--- title: "Configuring Permission Sets" slug: "configuring-permission-sets" status: "update" updated: 2026-07-17T18:36:00Z published: 2026-07-17T18:36:00Z canonical: "docs.onespan.com/configuring-permission-sets" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.onespan.com/llms.txt > Use this file to discover all available pages before exploring further. # Configuring Permission Sets Every OneSpan Sign Embedded Integration for Salesforce user needs (1) the standard objects/fields Read access (with the optional Apex script), (2) proper access to any custom fields, and (3) one of the three OneSpan Sign permission sets The following standard objects and fields must have at least Read access granted for each OneSpan Sign Embedded Integration for Salesforce user: - Account object - Case object - Contract object - Opportunity object - Product object - Contact object - Contact fields: - Account - Email - Title - MobilePhone - Lead object - Lead fields: - Email - Title - MobilePhone While it is possible to manually configure these permissions, the following script can be used by advanced OneSpan Sign Embedded Integration for Salesforce administrators to automate the creation of this permission set. This script will create a permission set that grants Read access to the fields above. To grant permissions using a script: 1. Log into OneSpan Sign Embedded Integration for Salesforce. 2. Click the Setup icon. 3. Click Developer Console. 4. Click Debug, and then Open Execute Anonymous Window. 5. In the Enter Apex Code window that appears copy and paste the following code: ```plaintext PermissionSet ps = new PermissionSet(Name = 'StandardFields', Label = 'Standard Fields Permissions', LicenseId = [SELECT Id FROM UserLicense WHERE Name = 'Salesforce' LIMIT 1].Id, Description='This is permission set which grants access to standard fields needed by OSS application'); insert ps; List objPerms = new List(); List fieldPerms = new List(); Map> objectsAndFieldsForReadAccess = new Map>(); objectsAndFieldsForReadAccess.put('Account', new List()); objectsAndFieldsForReadAccess.put('Case', new List()); objectsAndFieldsForReadAccess.put('Contact', new List{'Email', 'Title', 'MobilePhone', 'Account'}); objectsAndFieldsForReadAccess.put('Contract', new List()); objectsAndFieldsForReadAccess.put('Document', new List()); objectsAndFieldsForReadAccess.put('Lead', new List{'Email', 'Title', 'MobilePhone'}); objectsAndFieldsForReadAccess.put('Opportunity', new List()); objectsAndFieldsForReadAccess.put('Product2', new List()); for(String objectName :objectsAndFieldsForReadAccess.keySet()){    ObjectPermissions objPermission = new ObjectPermissions();    objPermission.ParentId = ps.Id;    objPermission.PermissionsRead = true;    objPermission.SobjectType = objectName;    objPerms.add(objPermission);    for(String fieldName :objectsAndFieldsForReadAccess.get(objectName)){        FieldPermissions fieldPermission = new FieldPermissions();        fieldPermission.SobjectType = objectName;        fieldPermission.PermissionsRead = true;        fieldPermission.ParentId = ps.Id;        fieldPermission.Field = objectName + '.' + fieldName;        fieldPerms.add(fieldPermission);    } } insert objPerms; insert fieldPerms; ``` 6. Click Execute. 7. Assign this permission set to your users. ## Custom Fields When a user opens a Transaction or Transaction Template, the OneSpan Sign Embedded Integration for Salesforce connector queries all fields on the transaction or transaction template object. If you are creating and adding custom fields to either of these pages you must ensure that your users have at least Read access privileges to these custom fields. If you do not, they may receive an insufficient privileges error. If you are adding a custom field that is of a Lookup or Master-Detail type, then you must also give your users Read access to the related object of that new custom field. If you are using [Field Mappings](/v1/docs/using-conventions-field-mappings), the custom fields that you are creating must be accessible (for insert), and editable (for writeback). As such, ensure that your users have the proper access as needed. ## Basic Permission Set Configurations Any combination of the following three Permission Sets can be configured on a given OneSpan Sign Embedded Integration for Salesforce account: - [OneSpan Sign User](/v1/docs/configuring-permission-sets#onespan-sign-user) - [OneSpan Sign Template Admin](/v1/docs/configuring-permission-sets#onespan-sign-template-admin) - [OneSpan Sign Admin](/v1/docs/configuring-permission-sets#onespan-sign-admin) OneSpan Sign Admins must have the profile of a Salesforce System Administrator. OneSpan Sign Admins can prepare transactions or templates only if they own them. - To enable the above Permission Sets to view and access the OneSpan Sign option in the Salesforce.com App Menu, see [Configuring the Salesforce.com App Menu](/v1/docs/configuring-the-salesforcecom-app-menu). ## OneSpan Sign User These users: (1) have access to the Transactions page; (2) can create, modify, and send document transactions; (3) can create transactions from scratch or from templates. A OneSpan Sign User must have the following permissions enabled: | Permission Name | Reason | | --- | --- | | API Enabled | Allows the user to perform any transaction-related operation. | ## OneSpan Sign Template Admin These users can: (1) create, modify, activate and deactivate templates; (2) create and modify transactions from scratch or from templates; (3) send transactions; (4) create, modify, and delete OneSpan Sign Conventions. A OneSpan Sign Admin must have the following permissions enabled: | Permission Name | Reason | | --- | --- | | API Enabled | Allows the user to perform any transaction-related operation. | ## OneSpan Sign Admin These users: (1) have all the permissions of the previous two Permission Sets; (2) can access the OneSpan Sign Admin page; (3) can modify the Permission Sets of other users. A OneSpan Sign Template Admin must have the following permissions enabled: | Permission Name | Reason | | --- | --- | | API Enabled | Allows the user to perform any transaction-related operation. | | Customize Application | To select the URLs to connect to, and to connect with the backend. The backend allows you to modify settings on Admin page. | | Manage Custom Permissions | Required by the Customize Application permission. | | Manage Connected Apps | Used to setup a Connected App, if the user is connecting to a custom OneSpan Sign instance. | | View Roles and Role Hierarchy | Required by the View Setup and Configuration permission. | | View Setup and Configuration Permission | Required by the Customize Application permission. | ## Configuring the Salesforce.com App Menu If you are a OneSpan Sign Admin, you should also be a Salesforce System Administrator. If so, you can always access the OneSpan Sign option in the Salesforce.com App Menu. The following procedure describes how to enable that functionality for: - OneSpan Sign Users - OneSpan Sign Template Admins - OneSpan Sign Admins who are not Salesforce System Administrators The following procedure won't work on a Permission Set that is provided as part of a managed package. To configure the Salesforce.com App Menu with the functionality described above: 1. Log in to the relevant Salesforce.com organization as a System Administrator. 2. Go to the Setup page. 3. On the left pane, click Users > Permission Sets. The Create Permission Set page appears. 4. Click New to create a Permission Set. 5. Type relevant Permission Set information, and ensure that the User License is set to None. 6. Click Save. The Permission Set page appears. 7. Under Apps, click Assigned Apps, and then click Edit. 8. Select the OneSpan Sign app from the Available Apps section, and then click Add. 9. Click Save. 10. Assign the new Permission Set to all relevant users.