Documenso discovery and the team-scoped signing API boundary

Documenso is an open-source document signing platform that can be hosted privately. The platform handles signed documents, recipient information, templates, team configurations, API tokens, and webhooks. While the public signing page may be accessible, the API token used to create envelopes or retrieve documents is a team-scoped credential with extensive permissions.

On November 4, 2026, a ZoomEye SDK probe identified a potential Documenso instance. The probe, with parameters sub_type=all, page 1, and page size one, returned no matches for the Documenso title, but returned a 422 error. This discovery indicates the possibility of an exposed API token or an inactive signing flow, but does not confirm the presence of a token or document signing capability.

API tokens in Documenso are scoped to a specific team, inheriting permissions from the user's role within the team. Roles range from administrator with full team access, to manager who can create and edit documents, to member who manages their own documents. The token authority should be reviewed, with separate tokens used for different integrations, proper naming, expiration, and storage outside of public source code. Revoking a token and verifying failed requests is recommended upon integration retirement.

Recipient verification and signing evidence should be separate from the integration's ability to create documents. Documenso can send webhooks notifying the system of various document events. These webhooks should be authenticated and unexpected event formats should be rejected. Self-hosted instances must restrict outbound requests to prevent security risks such as SSRF, limiting access to internal management services, metadata endpoints, and unrelated private networks.

Webhook destinations should be authorized using shared secrets or signatures, with a bounded retry policy and a reviewed list of approved endpoints.

Publicly sharing document-signing links poses risks, as the token or link in the URL can act as a bearer capability. Review the link's expiration, recipient binding, and behavior after cancellation or completion. Self-hosted deployments require a valid signing certificate, which should be inventoried, its trust chain reviewed, renewal process monitored, and failure behavior tested.

A bounded discovery plan should include separate records of title matches, application observations, sub_type=all parameters, timing, page details, and size. Confirm candidate hosts with owners and conduct a full lifecycle test with non-sensitive data to verify the security of owned signing services.