This is not the same as the documentation MCP server at
https://docs.sajn.se/mcp. That one only searches these docs and needs no login. The sajn MCP server connects to your real account data and requires authentication.Server URL
Authentication
The sajn MCP server uses OAuth 2.0. Most MCP clients, such as Claude, ChatGPT, and Cursor, find the server’s OAuth settings and start the sign-in themselves. The client opens the sajn consent screen, where you choose what the assistant gets:- Pick a workspace.
- Pick a level for that workspace: Läs (read), Skriv (write), or Administrera (administer). Skriv is preselected.
- To add another workspace from the same organization, select Lägg till arbetsyta and repeat the first two steps.
- On the review step, use the ⋯ menu on a row to change its level, make it the default workspace with Gör till standard, or remove it.
- Select Godkänn.
Levels and permissions
Each workspace in a connection has its own level:
A tool call passes four checks in the workspace it acts in, and each check can only narrow the one before it:
- The level you granted for that workspace.
- Your role in that workspace.
- The workspace’s policy for AI agents in Inställningar > AI.
- The workspace’s AI switch. A workspace with AI turned off refuses every tool call.
documents:read, and keep working.
Some tools need a workspace permission as well — most notably the developer tools, which require Manage developer (API logs) or Manage webhooks, so only developers can read raw traffic.
Working in several workspaces
A call acts in the default workspace unless it names another one. When a connection covers more than one workspace, every tool takes an optionalworkspaceId argument: the workspace’s id, slug, or name. The assistant fills it in, so you name the workspace in plain words, such as “create it in Juridik”.
getCurrentUserlists the connected workspaces and marks the default.- A call about an existing document runs in the workspace that holds the document, so you don’t name it.
- Every result names the workspace the call acted in.
- A workspace outside the connection is refused, and so is a name that two connected workspaces share. The error lists the connected workspaces.
Tools
An MCP client loads every listed tool into every conversation, so the server lists only the 22 everyday tools. Every other tool is reached throughfindTools. The assistant does this itself: you ask in plain words, and it finds and runs the right tool.
Each tool needs a level in the workspace it acts in, and most also need a permission in your role. Tools marked destructive send, delete, overwrite, or change access, so your client asks you before it runs them.
Everyday tools
Reaching the other tools
findToolstakes a description of the task, such as “invite a member”, and returns the best-matching tools with their input schemas.- The assistant runs a read-only match with
runReadOnlyTooland any other match withrunTool.
runTool or runReadOnlyTool passes every check that a direct call passes, including the level of the tool it runs. If findTools returns a match under blockedByPolicy, the workspace’s AI agent policy has switched that tool off. An administrator can allow it under Inställningar > AI.
The ChatGPT app works differently: it lists its tools directly and has no findTools. It covers the everyday signing workflow: createDocument, findDocuments, sendPartyReminder, summarizeContent, getDocumentReadiness, getDocument, sendDocument, withdrawDocument, getSettings, updateSettings, getSigningMethods, setCustomFieldValue, getParties, addParty, updateParty, removeParty, getFields, getField, addTextField, updateTextField, addFormField, updateFormField, removeField, getFieldValues, setFieldValues, getDocumentFile, findTemplates, getTemplate, createContact, updateContact, findContactsByCustomField, findContacts, getContact, createCompany, submitForApproval, findActions, dismissAction, snoozeAction, findCustomFields, getUsage, reportMissingCapability, getCurrentUser.
All tools by area
Documents
Content and fields
setFieldValues writes values in form blocks and in fields on uploaded PDFs, both the PDF’s own form fields and fields placed on top of it. getFieldValues lists each value with who fills it. A value assigned to a party is read-only: that party fills it in when signing.
Parties
Approvals
Comments
Folders, tags and custom fields
Actions, reminders and notifications
Templates
Contacts, companies and products
sajn ID
Reports
Members and roles
Workspace and organization settings
Your account
Developer tools
Connection and support
Uploading a PDF
A tool call carries JSON, not file bytes, so the file itself never goes through the MCP connection. How it reaches sajn depends on whether the assistant can run shell commands or raw HTTP requests. Assistants that can run commands (Claude Code, agents with a shell tool) upload on their own:createDocumentcreates the draft.createUploadUrlreturns a single-use upload URL and anuploadKey.- The assistant sends the file to that URL in a
PUTrequest. addDocumentFileadds the file to the document. Word, Excel, and other Office files are converted to PDF at this step.
