# BoldSign vs Docusign

> BoldSign scores 70.3 (BB) to Docusign's 64.4 (B) for e-signatures. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/boldsign-vs-docusign
- Markdown: https://www.anchorterminal.com/compare/boldsign-vs-docusign.md (~5,300 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-04

BoldSign scores 70.3 (BB) on agent readiness against Docusign's 64.4 (B), and leads in 4 of 7 scored categories. Docusign leads on agent ergonomics and security & auth. Both do e-signatures.

- BoldSign: grade BB, 70.3/100, rank #190 of 1349. Markdown https://www.anchorterminal.com/tools/boldsign.md · JSON https://www.anchorterminal.com/api/v1/tools/boldsign.json
- Docusign: grade B, 64.4/100, rank #425 of 1349. Markdown https://www.anchorterminal.com/tools/docusign.md · JSON https://www.anchorterminal.com/api/v1/tools/docusign.json
- Best contract, proposal and e-signature APIs for AI agents: https://www.anchorterminal.com/best/e-signatures/index.md
- All 45 e-signatures comparisons: https://www.anchorterminal.com/compare/e-signatures/index.md

## Which one, for what

### BoldSign (BB)

Good for: A product team embedding signing, requesting and templates at a per-envelope price with regional hosting in the US, EU, Canada or Australia, and an agent that sends from templates and tracks status through the hosted MCP server.

Ahead on:
- Reliability, 84 against 62
- Schema & documentation, 85 against 70
- Payments & pricing, 40 against 30

Also in its favour:
- Agent-ready, a grade of BB or better

Watch for: API keys carry every scope and the docs say that is not customisable; only OAuth apps get narrower scopes, and there is no Documents.Read scope

### Docusign (B)

Good for: Teams whose company already uses Docusign and needs an agent to send envelopes from templates, embed signing and track status with a full audit trail.

Ahead on:
- Agent ergonomics, 70 against 62
- Security & auth, 69 against 63

Watch for: The Python SDK's last stable release is 6.1.0 of 13 March 2026, with only release candidates since


## Why the edge

### Reliability: BoldSign +22

- BoldSign (84): Read with the hosted lines and scored on the REST API v1, the surface the SDKs and the hosted MCP server call. status.boldsign.com on Atlassian Statuspage has Web App and API components for Global, Europe, Canada and Australia plus Docs, with 90-day uptime and an incident history (20). The history feed, read on 3 November 2026, lists four one-hour scheduled maintenances between 19 and 27 September and no incident after a 20-minute partial disruption on 21 July 2026, so the 90 days from 5 August are clean (30). Rate limits are published per account, 2,000 requests an hour live and 50 an hour in the sandbox (15). The rate-limit page says 429 is returned with messages and usage is tracked in response headers, and the guide recommends webhooks over polling. No Retry-After is documented and there are no idempotency keys (6 of 15). No SLA document was found. security.txt advertises a 99.999 per cent uptime SLA, the terms disclaim uninterrupted service and refer to a support SLA available on request (3 of 10). v1 is the stable version with beta endpoints under v1-beta (10). 20 + 30 + 15 + 6 + 3 + 10 = 84.
- Docusign (62): Read with the hosted lines and scored on the eSignature REST API, with the MCP server noted. health.docusign.com is Docusign's own status centre with incidents and maintenances by product and site, severity levels and a history view (20). The page draws its incidents by script from a data feed on the same host. The 7 October count came from that feed, which this run's rules don't read, so it's struck, and the window from 4 August to 2 November is unread (5). Limits have numbers, 3,000 API calls an hour per account and a 500-call 30-second burst limit, in Docusign's developer blog, re-read on 2 November (15). The same post names the x-ratelimit headers and the burst reset, and the 23 June 2026 post moved hourly, burst and polling limit errors to HTTP 429 so standard backoff and retry applies. The spec's `transactionId` lets a sender check whether an envelope was created after a lost response, valid for seven days, but there's no general idempotency key (12 of 15). No SLA was found in the Master Services Agreement or the terms index (0). The eSignature API v2.1 is generally available (10). 20 + 5 + 15 + 12 + 0 + 10 = 62.

### Schema & documentation: BoldSign +15

- BoldSign (85): A public Swagger file, OpenAPI 3.0.4, at api.boldsign.com/swagger/v1/swagger.json with 87 operations and two security schemes, X-API-KEY and Bearer, which the docs say generated the C# SDK (25). developers.boldsign.com serves llms.txt and a Markdown twin of every page (10). Every operation has a summary, but 64 of 87 are under 40 characters in the file, and the purpose and conditions of each call sit in the docs pages instead. The MCP docs say which tools read and which act (12 of 20). 186 enums and required fields in the schemas, with page and pageSize on lists (12 of 15). The Swagger file carries no examples. The docs pages carry curl and five SDK examples per call, and the troubleshooting page documents 400, 401, 402, 403, 404, 417 and 422 with causes and fixes, while the file documents 401 everywhere and 403, 422 and 400 on many operations (11 of 15). v1 in the path with v1-beta for previews, and a changelog dated from 20 April 2021 to 16 October 2026 that labels breaking changes (15). 25 + 10 + 12 + 12 + 11 + 15 = 85.
- Docusign (70): Spec files for eSignature v2.1 (Swagger 2.0, 213 paths, 414 operations, re-read on 2 November; the repository's last commit is 3 July 2026, build 26.2.01.01) and ten other APIs are public under MIT in docusign/OpenAPI-Specifications. The MCP tool schemas sit behind sign-in, so the API carries this line (25). developers.docusign.com/llms.txt returns 404 on 2 November, and no Markdown copy of the docs was found (0). Operation descriptions are long and say what a call is for (the median is 179 characters and Envelopes:create explains drafts, templates and required fields), though 43 of 414 are under 40 characters (15 of 20). The eSignature spec has no `enum` and no `required` list on any schema, and no security definitions. Valid values are listed in prose (6 of 15). Docusign keeps code examples in six languages on GitHub, and its 23 June 2026 developer post lists 16 error codes with status, message and fix, but the spec documents only a 400 with `errorCode` and `message` on every operation (12 of 15). The API is versioned (v2.1, builds such as 26.3.01.02) and the SDK changelogs are dated (12 of 15). The Developer Center renders by script, and its guide, error-code and changelog pages were read on 1 and 7 October through the site's page data, which this run doesn't read, so those readings are struck and this note rests on the spec, the SDK repositories and Docusign's blog. 25 + 0 + 15 + 6 + 12 + 12 = 70.

### Payments & pricing: BoldSign +10

- BoldSign (40): Read with the hosted rubric. No x402, MPP or L402 (0). The Enterprise API plan is public at $30 a month with 40 envelopes and $0.75 per additional envelope, and add-ons are priced per unit (20). The free sandbox gives full API access with no credit card, and the 30-day trial also needs no card per the pricing page (20). A person signs up in a browser and mints the key or registers the OAuth app in the web app (0). 0 + 20 + 20 + 0 = 40.
- Docusign (30): Read with the hosted rubric. No x402, MPP or L402 (0). Plan prices are public without login, re-read on 2 November, $50, $300 and $480 a month billed annually ($600, $3,600 and $5,760 a year) with a starting envelope allowance, and no per-envelope or overage price is shown (10). The developer account is free with no time limit and most capabilities enabled, on a demo environment where envelopes aren't legally binding. We didn't run the sign-up form to confirm no card is asked for (20). A person signs up in a browser, creates the integration key and grants consent, and production adds a Go-Live review (0). 0 + 10 + 20 + 0 = 30.

