SignRequest
Connect SignRequest to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect SignRequest to collect digital signature evidence with automated compliance tests, switched on per workspace.
| Category | Digital Signature |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| SignRequest's guide | signrequest.com |
Connect with an API token
-
In SignRequest:
- Sign in to SignRequest with a user who belongs to the Team (the API requires a Team to be enabled).
- Open the team API settings page (https://signrequest.com/#/teams) and create an API token for the team.
- Copy the token; SignRequest expects it in an
Authorization: Token <token>header.
Where to find the other values:
- API token: The team API settings page (https://signrequest.com/#/teams).
- Subdomain: Your team's address, https://<your_subdomain>.signrequest.com; API calls for the team use https://<your_subdomain>.signrequest.com/api/v1/.
SignRequest's public documentation does not cover every step.
Source is the 'Getting Started' and 'API Token' text of SignRequest's own OpenAPI document served from its API docs page: 'You can create an API token in the team API settings page' (linked to /#/teams). It does not name the buttons on that page or say whether the token is shown only once, so those steps are not given. Tokens are team-wide; SignRequest documents no read-only scope. A free Sandbox Team can be used for testing (documents are watermarked). The earlier run found SignRequest's help centre stating 'SignRequest is no longer offering new API integrations!' and pointing to the Box Sign API; the help centre article 'Generate an API token' returned HTTP 403 in this run (both directly and via the Help Center JSON API), so its click path could not be read.
Source: signrequest.com, signrequest.com, checked 2026-10-07.
The permissions Safeguard needs:
team API token. SignRequest issues no read-only credential. Safeguard only reads with it, and you can revoke it at any time. -
On Compliance › Connectors, open SignRequest, click Connect, choose API token and fill in:
Field What to enter API token Required. Stored encrypted and never shown again. Subdomain Required. The part before .signrequest.com in your address. -
Click Connect with token.
Frameworks
Safeguard's automated tests read SignRequest and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.2, CC6.3 | 3 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.6.5, A.8.2 | 3 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4) | 3 |
| PCI DSS | Automated tests | 7.2.2, 7.2.4, 8.2.5 | 3 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-05 | 3 |
These tests are switched on per workspace by the Safeguard team.
Related
- Digital Signature connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks