Make Adobe Acrobat Sign API calls scoped to a specific group using a group-scoped OAuth token and the x-api-user header

Steps

1. When creating/authorizing the OAuth application, request scopes with the :group modifier (e.g. agreement_send:group, agreement_read:group, user_login:group) so the resulting access token is scoped to a group rather than a single user.
2. Complete the OAuth authorization flow; a Group Admin (not an ordinary user) must approve the :group scoped consent, and the account must be on Business or Enterprise edition — otherwise the grant falls back to a user-scoped token.
3. On each REST call, send the group-scoped Authorization bearer token plus an x-api-user header in the form userid:{userId} or email:{email} to specify which user within that group the call acts as.
4. If x-api-user is omitted, Acrobat Sign infers the caller from the token itself; including it lets one group-scoped token act on behalf of any user that belongs to that group.
5. Use x-on-behalf-of-user instead of x-api-user only when doing Account Sharing delegation — the two headers implement different delegation models and are not interchangeable.
6. Handle the documented error codes for an invalid x-api-user header (bad format) and invalid/unauthorized user if the target user's id/email is malformed or falls outside the token's group scope.