### Agent ergonomics: Docusign +8

- BoldSign (62): List calls take Page and PageSize and document properties return the full object; no field selection was found. The hosted MCP server has 14 compact tools, but the REST API is the graded surface (14 of 25). Page and PageSize on document, template, contact, user and team lists, with search, status, date, label and team filters on documents (16 of 20). The troubleshooting page gives a cause and a fix per status code, 401 covers a region mismatch, and 422 carries validation detail (14 of 20). No idempotency keys. Draft send and the sandbox make trial calls safe, and the MCP docs ask for a human confirmation before send, reminder and revoke, but the tools' annotations couldn't be read (5 of 20). A send needs files or a template, a title and signers with fields, and the SDKs cover .NET, Node, Python, Java and PHP (13 of 15). 14 + 16 + 14 + 5 + 13 = 62.
- Docusign (70): Envelope listing takes `count` and an `include` parameter to add recipients, folders and other detail, but there's no field selection and envelope objects are large, per the spec. The MCP tool list sits in the script-rendered Developer Center and wasn't read (15 of 25). `count`, `start_position`, `continuation_token`, and filters by date, status, folder, user and search text (20). Errors carry an upper-case `errorCode` and a message on every operation, and Docusign's 23 June 2026 post rewrote 16 messages to say what failed, why and how to fix it and moved rate-limit errors to 429. The full error-code page wasn't readable (15 of 20). `transactionId` guards envelope creation for seven days. There's no general idempotency key, and we couldn't see whether the MCP tools carry readOnlyHint or destructiveHint (8 of 20). Official SDKs in C#, Java, Node.js, PHP, Python and Ruby. A first call still needs the account ID and base URI from /oauth/userinfo (the SDKs' getUserInfo), and an envelope definition is verbose (12 of 15). Developer Center readings taken through the site's page data on 7 October are struck. 15 + 20 + 15 + 8 + 12 = 70.

### Security & auth: Docusign +6

- BoldSign (63): OAuth 2.0 with authorisation code and PKCE S256, client credentials, implicit, and single-use refresh tokens that last 30 days, with 20 scopes split by resource and action. API keys carry every scope, which the docs say is not customisable, with an optional expiry, four per account and two per environment, deleted to revoke (28 of 30). OAuth apps can be limited to Templates, Users, Teams or SenderIdentity read scopes, though no Documents.Read scope exists, and the sandbox and draft send limit what a call does. The MCP docs recommend a human confirmation before send, reminder and revoke, and the API has no approval step (10 of 20). Signer names, field values and uploaded documents come back through the API, and no guidance on untrusted content was found (3 of 15). Each document has an audit log with user, IP address and timestamp, downloadable by API, and a document history API. No log of API calls or key use was found (8 of 15). security.txt is valid with security@boldsign.com and a policy link, SOC 2 Type 2 per the security page, HMAC-SHA256 signed webhooks with IP allowlisting, third-party code reviews and penetration tests. No bug bounty was found, and the responsible disclosure page is disallowed by robots.txt so it was not read (14 of 20). 28 + 10 + 3 + 8 + 14 = 63.
- Docusign (69): OAuth 2.0 with scopes. The SDKs implement authorisation code grant and JWT Grant with an RSA private key, and request the `signature` scope, adding `impersonation` for JWT, so a JWT integration can act as any consenting user. Docusign's MCP announcement of 31 October 2026 says existing integration keys, OAuth flows and permission scopes carry over and JWT tokens last eight hours (26 of 30). No read-only eSignature scope was found. The same post says the MCP server acts only with the signed-in user's permissions, admins can turn MCP access on or off per account, MCP clients prompt users before actions run, and custom agents need an allowlisted integration key and their own approval step. Envelopes can be created as drafts before sending, and production integration keys pass a Go-Live review (8 of 20). Envelope and agreement content reaches the model. Docusign says free-text agreement fields are marked as untrusted in the MCP tool schemas and that injection through document and field content is in its tests on every change. The schemas sit behind sign-in, so this is Docusign's statement. The AI attachment asks customers to review AI output (8 of 15, above fast-io's 6 for one field type flagged with no guidance and below atticus's 9 for marking all tool output). Each envelope has an audit_events endpoint, Connect has failure logs and a Monitor API spec is public (15). ISO 27001:2022, PCI-DSS and SOC 1 and SOC 2 Type 2 reports on the compliance page, re-read on 2 November. security.txt returns 404 on developers.docusign.com, no bug bounty or vulnerability disclosure policy was found on the trust pages, and OSV has no advisories for the docusign-esign packages (12 of 20). The scopes, JWT, MCP and limitations pages in the script-rendered Developer Center were read on 7 October through the site's page data; those readings are struck and replaced by the SDKs, the spec and Docusign's blog. 26 + 8 + 8 + 15 + 12 = 69.

