Sign
E-signatures
What it is for
Manage templates and signature requests through draft, sent, signed, declined and expired, and record the document hash that was signed. The platform cannot yet lock a record, so a signed request is immutable by convention only.
What the package does and does not do
Document templates and signature requests with a draft, sent, signed, declined, expired flow. A request names the signer (personal data) and keeps the signature evidence as references. A signed request is immutable by convention only: the platform cannot yet lock a record, so nobody should edit a request once it is signed, and the document_hash records what was signed. Sending and recording a signature need a human approval; agents may only propose them.
Models
sign_template
A document that can be sent out for signature
Read group: sign.user. Write group: sign.manager.
| Field | Kind | Data class | Personal data | Group | Agents see | Description |
|---|---|---|---|---|---|---|
name | text | none | no | sign.user | in clear | Template name, for example Employment contract |
description | longtext | none | no | sign.user | in clear | What the document is for and who signs it |
body | longtext | none | no | sign.user | in clear | The document text, or a reference to where the file is kept |
signer_role | text | none | no | sign.user | in clear | Role of the person who signs, for example Customer |
active | bool | none | no | sign.user | in clear | Whether new requests can use the template |
sign_request
A request for one person to sign one document
Read group: sign.user. Write group: sign.user.
| Field | Kind | Data class | Personal data | Group | Agents see | Description |
|---|---|---|---|---|---|---|
template_id | ref → sign_template | none | no | sign.user | in clear | The document to sign |
title | text | none | no | sign.user | in clear | Subject shown to the signer |
message | longtext | none | no | sign.user | in clear | Message shown to the signer in the request |
signer_name | text | internal | yes | sign.user | masked | Name of the person who must sign |
signer_email | text | internal | yes | sign.user | masked | Email address the request is sent to |
sent_on | date | none | no | sign.user | in clear | Day the request was sent (YYYY-MM-DD) |
expires_on | date | none | no | sign.user | in clear | Last day the request can be signed (YYYY-MM-DD) |
signed_on | date | none | no | sign.user | in clear | Day the document was signed (YYYY-MM-DD) |
signer_ip | text | internal | yes | sign.manager | masked | IP address the signature came from (evidence) |
signer_user_agent | text | internal | yes | sign.manager | masked | Browser the signature was made with (evidence) |
signature_reference | text | none | no | sign.manager | in clear | Where the signature image or certificate is stored |
document_hash | text | none | no | sign.manager | in clear | SHA-256 hash (hex) of the signed document, to prove it was not changed afterwards |
state | select (draft, sent, signed, declined, expired) | none | no | sign.user | in clear | Request status: draft, sent, signed, declined, expired |
Workflows
sign_request
| Action | Moves | Who may run it | Approval |
|---|---|---|---|
sign_request.send | state: draft → sent | sign.user | yes |
sign_request.sign | state: sent → signed | sign.manager | yes |
sign_request.decline | state: sent → declined | sign.user | no |
sign_request.expire | state: sent → expired | sign.user | no |
Permission groups
Groups used by this app:
sign.managersign.user
Approval steps
Steps an agent can only propose:
sign_request.sendsign_request.sign
What agents can and cannot do
An agent can read, search, create and update records of this app, and run the actions that need no approval, within the permission groups of its token.
It can only propose these steps, and a person must approve them: sign_request.send, sign_request.sign, sign_template.delete, sign_request.delete.
Personal data is masked as placeholder tokens: sign_request.signer_name, sign_request.signer_email, sign_request.signer_ip, sign_request.signer_user_agent.
Dependencies
None.
Install
Install it from the Customize app (Marketplace), or from the command line:
obop modules install-from signNeeds a database and administrator rights.