Microsoft Power Platform

Build Penneo Sign flows in Microsoft Power Automate with our certified connectors

Power Automate connectors

Penneo publishes two certified connectors for Microsoft Power Platform. They let you create case files, poll for case file creation, poll for casefile status, and download signed documents from a Power Automate flow without writing any code.

Both connectors are open source and maintained in Microsoft's connector repository:

Choosing an environment

The two connectors expose exactly the same actions with exactly the same fields. The only difference is which Penneo environment they talk to:

ConnectorEnvironmentAPI hostOAuth host
Penneo SignProductionapp.penneo.comlogin.penneo.com
Penneo Sign SandboxSandboxsandbox.penneo.comsandbox.oauth.penneo.cloud

Build and test your flow with Penneo Sign Sandbox, then swap the connection over to Penneo Sign for production. Because the action names and fields are identical, no other changes to the flow are needed.

📘

A sandbox account is separate from your production account. If you don't have one, contact Penneo support to get sandbox access before you start.

Prerequisites

  • An active Penneo account (a sandbox account for the sandbox connector).
  • A Power Automate, Power Apps, or Logic Apps environment.

Authentication

Both connectors use OAuth 2.0 Authorization Code Grant. When you create the connection, Power Platform redirects you to Penneo's login page and you sign in with your regular Penneo credentials - there are no API keys to manage in the flow.

The connectors request no scopes, and the connection acts as the signed-in user - so the case files it creates are owned by that user, and it can only read case files that user has access to.

Actions

Each connector ships four actions.

ActionWhat it does
Create a new case fileQueues a new case file with your documents and signers. Returns a job uuid and payloadHash.
Check job statusPolls the creation job using uuid + payloadHash until it is completed (or failed). Returns the caseFileId that are used in the next actions.
Get case file detailsReturns a case file's status, signers, and documents (including the document ids) by caseFileId.
Download documentReturns a document's content as a base64 encoded string.

The typical flow

Case file creation is asynchronous, so a complete end-to-end flow has four steps:

  1. Create a new case file - pass the title, base64 encoded PDFs, and signers. You get back a job uuid and a payloadHash.
  2. Check job status - poll with that uuid and payloadHash until jobStatus is completed. The completed job's result contains the created caseFileId.
  3. Get case file details - call with the case file id. Wait for status 5 (completed) before downloading; until then the signers haven't all signed.
  4. Download document - call once per document id from step 3, then decode the base64 content into a PDF file.
🚧

Steps 2 and 3 are polling steps. Use a Do until loop with a delay between iterations rather than a tight loop, and remember that a case file can end in a non-completed state (rejected, expired, failed) - handle those branches too.

Create a new case file

The request body is a single caseFile object.

Case file fields

FieldTypeRequiredNotes
titlestringYes1–1024 characters.
documentsarrayYesSee Document fields.
signersarrayYesSee Signer fields.
languageenumNoen, da, sv, nl, fr, fi, no, de. Applied to signers without their own language.
sendAtinteger (UNIX ts)NoWhen to send the case file. Empty = send immediately.
expireAtinteger (UNIX ts)NoWhen the case file expires. Defaults apply if omitted.
visibilityModeintegerNo0 = signers see all documents (default), 1 = signers see only what they must sign.
sensitiveDatabooleanNoSigners must validate their identity before accessing documents. Also disables email attachments.
disableEmailAttachmentsbooleanNoLeaves signed documents out of finalisation emails. Overridden when sensitiveData is true.
disableNotificationsOwnerbooleanNoStops notifications to the case file owner.
signOnMeetingbooleanNoDocuments are signed during a physical meeting.
folderIdintegerNoPlaces the case file in a specific Penneo folder.
referencestringNoShown in the Penneo web application — handy for correlating with your own system's record id.
metaDatastringNoSearchable in Penneo via API.
ccRecipientsarrayNoname and email; receive a copy of the signed documents.

Document fields

FieldTypeRequiredNotes
titlestringYes1–1024 characters.
pdfstringYesBase64 encoded PDF.
signablebooleanNotrue (default) = signable document, false = read-only attachment.
rolesarrayNoSigner roles allowed to sign this document. Empty = all signers.
documentOrderintegerNoSigning order of the document. Defaults to the order supplied.
metaDatastringNoSearchable in Penneo.