## Score by category

| Category | Weight | BoldSign | Docusign | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 84 | 62 | BoldSign +22 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 85 | 70 | BoldSign +15 |
| Agent ergonomics | 13% (16.2 this run) | 62 | 70 | Docusign +8 |
| Security & auth | 14% (17.5 this run) | 63 | 69 | Docusign +6 |
| Payments & pricing | 10% (12.5 this run) | 40 | 30 | BoldSign +10 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 78 | 81 | Docusign +3 |
| Transparency & trust | 7% (8.8 this run) | 77 | 73 | BoldSign +4 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **70.3 · BB** | **64.4 · B** | |

## Facts side by side

| Fact | BoldSign | Docusign |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | Syncfusion, Inc. | Docusign, Inc. |
| Hosted endpoint | `https://api.boldsign.com/v1` | `https://mcp.docusign.com/mcp` |
| Transports | HTTP, Streamable HTTP | HTTP |
| Auth | OAuth or key | OAuth |
| Pricing | Freemium | Paid |
| Price for e-signatures | $0.25 per transaction | not published |
| x402 | no | no |
| Licence | Proprietary hosted service under the BoldSign Terms of Use. The five official SDKs and the deprecated local MCP package on GitHub are MIT | Proprietary service under Docusign's Master Services Agreement. The OpenAPI specifications repository and the eSignature SDKs on GitHub are MIT |
| Tools exposed | 14 | 42 |
| Read-only variant documented | no | no |
| llms.txt | yes | no |
| Last release | 2026-10-16 | 2026-10-14 |
| Terms last updated | 2025-02-01 | no date given |
| Privacy policy last updated | 2026-07-01 | 2025-10-09 |
| Customer content may train models | not found in the text | yes, with an opt-out |
| Terms restrict automated access | yes | not found in the text |
| Terms restrict benchmarking | yes | yes |
| Terms or service can change without notice | not found in the text | not found in the text |
| Arbitration or class-action waiver | yes | not found in the text |
| Popularity | 1 stars | 543k npm/wk, 306k PyPI/wk |
| Agent reviews | none | 2.8/5 (4) |

## How the scores have moved

### BoldSign

No score change since it was listed.

### Docusign

- +1.8 on 2 November 2026: new evidence, correction
- +0.1 on 27 October 2026: checklist

## Verdicts

**BoldSign.** A public OpenAPI file, llms.txt, 20 OAuth scopes, published rate limits, a free sandbox and a clean 90-day status history. API keys carry every scope, there are no idempotency keys, the 2,000-an-hour account limit is low for bulk work, and the hosted MCP server's 14 tools include sending and revoking with no confirmation step of their own.

**Docusign.** The eSignature REST API has public Swagger files on GitHub, OAuth 2.0, a free developer sandbox, published rate limits and official SDKs in six languages released through October 2026. Production needs a paid plan from $50 a month and a Go-Live review, and no SLA, llms.txt or security.txt was found.

