Vaults

A vault is where envelopes and templates live, and what decides who inside the account can reach them. Every envelope needs one, and a new account has none — creating a vault is the first call most integrations make.

Types

API value	Label in the app	Who can reach it
`Account`	Account	Everyone in the account.
`UserAccount`	Personal	Only its owner.
`UserAccountGroup`	Group	Only the users granted access.

Administrators reach every vault in the account, whatever its type.

Sandbox and production vaults are separate: a token only ever sees vaults from its own environment.

Listing

Endpoint	Returns
`GET /v1/ecm/vaults/user-accounts`	The vaults you can reach.
`GET /v1/ecm/vaults/accounts`	The account's vaults. `isFavorite` means favourited by you.
`GET /v1/ecm/vaults/user-accounts/{userAccountId}`	Another user's vaults. Administrators only.
`GET /v1/ecm/vaults/{vaultId}/list`	The envelopes and templates inside one vault.

GET /v1/ecm/vaults/members returns the account roster you can use to populate a group vault. It includes deactivated seats, flagged isActive: false — filter them out before feeding the ids back, or you will add dead members.

Ownership and membership

Vault updates are a full replace, and three of their behaviours will bite an unprepared sync job.

Changing the type to UserAccount transfers ownership to whoever made the call. Renaming another user's personal vault as an administrator makes it yours. Changing the type to Account or UserAccountGroup clears the owner instead.

Changing a group vault to any other type removes all of its members.

Unknown member ids are silently dropped on update. A PUT that sets type: "UserAccountGroup" with ids that do not resolve returns 204 and leaves you with a group vault that has no members at all — and therefore nobody but administrators can open it. On create, the same ids are an error instead. Always read the vault back after a membership change.

Members are matched, not truncated: ids you leave out are removed, ids already present are untouched, new ids are added. Ids belonging to another account are refused with 400 User Account not found, even for vault types that ignore membership.

Deleting

DELETE /v1/ecm/vaults/{vaultId} is a soft delete. A vault that still holds envelopes or templates cannot be deleted — trashed content does not count, so a vault whose contents are all in the trash can still be removed.

Moving envelopes

POST /v1/ecm/envelopes/{envelopeId}/to/{vaultId} moves an envelope. There is no restriction between types: only your access to the destination matters.

Restoring a trashed envelope also takes a destination vault, and moves it there.

Types#

Listing#

Ownership and membership#

Deleting#

Moving envelopes#

Types

Listing

Ownership and membership

Deleting

Moving envelopes