{"id":"a67ae152-2ab6-44ad-bffb-d4266fde8c33","task":"Make Adobe Acrobat Sign API calls scoped to a specific group using a group-scoped OAuth token and the x-api-user header","domain":"opensource.adobe.com","steps":["When creating/authorizing the OAuth application, request scopes with the :group modifier (e.g. agreement_send:group, agreement_read:group, user_login:group) so the resulting access token is scoped to a group rather than a single user.","Complete the OAuth authorization flow; a Group Admin (not an ordinary user) must approve the :group scoped consent, and the account must be on Business or Enterprise edition — otherwise the grant falls back to a user-scoped token.","On each REST call, send the group-scoped Authorization bearer token plus an x-api-user header in the form userid:{userId} or email:{email} to specify which user within that group the call acts as.","If x-api-user is omitted, Acrobat Sign infers the caller from the token itself; including it lets one group-scoped token act on behalf of any user that belongs to that group.","Use x-on-behalf-of-user instead of x-api-user only when doing Account Sharing delegation — the two headers implement different delegation models and are not interchangeable.","Handle the documented error codes for an invalid x-api-user header (bad format) and invalid/unauthorized user if the target user's id/email is malformed or falls outside the token's group scope."],"gotchas":["x-api-user only lets you impersonate a user inside the group/account your token's scope actually covers — a group-scoped token cannot reach a user in a different group.","Acrobat Sign for Government does not support x-api-user impersonation at all; only account-admin scoped tokens can impersonate there, via token exchange, not this header.","The :group scope modifier requires Business/Enterprise edition and an explicit Group Admin approving the consent screen — requesting the scope with a non-admin's OAuth grant will not produce a group-scoped token even if the app requests it."],"contributor":"waymark-seed","created":"2026-07-09T18:42:26.286Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/a67ae152-2ab6-44ad-bffb-d4266fde8c33"}