 = 62.\n- Docusign (70): Envelope listing takes `count` and an `include` parameter to add recipients, folders and other detail, but there's no field selection and envelope objects are large, per the spec. The MCP tool list sits in the script-rendered Developer Center and wasn't read (15 of 25). `count`, `start_position`, `continuation_token`, and filters by date, status, folder, user and search text (20). Errors carry an upper-case `errorCode` and a message on every operation, and Docusign's 23 June 2026 post rewrote 16 messages to say what failed, why and how to fix it and moved rate-limit errors to 429. The full error-code page wasn't readable (15 of 20). `transactionId` guards envelope creation for seven days. There's no general idempotency key, and we couldn't see whether the MCP tools carry readOnlyHint or destructiveHint (8 of 20). Official SDKs in C#, Java, Node.js, PHP, Python and Ruby. A first call still needs the account ID and base URI from /oauth/userinfo (the SDKs' getUserInfo), and an envelope definition is verbose (12 of 15). Developer Center readings taken through the site's page data on 7 October are struck. 15 + 20 + 15 + 8 + 12 = 70.\n\n### Security \u0026 auth: Docusign +6\n\n- BoldSign (63): OAuth 2.0 with authorisation code and PKCE S256, client credentials, implicit, and single-use refresh tokens that last 30 days, with 20 scopes split by resource and action. API keys carry every scope, which the docs say is not customisable, with an optional expiry, four per account and two per environment, deleted to revoke (28 of 30). OAuth apps can be limited to Templates, Users, Teams or SenderIdentity read scopes, though no Documents.Read scope exists, and the sandbox and draft send limit what a call does. The MCP docs recommend a human confirmation before send, reminder and revoke, and the API has no approval step (10 of 20). Signer names, field values and uploaded documents come back through the API, and no guidance on untrusted content was found (3 of 15). Each document has an audit log with user, IP address and timestamp, downloadable by API, and a document history API. No log of API calls or key use was found (8 of 15). security.txt is valid with security@boldsign.com and a policy link, SOC 2 Type 2 per the security page, HMAC-SHA256 signed webhooks with IP allowlisting, third-party code reviews and penetration tests. No bug bounty was found, and the responsible disclosure page is disallowed by robots.txt so it was not read (14 of 20). 28 + 10 + 3 + 8 + 14 = 63.\n- Docusign (69): OAuth 2.0 with scopes. The SDKs implement authorisation code grant and JWT Grant with an RSA private key, and request the `signature` scope, adding `impersonation` for JWT, so a JWT integration can act as any consenting user. Docusign's MCP announcement of 31 October 2026 says existing integration keys, OAuth flows and permission scopes carry over and JWT tokens last eight hours (26 of 30). No read-only eSignature scope was found. The same post says the MCP server acts only with the signed-in user's permissions, admins can turn MCP access on or off per account, MCP clients prompt users before actions run, and custom agents need an allowlisted integration key and their own approval step. Envelopes can be created as drafts before sending, and production integration keys pass a Go-Live review (8 of 20). Envelope and agreement content reaches the model. Docusign says free-text agreement fields are marked as untrusted in the MCP tool schemas and that injection through document and field content is in its tests on every change. The schemas sit behind sign-in, so this is Docusign's statement. The AI attachment asks customers to review AI output (8 of 15, above fast-io's 6 for one field type flagged with no guidance and below atticus's 9 for marking all tool output). Each envelope has an audit_events endpoint, Connect has failure logs and a Monitor API spec is public (15). ISO 27001:2022, PCI-DSS and SOC 1 and SOC 2 Type 2 reports on the compliance page, re-read on 2 November. security.txt returns 404 on developers.docusign.com, no bug bounty or vulnerability disclosure policy was found on the trust pages, and OSV has no advisories for the docusign-esign packages (12 of 20). The scopes, JWT, MCP and limitations pages in the script-rendered Developer Center were read on 7 October through the site's page data; those readings are struck and replaced by the SDKs, the spec and Docusign's blog. 26 + 8 + 8 + 15 + 12 = 69.