Docs
Signing API reference
All operations take and return JSON over HTTPS and require the Authorization header (see Quickstart). Files and data are base64-encoded.
Trace a signing flow
Pick a flow, then step through it. Each step shows who calls whom, the Signing API operation used and the fields passed between steps. Select an operation to jump to its full reference below.
Step 1 of 8: Web page to Desktop app + token
Connect with the Browser SDK and choose a certificate
- Data passed
certificate
The desktop app listens only on the local machine, on a secure local WebSocket. Your domain must be on its allow-list.
Operations
Sign
POST/sign/data
Sign data or a file as CMS, CAdES-B-B or a bare signature, attached or detached. One call with the HSM; the first of two calls with a token.
- Required
signerinput- Optional
output- Response
statusCodeerrorresult
POST/sign/finish
Complete a token signature started with /sign/data. The certificate is checked again here.
- Required
IDcertificatesignature- Optional
- none
- Response
statusCodeerrorresult
POST/documents/pdf/prepare
Prepare a PDF for signing with a token: signature field, visible stamp, reason and location. Returns what the token must sign.
- Required
providercertificatecertLabelreasonlocationfile- Optional
certificateChainsignatureStampsignaturePagesignatureFieldNamestartXstartYendXendYtimestamp- Response
statusCodeerrorresult
POST/documents/pdf/finish
Embed the token signature into the prepared PDF and return the signed PDF (PAdES).
- Required
IDcertificatesignature- Optional
- none
- Response
statusCodeerrorsignedFile
POST/documents/pdf/signWithHsm
Sign a PDF in one call with the company seal held in the HSM, with an optional visible stamp.
- Required
filereasonlocation- Optional
signatureStampsignaturePagesignatureFieldNamestartXstartYendXendY- Response
statusCodeerrorsignedFile
POST/remote/pdf/embed
Embed a signature produced on the phone (remote certificate) into a PDF prepared by the mobile SDK.
- Required
filePreparedprep_digestsigned_attrssignaturecertificate- Optional
certificateChainsessionIdtrxId- Response
statusCodeerrorsignedFile
POST/raw/file/prepare
Prepare any file for a detached or attached CMS signature with a token. Legacy flow; prefer /sign/data.
- Required
providercertificatecertLabelfile- Optional
mode- Response
statusCodeerrorresult
POST/raw/file/finish
Complete a file signature started with /raw/file/prepare. Legacy flow; prefer /sign/finish.
- Required
IDcertificatesignature- Optional
- none
- Response
statusCodeerrorsignedFile
Validate and verify
POST/verify
Verify a CMS, CAdES or bare signature, attached or detached. The format can be detected automatically.
- Required
signature- Optional
inputcertificateformatmode- Response
statusCodeerrorformatmoderesult
POST/documents/pdf/validate
Validate every signature in a PDF: integrity, certificate chain, expiry, and revocation through OCSP and CRL.
- Required
file- Optional
- none
- Response
statusCodeerrorresult
POST/remote/pdf/validate
Check a remotely signed PDF for integrity and later modifications. Use /documents/pdf/validate for full trust checks.
- Required
file- Optional
sessionIdtrxId- Response
statusCodeerrorresult
POST/documents/office/validate
Validate the signatures in an Office document.
- Required
file- Optional
- none
- Response
statusCodeerrorresult
POST/raw/file/validate
Validate a file against its detached or attached CMS signature (.p7s).
- Required
p7s- Optional
filemode- Response
statusCodeerrorresult
POST/raw/text/validate
Validate a signature over a piece of text with the signer certificate.
- Required
datasignaturesignerCertificate- Optional
- none
- Response
statusCodeerrorresult
POST/tools/certificate/validate
Validate a certificate: chain to a trusted CA, validity period and revocation status.
- Required
providercertificate- Optional
- none
- Response
statusCodeerrorcertData
Timestamp
POST/documents/pdf/timestamp
Add a trusted document timestamp to a PDF from your RFC 3161 Timestamp Authority.
- Required
file- Optional
- none
- Response
statusCodeerrorsignedFile
POST/raw/file/timestamp
Get an RFC 3161 timestamp token for any file.
- Required
file- Optional
- none
- Response
statusCodeerrorsignedFile
POST/raw/uuid/timestamp
Get a timestamp token bound to an identifier.
- Required
file- Optional
- none
- Response
statusCodeerrordata
Status
GET/
Health check: service status and uptime.
- Required
- none
- Optional
- none
- Response
statusstatusCodeuptime
eInvoice Service
A separate service with its own base URL and token. See E-invoicing.
POST/invoice/sign
Sign invoices with the company seal. You submit them to ETA yourself.
POST/invoice/submit
Sign and submit up to 100 documents to ETA in one call.
POST/invoice/validate
Check the signature on a document you hold.
GET/invoice/:uuid
Fetch a submitted document from ETA.
GET/invoice/:uuid/details
Fetch document details and validation results from ETA.
GET/invoice/recent
List recent documents.
PUT/invoice/:uuid/cancel
Cancel an issued document.
PUT/invoice/:uuid/reject
Reject a received document.
Errors
Errors use the same envelope with an HTTP status code: 400 for invalid input (the message names the field), 401 for a missing or wrong token, and a server error status when a dependency such as the HSM or a Timestamp Authority cannot be reached. The error and message fields say which.