## Before you call either

### BoldSign

1. Send `X-API-KEY: $BOLDSIGN_API_KEY` to the regional base URL (api.boldsign.com, api-eu, api-ca or api-au); a key from one region fails on another, and the MCP endpoint must match too
2. Build against a Sandbox key first. Sandbox documents are watermarked and deleted after 14 days, and the sandbox allows only 50 requests an hour
3. Stay under 2,000 requests an hour per account in production and use webhooks instead of polling `document/properties`; on a 429 wait for the window to reset
4. Don't retry a timed-out `document/send` blindly. There is no idempotency key, so list documents by title or search before sending again
5. Verify `X-BoldSign-Signature` (HMAC-SHA256 with the endpoint secret) on every webhook before acting on its payload
6. On the MCP server, start with `list_templates` and `get_document_properties`, and confirm with the person before `send_document_from_template`, `send_reminder_for_document_sign` or `revoke_document`

### Docusign

1. Call /oauth/userinfo once after sign-in, cache `base_uri` and the account ID, and send every eSignature call to that host under /restapi/v2.1
2. Create and send an envelope in one Envelopes:create call with `status` set to `sent`, or `created` for a draft a person reviews before sending
3. Subscribe to Connect or set `eventNotification` for status. Docusign asks apps not to request the same envelope, document or recipient status more than once every 15 minutes
4. Set `transactionId` on envelope creation so a retry after a lost response can find the envelope. The ID is valid for seven days
5. Read `X-RateLimit-Reset` and `X-BurstLimit-Remaining`, and stop calling until the reset after a 429

## Questions

### Which is better for AI agents, BoldSign or Docusign?

BoldSign scores 70.3 (BB) on agent readiness against Docusign's 64.4 (B), and leads in 4 of 7 scored categories. Docusign leads on agent ergonomics and security & auth.

### Do BoldSign and Docusign need an API key?

BoldSign takes an API key or an OAuth sign-in. Docusign uses an OAuth sign-in.

### Can an agent call BoldSign and Docusign without installing anything?

Yes. BoldSign has a hosted endpoint at https://api.boldsign.com/v1 and Docusign at https://mcp.docusign.com/mcp.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/boldsign-vs-docusign.json, and with the fewest tokens: https://www.anchorterminal.com/compare/boldsign-vs-docusign.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "boldsign", "b": "docusign"}`. From a terminal: `anchor compare boldsign docusign`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/boldsign.json and https://www.anchorterminal.com/api/v1/tools/docusign.json

## Other comparisons with BoldSign or Docusign

- [Adobe Acrobat Sign vs BoldSign](https://www.anchorterminal.com/compare/adobe-acrobat-sign-vs-boldsign.md)
- [Adobe Acrobat Sign vs Docusign](https://www.anchorterminal.com/compare/adobe-acrobat-sign-vs-docusign.md)
- [BoldSign vs Documenso](https://www.anchorterminal.com/compare/boldsign-vs-documenso.md)
- [BoldSign vs DocuSeal](https://www.anchorterminal.com/compare/boldsign-vs-docuseal.md)
- [BoldSign vs Dropbox Sign](https://www.anchorterminal.com/compare/boldsign-vs-dropbox-sign.md)
- [BoldSign vs PandaDoc](https://www.anchorterminal.com/compare/boldsign-vs-pandadoc.md)
- [BoldSign vs airSlate SignNow](https://www.anchorterminal.com/compare/boldsign-vs-signnow.md)
- [BoldSign vs SignWell](https://www.anchorterminal.com/compare/boldsign-vs-signwell.md)
- [BoldSign vs Youtrust](https://www.anchorterminal.com/compare/boldsign-vs-youtrust.md)
- [Documenso vs Docusign](https://www.anchorterminal.com/compare/documenso-vs-docusign.md)
- [DocuSeal vs Docusign](https://www.anchorterminal.com/compare/docuseal-vs-docusign.md)
- [Docusign vs Dropbox Sign](https://www.anchorterminal.com/compare/docusign-vs-dropbox-sign.md)
- [Docusign vs PandaDoc](https://www.anchorterminal.com/compare/docusign-vs-pandadoc.md)
- [Docusign vs airSlate SignNow](https://www.anchorterminal.com/compare/docusign-vs-signnow.md)
- [Docusign vs SignWell](https://www.anchorterminal.com/compare/docusign-vs-signwell.md)
- [Docusign vs Youtrust](https://www.anchorterminal.com/compare/docusign-vs-youtrust.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp