21 CFR Part 11 requests

21 CFR Part 11 is a US FDA regulation for electronic records and signatures (often called GxP). You can send both cfr11 and standard requests through the API, Box Automate, and Box for Salesforce, not only the Box web app.

21 CFR Part 11 in Box Sign requires GxP Validation. An enterprise admin must also enable it for specific users and groups before those users can create cfr11 requests. See 21 CFR Part 11 compliance support.

Choose a request flow

Value	Description
`cfr11`	Enforces 21 CFR Part 11 requirements.
`standard`	The default Box Sign flow.

request_flow is optional. If you omit it, Box Sign uses the enterprise admin default. A value your account cannot use returns a 403 Forbidden error. The field is also returned when you create, get, or list requests and templates. When request_flow is cfr11:

Each signer must log in (login_required is always true). Setting it to false returns a 400 Bad Request error.
signature_color cannot be red. Use blue or black.
Each recipient must have no signature properties, or at least one required signature or initials field. A request with only text fields fails.

Create from a template

Pass template_id and request_flow: "cfr11". Box Sign validates the template signature and initials placeholders when you create the request.

curl -i -X POST "https://api.box.com/2.0/sign_requests" \
     -H "authorization: Bearer <ACCESS_TOKEN>" \
     -H "content-type: application/json" \
     -d '{
       "request_flow": "cfr11",
       "template_id": "123075213-af2c8822-3ef2-4952-8557-52d69c2fe9cb",
       "signers": [
         {
           "role": "signer",
           "email": "signer@example.com"
         }
       ],
       "parent_folder": {
         "type": "folder",
         "id": "0987654321"
       }
     }'

A template that has only non-signature fields returns a 400 Bad Request error.

Create from source files

Box Sign extracts document tags during conversion, so it cannot validate placeholders at request time. For cfr11 requests from source_files, is_document_preparation_needed must be true:

`is_document_preparation_needed`	When validation runs
`true`	On the prepare page, before the request is sent. Box Sign can adjust signature and initials placeholders and warn you if any are resized.
`false`	During conversion after send. If validation fails, the status is `error` with `error_code` `cfr11_validation_failed`, and Box Sign emails the requester. Create a new request after you fix the file.

If you pass both template_id and source_files, the files replace the template document. Validation follows the source-file rules, so is_document_preparation_needed must be true.

Read CFR Part 11 fields

Field	Description
`request_flow`	`cfr11` or `standard`.
`signers[].login_required`	Always `true` for `cfr11`.
`signers[].signature_fields[].reason`	Signing reason for applicable `cfr11` signature fields. Otherwise `null`.
`signers[].signature_fields[].is_validated`	`true` after re-authentication, `false` if the field is filled but not re-authenticated, `null` when it does not apply.

You can get, list, cancel, and resend a cfr11 request even if 21 CFR Part 11 is not enabled for your account. Box checks template permission when you create a request from it, not when you retrieve the template. Requests and templates created before API support for 21 CFR Part 11 still return a request_flow based on the user’s permissions.

Error responses

Scenario	Status	Reason
`login_required` is `false` on a `cfr11` request	`400`	`invalid_parameter`
`signature_color` is `red` on a `cfr11` request	`400`	`invalid_parameter`
A `cfr11` request has only non-signature fields	`400`	`invalid_template`
The `template_id` does not exist or you cannot use it	`404`	`not_found`
You cannot use the specified `request_flow`	`403`	`forbidden_by_policy`

Tag errors on source-file requests are not returned at create time. They display in the signing log as error / cfr11_validation_failed.

Getting started

Applications & integrations

Identity & access

Using the API

Troubleshooting

Content

Collaboration

Metadata & search

Events & webhooks

Users

Intelligent workflow

E-signatures

Security & compliance

21 CFR Part 11 requests

Choose a request flow

Create from a template

Create from source files

Read CFR Part 11 fields

Error responses

​Choose a request flow

​Create from a template

​Create from source files

​Read CFR Part 11 fields

​Error responses

Choose a request flow

Create from a template

Create from source files

Read CFR Part 11 fields

Error responses