Signer fields

Only name is strictly required, but in practice you also want email so Penneo can send the signing request.

FieldTypeNotes
namestringRequired.
emailstringPenneo handles all communication with the signer.
rolestringMin. 3 characters. Letters, numbers, spaces, comma, underscore, hyphen. Must not end in a space. Match with documents[].roles.
signOrderinteger0 (default) = no enforced order. Use ascending numbers for sequential signing.
languageenumSame list as the case file language.
reminderIntervalintegerDays between reminders.
activeAt / expireAtintegerUNIX timestamps controlling when this signer can sign.
successUrl / failUrlstringRedirect URLs after signing succeeds or fails.
onBehalfOfstringCompany or organisation the signer signs for.
storeAsContactbooleanDefault true — stores the signer as a contact in Penneo.
accessControlbooleanValidates SSN / VATIN / phone before granting access.
socialSecurityNumberPlainstringSSN or phone number. Use E.164 format for phone numbers.
ssnTypeenumlegacy (default), dk:cpr, se:pin, no:nin, be:nrn, fi:pic, sms, google:oidc, microsoft:oidc.
vatinstringVAT number of the signer's company.
secureSigningMethodsarrayRestricts eID methods — see below. Overrides case file and customer settings.
enableInsecureSigningbooleanAllows touch signatures.
insecureSigningMethodsarraytext, draw, image. Empty = company default.
emailSubject / emailTextstringSignature request email. Falls back to your company template.
reminderEmailSubject / reminderEmailTextstringReminder email. Falls back to your company template.
completedEmailSubject / completedEmailTextstringCompletion email. Falls back to your company template.
emailFormatenumtext (default) or html.

Available values for secureSigningMethods:

mitid.dk                    bankid_se                   bankid_no
itsme.be                    ftn.fi                      eid.belgium.be
passport-reader.eident.dk   ausweisapp.bund.de
qes.personal.mitid.dk       qes.erhverv.mitid.dk
📘

Every field maps 1:1 to the Create case file API reference, so use that page when you need the full detail behind a field.

Check job status

Send the uuid and payloadHash from the create step. The response includes:

FieldNotes
jobStatuspending, processing, completed, failed, or aborted_duplicated.
resultReturned as JSON once the job completes — this is where the created caseFileId comes from.
errorMessageOnly present when jobStatus is failed.
createdAt / updatedAtISO 8601 timestamps.
🚧

This action is rate limited to 20 requests per minute per uuid + payloadHash combination. Put a delay in your polling loop and back off on failures.

Get case file details

Takes the caseFileId and returns the case file with its signers (name, id, and the signing request's email and status) and its documents (id, status, and whether the document is signable). The documentIds are what you pass to Download document.

Case file status values:

ValueStatusValueStatus
0new5completed
1pending6failed
2rejected7expired
3deleted8anonymized
4signed

Use status 5 (completed) as the trigger for downloading signed documents.

Download document

Takes a document id and returns a content field with the base64 encoded document. The optional Signed parameter defaults to true.

If a case file contains several documents, loop over the document ids from Get case file details - the action returns one document per call.

Working with base64 in Power Automate

Both the request and response side of these connectors use base64 encoded PDFs:

  • Uploading: use the base64() expression on the file content, for example base64(outputs('Get_file_content')?['body']).
  • Downloading: use base64ToBinary() on the returned content before writing the file, for example in a Create file action for SharePoint or OneDrive.

Large PDFs take longer to process and inflate roughly 33% when base64 encoded, so keep an eye on document size in high-volume flows.

Known limitations

  • Asynchronous creation. Creating a case file returns a job, not a case file. You must poll Check job status; there is no synchronous create.
  • Polling, not webhooks. These connectors have no triggers, so a flow reacting to signing completion has to poll Get case file details. If you need push notifications, use webhooks against the REST API instead.
  • Rate limit. 20 requests per minute per uuid + payloadHash on Check job status.
  • Environment is fixed per connector. A connector cannot be pointed at a different Penneo environment - pick the connector that matches the environment.

Where to go next