> ## Documentation Index
> Fetch the complete documentation index at: https://developer.box.com/llms.txt
> Use this file to discover all available pages before exploring further.
# 21 CFR Part 11 requests
> Send GxP signature requests through the Box Sign API with request_flow set to cfr11, and handle the extra validation rules.
export const MultiRelatedLinks = ({sections = []}) => {
if (!sections || sections.length === 0) {
return null;
}
return
{sections.map((section, index) => )}
;
};
export const RelatedLinks = ({title, items = []}) => {
const getBadgeClass = badge => {
if (!badge) return "badge-default";
const badgeType = badge.toLowerCase().replace(/\s+/g, "-");
return `badge-${badge === "ガイド" ? "guide" : badgeType}`;
};
if (!items || items.length === 0) {
return null;
}
return ;
};
[21 CFR Part 11][cfr] is a US FDA regulation for electronic records and
signatures (often called GxP). You can send both `cfr11` and `standard`
requests through the API, Box Automate, and Box for Salesforce, not only the
Box web app.
21 CFR Part 11 in Box Sign requires GxP Validation. An enterprise admin must also enable
it for specific users and groups before those users can create `cfr11`
requests. See [21 CFR Part 11 compliance support][cfr].
## Choose a request flow
| Value | Description |
| ---------- | ------------------------------------- |
| `cfr11` | Enforces 21 CFR Part 11 requirements. |
| `standard` | The default Box Sign flow. |
`request_flow` is optional. If you omit it, Box Sign uses the enterprise admin
default. A value your account cannot use returns a `403 Forbidden` error. The field is
also returned when you create, get, or list requests and templates.
When `request_flow` is `cfr11`:
* Each signer must log in (`login_required` is always `true`). Setting it to
`false` returns a `400 Bad Request` error.
* `signature_color` cannot be `red`. Use `blue` or `black`.
* Each recipient must have no signature properties, or at least one required signature or
initials field. A request with only text fields fails.
## Create from a template
Pass `template_id` and `request_flow: "cfr11"`. Box Sign validates the template
signature and initials placeholders when you create the request.
```sh theme={null}
curl -i -X POST "https://api.box.com/2.0/sign_requests" \
-H "authorization: Bearer " \
-H "content-type: application/json" \
-d '{
"request_flow": "cfr11",
"template_id": "123075213-af2c8822-3ef2-4952-8557-52d69c2fe9cb",
"signers": [
{
"role": "signer",
"email": "signer@example.com"
}
],
"parent_folder": {
"type": "folder",
"id": "0987654321"
}
}'
```
A template that has only non-signature fields returns a `400 Bad Request` error.
## Create from source files
Box Sign extracts [document tags][tags] during conversion, so it cannot validate
placeholders at request time. For `cfr11` requests from `source_files`,
`is_document_preparation_needed` must be `true`:
| `is_document_preparation_needed` | When validation runs |
| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `true` | On the prepare page, before the request is sent. Box Sign can adjust signature and initials placeholders and warn you if any are resized. |
| `false` | During conversion after send. If validation fails, the status is `error` with `error_code` `cfr11_validation_failed`, and Box Sign emails the requester. Create a new request after you fix the file. |
If you pass both `template_id` and `source_files`, the files replace the template document. Validation follows the source-file rules, so `is_document_preparation_needed` must be `true`.
## Read CFR Part 11 fields
| Field | Description |
| ------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| `request_flow` | `cfr11` or `standard`. |
| `signers[].login_required` | Always `true` for `cfr11`. |
| `signers[].signature_fields[].reason` | Signing reason for applicable `cfr11` signature fields. Otherwise `null`. |
| `signers[].signature_fields[].is_validated` | `true` after re-authentication, `false` if the field is filled but not re-authenticated, `null` when it does not apply. |
You can get, list, cancel, and resend a `cfr11` request even if 21 CFR Part 11
is not enabled for your account. Box checks template permission when you
create a request from it, not when you retrieve the template.
Requests and templates created before API support for 21 CFR Part 11 still return a `request_flow` based on the user's permissions.
## Error responses
| Scenario | Status | Reason |
| ----------------------------------------------------- | ------ | --------------------- |
| `login_required` is `false` on a `cfr11` request | `400` | `invalid_parameter` |
| `signature_color` is `red` on a `cfr11` request | `400` | `invalid_parameter` |
| A `cfr11` request has only non-signature fields | `400` | `invalid_template` |
| The `template_id` does not exist or you cannot use it | `404` | `not_found` |
| You cannot use the specified `request_flow` | `403` | `forbidden_by_policy` |
Tag errors on source-file requests are not returned at create time. They display in the [signing log][log] as `error` / `cfr11_validation_failed`.
[cfr]: https://docs.box.com/en/box-sign/sending-a-document-for-signature/21-cfr-part-11-compliance-support
[tags]: https://docs.box.com/en/box-sign/templates/creating-templates-using-tags
[log]: https://support.box.com/hc/en-us/articles/4404095202579-Viewing-the-signing-log