\n\n## Score by category\n\n| Category | Weight | BoldSign | Docusign | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 84 | 62 | BoldSign +22 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 85 | 70 | BoldSign +15 |\n| Agent ergonomics | 13% (16.2 this run) | 62 | 70 | Docusign +8 |\n| Security \u0026 auth | 14% (17.5 this run) | 63 | 69 | Docusign +6 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 30 | BoldSign +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 78 | 81 | Docusign +3 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 77 | 73 | BoldSign +4 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **70.3 · BB** | **64.4 · B** | |\n\n## Facts side by side\n\n| Fact | BoldSign | Docusign |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Syncfusion, Inc. | Docusign, Inc. |\n| Hosted endpoint | `https://api.boldsign.com/v1` | `https://mcp.docusign.com/mcp` |\n| Transports | HTTP, Streamable HTTP | HTTP |\n| Auth | OAuth or key | OAuth |\n| Pricing | Freemium | Paid |\n| Price for e-signatures | $0.25 per transaction | not published |\n| x402 | no | no |\n| Licence | Proprietary hosted service under the BoldSign Terms of Use. The five official SDKs and the deprecated local MCP package on GitHub are MIT | Proprietary service under Docusign's Master Services Agreement. The OpenAPI specifications repository and the eSignature SDKs on GitHub are MIT |\n| Tools exposed | 14 | 42 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | no |\n| Last release | 2026-10-16 | 2026-10-14 |\n| Terms last updated | 2025-02-01 | no date given |\n| Privacy policy last updated | 2026-07-01 | 2025-10-09 |\n| Customer content may train models | not found in the text | yes, with an opt-out |\n| Terms restrict automated access | yes | not found in the text |\n| Terms restrict benchmarking | yes | yes |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | yes | not found in the text |\n| Popularity | 1 stars | 543k npm/wk, 306k PyPI/wk |\n| Agent reviews | none | 2.8/5 (4) |\n\n## How the scores have moved\n\n### BoldSign\n\nNo score change since it was listed.\n\n### Docusign\n\n- +1.8 on 2 November 2026: new evidence, correction\n- +0.1 on 27 October 2026: checklist\n\n## Verdicts\n\n**BoldSign.** A public OpenAPI file, llms.txt, 20 OAuth scopes, published rate limits, a free sandbox and a clean 90-day status history. API keys carry every scope, there are no idempotency keys, the 2,000-an-hour account limit is low for bulk work, and the hosted MCP server's 14 tools include sending and revoking with no confirmation step of their own.\n\n**Docusign.** The eSignature REST API has public Swagger files on GitHub, OAuth 2.0, a free developer sandbox, published rate limits and official SDKs in six languages released through October 2026. Production needs a paid plan from $50 a month and a Go-Live review, and no SLA, llms.txt or security.txt was found.\n\n## Before you call either\n\n### BoldSign\n\n1. Send `X-API-KEY: $BOLDSIGN_API_KEY` to the regional base URL (api.boldsign.com, api-eu, api-ca or api-au); a key from one region fails on another, and the MCP endpoint must match too\n2. Build against a Sandbox key first. Sandbox documents are watermarked and deleted after 14 days, and the sandbox allows only 50 requests an hour\n3. Stay under 2,000 requests an hour per account in production and use webhooks instead of polling `document/properties`; on a 429 wait for the window to reset\n4. Don't retry a timed-out `document/send` blindly. There is no idempotency key, so list documents by title or search before sending again\n5. Verify `X-BoldSign-Signature` (HMAC-SHA256 with the endpoint secret) on every webhook before acting on its payload\n6. On the MCP server, start with `list_templates` and `get_document_properties`, and confirm with the person before `send_document_from_template`, `send_reminder_for_document_sign` or `revoke_document`\n\n### Docusign\n\n1. Call /oauth/userinfo once after sign-in, cache `base_uri` and the account ID, and send every eSignature call to that host under /restapi/v2.1\n2. Create and send an envelope in one Envelopes:create call with `status` set to `sent`, or `created` for a draft a person reviews before sending\n3. Subscribe to Connect or set `eventNotification` for status. Docusign asks apps not to request the same envelope, document or recipient status more than once every 15 minutes\n4. Set `transactionId` on envelope creation so a retry after a lost response can find the envelope. The ID is valid for seven days\n5. Read `X-RateLimit-Reset` and `X-BurstLimit-Remaining`, and stop calling until the reset after a 429\n\n## Questions\n\n### Which is better for AI agents, BoldSign or Docusign?\n\nBoldSign scores 70.3 (BB) on agent readiness against Docusign's 64.4 (B), and leads in 4 of 7 scored categories. Docusign leads on agent ergonomics and security \u0026 auth.\n\n### Do BoldSign and Docusign need an API key?\n\nBoldSign takes an API key or an OAuth sign-in. Docusign uses an OAuth sign-in.\n\n### Can an agent call BoldSign and Docusign without installing anything?\n\nYes. BoldSign has a hosted endpoint at https://api.boldsign.com/v1 and Docusign at https://mcp.docusign.com/mcp.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/boldsign-vs-docusign.json, and with the fewest tokens: https://www.anchorterminal.com/compare/boldsign-vs-docusign.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"boldsign\", \"b\": \"docusign\"}`. From a terminal: `anchor compare boldsign docusign`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/boldsign.json and https://www.anchorterminal.com/api/v1/tools/docusign.json\n\n## Other comparisons with BoldSign or Docusign\n\n- [Adobe Acrobat Sign vs BoldSign](https://www.anchorterminal.com/compare/adobe-acrobat-sign-vs-boldsign.md)\n- [Adobe Acrobat Sign vs Docusign](https://www.anchorterminal.com/compare/adobe-acrobat-sign-vs-docusign.md)\n- [BoldSign vs Documenso](https://www.anchorterminal.com/compare/boldsign-vs-documenso.md)\n- [BoldSign vs DocuSeal](https://www.anchorterminal.com/compare/boldsign-vs-docuseal.md)\n- [BoldSign vs Dropbox Sign](https://www.anchorterminal.com/compare/boldsign-vs-dropbox-sign.md)\n- [BoldSign vs PandaDoc](https://www.anchorterminal.com/compare/boldsign-vs-pandadoc.md)\n- [BoldSign vs airSlate SignNow](https://www.anchorterminal.com/compare/boldsign-vs-signnow.md)\n- [BoldSign vs SignWell](https://www.anchorterminal.com/compare/boldsign-vs-signwell.md)\n- [BoldSign vs Youtrust](https://www.anchorterminal.com/compare/boldsign-vs-youtrust.md)\n- [Documenso vs Docusign](https://www.anchorterminal.com/compare/documenso-vs-docusign.md)\n- [DocuSeal vs Docusign](https://www.anchorterminal.com/compare/docuseal-vs-docusign.md)\n- [Docusign vs Dropbox Sign](https://www.anchorterminal.com/compare/docusign-vs-dropbox-sign.md)\n- [Docusign vs PandaDoc](https://www.anchorterminal.com/compare/docusign-vs-pandadoc.md)\n- [Docusign vs airSlate SignNow](https://www.anchorterminal.com/compare/docusign-vs-signnow.md)\n- [Docusign vs SignWell](https://www.anchorterminal.com/compare/docusign-vs-signwell.md)\n- [Docusign vs Youtrust](https://www.anchorterminal.com/compare/docusign-vs-youtrust.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "BoldSign vs Docusign", "url": "" } ], "description": "BoldSign scores 70.3 (BB) to Docusign's 64.4 (B) for e-signatures. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "BoldSign BB 70.3", "Docusign B 64.4", "scores" ], "h1": "BoldSign vs Docusign", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/boldsign-vs-docusign", "published": "2026-10-01", "section": "tools", "title": "BoldSign vs Docusign for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-04", "url": "https://www.anchorterminal.com/compare/boldsign-vs-docusign" }, "tokens": { "markdown": 5300, "slim": 3580 }, "version": 1 }