- The assistant calls
createDocumentand gives you the link it returns. - You open the link and drag the PDF onto the document.
- You tell the assistant it’s uploaded, and it continues —
getFieldsto see the PDF,getFieldValuesto see what can be filled in, then parties and sending as usual.
The link is an ordinary document URL, not a token — opening it requires your own sajn login. An assistant that asks you to paste a document’s contents into the chat is getting it wrong.
Importing signed agreements into the archive
To add agreements that were signed outside sajn, ask the assistant to import them into the archive. It creates one document per file withtype set to ARCHIVE_IMPORTED, titled after the file name, and attaches the file through either of the preceding routes.
Setup
- ChatGPT
- Claude Code
- Claude Desktop
- Cursor
- VS Code
- Open the sajn app in the ChatGPT app directory.
- Connect the app.
- Sign in to sajn, pick the workspaces and a level for each, and select Godkänn.
Example prompts
Working on documents- “Draft an NDA from our standard template, add Anna at Ribban as signer with BankID, and show it to me before sending.”
- “What’s still missing on the Volvo agreement before I can send it?”
- “Fill in the amount as 45 000 SEK and the start date as 1 September, then send it.”
- “Add a price table with 10 hours of consulting at 1 200 SEK, 25% VAT.”
- “Which documents are waiting for signatures, and who’s holding them up?”
- “Remind everyone who hasn’t signed the Q3 contracts.”
- “What expires in the next 30 days?”
- “Push the deadline on the Ribban agreement out by two weeks.”
- “List the failed webhook deliveries from the last day and show me the response body of the first one.”
- “Find the API requests that returned 4xx today and tell me what’s wrong with them.”
- “Which webhook endpoint is failing, and what status code is it returning?”
Security
- Workspace-scoped — a connection only reaches the workspaces you picked at consent, all in one organization.
- Least privilege — each call is checked against the level you granted for the workspace it acts in, and developer tools also need a workspace permission.
- Same enforcement as REST — scopes and role permissions are re-checked on every tool call, not just at listing time.
- Confirmation hints — tools that email or SMS a counterparty, or destroy work, are marked destructive so your client can prompt first.
- Rate limited — per-IP and per-organization limits apply, the same as the REST API.
Troubleshooting
Tool names changed — my scripts broke
Tool names changed — my scripts broke
The tools now share their names with the assistant built into sajn. The most common renames:
For anything else, call
findTools with what you want to do.The debugging tools don't show up
The debugging tools don't show up
The member must hold the matching workspace permission — Manage developer for API logs, Manage webhooks for deliveries. A connection made before the levels existed also needs the
audit:read scope. To get it, reconnect the server.Connection rejected / 401
Connection rejected / 401
- Confirm the URL is
https://app.sajn.se/api/mcp(note/api/mcp, not/mcp). - Reconnect the server and complete the OAuth consent flow again.
The assistant says the application lacks permission
The assistant says the application lacks permission
The call needs a higher level than you granted for that workspace, such as Skriv to create or send. Reconnect the server and pick a higher level for the workspace.
The assistant works in the wrong workspace
The assistant works in the wrong workspace
Name the workspace in your request, such as “in Juridik”. To change which workspace it uses by default, reconnect the server and use Gör till standard on the review step. A workspace created after you connected is not in the connection until you reconnect.
The assistant says it can't edit a sent document
The assistant says it can't edit a sent document
That’s correct — parties, fields and content are locked once a document is out for signing. Withdraw it with
withdrawDocument to make it a draft again (the parties are notified), or move the expiry date with updateSettings if that’s all you need.Next steps
Choosing an authentication method
The OAuth flow above is for assistant clients — see which credential your own integration needs
Webhooks
Set up and debug webhook endpoints

