pandadoc v1.0.0

The pack names a reference, never a secret. Installing a pack registers capabilities and makes them governable; registration is not connectivity. The credential is created at the provider and held in the client's own secret manager under the reference the pack names, and deployment testing is still required to show the credential path works and cannot be bypassed.

Reference

secret-ref-pandadoc-api-credential

Custody

customer_vault

Injection

header (Authorization)

A PandaDoc OAuth 2.0 access token, held in the client's own secret manager. The stored material must be the complete Authorization header value: the scheme 'Bearer', one separating space, then the access token — 'Bearer <access_token>'. PandaDoc documents OAuth 2.0 as the recommended authentication method for all new integrations and the 'API-Key' header as a legacy method maintained for backwards compatibility with existing integrations. This pack registers only the OAuth credential: the official documentation retrieved for this review does not establish the API key's issuance, expiry or revocation contract, so the API-key option was removed rather than registered on an unresolved custody model — a deployment that wants the legacy key must complete that review itself. customer_vault is the only generally-supported production custody model here — identity_federation and customer_broker are refused at startup and inline is lab-only. Token lifecycle, per PandaDoc's Create/Refresh Access Token reference: the authorization code is one-time-use; the access token's expires_in is 31,535,999 seconds (one year) as currently documented — read expires_in rather than hard-coding a duration — and an expired token returns 401; the stored refresh_token is then exchanged for a new access token at POST /oauth2/access_token with grant_type=refresh_token. The client secret stays with the external process, which MUST own minting and refresh and write the fresh header value into the vault — the executor injects the stored value verbatim and performs no token lifecycle itself, and a stale value fails closed. The retrieved reference documents no token-revocation endpoint and no refresh-token rotation or lifetime semantics, so revocation and refresh-token expiry are unresolved vendor-side custody properties — one reason this pack stays draft; ending the integration's access is an account-side administrative action the deployment must confirm with PandaDoc. Least privilege: PandaDoc documents two scopes, 'read' (view templates and document details) and 'write' (create, send, delete and download documents), and documents 'read+write' as deprecated in favor of 'read write'. This pack needs 'read write' when the create and send capabilities are enabled — note that 'write' also authorizes document deletion, which this pack excludes; that residual breadth is a documented trade-off of the vendor's scope model, not an oversight. Executor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack.

• pandadoc-documents (api, pii): https://api.pandadoc.com/public/v1/documents
• pandadoc-templates (api, internal): https://api.pandadoc.com/public/v1/templates
• pandadoc-contacts (api, pii): https://api.pandadoc.com/public/v1/contacts

Every capability in this pack targets PandaDoc's real shared API host api.pandadoc.com, so no host substitution is required; the only placeholder is DOCUMENT_ID in the send path, an UPPERCASE path segment the deployment binds to a concrete document before enabling. This pack registers only endpoints verified against the official PandaDoc API reference at developers.pandadoc.com: listing documents, listing templates, listing contacts, creating a document, and sending a document. All reads are COLLECTION reads only — single-record paths (document details, template details, contact details) are not registered. Effect-level declaration: PandaDoc documents that sending a document emails the recipients a link to view and sign it, so document send is declared send at the R3 floor — send is one of the IRREVERSIBLE ACTIONS (delete, send, pay, deploy, approve, share and transfer), a sent document cannot be un-sent, and an irreversible action cannot be taken without a person. Document creation is declared create at the R2 floor: it brings a new document into existence but does not itself notify recipients — PandaDoc documents that a created document sits in document.uploaded and then document.draft status until a separate send call. Documented exclusions, framed as what this pack does not register: document update and document status change (PATCH, including voiding a sent document), document delete and bulk delete, document download and export, document recipient/field/section/attachment management, manual reminders (a further send surface), document ownership update and transfer-all-ownership (a transfer effect), template creation/update/duplication/deletion, content library items, forms, contact create/update/delete, catalog items and quotes, notary requests, webhook subscriptions, workspace/user/member administration, and API-key creation — a documented exclusion, not an approximated capability. Authentication: PandaDoc documents two methods, an Authorization: 'API-Key <key>' header (documented as legacy, maintained for backwards compatibility) and OAuth 2.0 bearer tokens (documented as recommended for all new integrations); see the credential note for what the stored value must be. This pack registers the OAuth method only: the retrieved documentation does not establish the legacy API key's issuance, expiry or revocation contract, so that credential option was removed (see the credential note).

Draft review record dated 2026-09-21 · Reviewer: aaes-eng (an opaque id that resolves internally to the responsible reviewer)

• https://developers.pandadoc.com/reference/list-documents (retrieved 2026-09-21)
• https://developers.pandadoc.com/reference/list-templates (retrieved 2026-09-21)
• https://developers.pandadoc.com/reference/list-contacts (retrieved 2026-09-21)
• https://developers.pandadoc.com/reference/create-document (retrieved 2026-09-21)
• https://developers.pandadoc.com/reference/send-document (retrieved 2026-09-21)
• https://developers.pandadoc.com/docs/send-document (retrieved 2026-09-21)
• https://developers.pandadoc.com/reference/authentication (retrieved 2026-09-21)
• https://developers.pandadoc.com/reference/access-token (retrieved 2026-09-21)

A pack review is not a vendor or examiner attestation. A retrieval date says when a source page was read; it does not by itself establish what the page said then. No pack is vendor-endorsed, and none has been connectivity-tested against a live vendor tenant.