Docs

Quickstart

Make your first calls to the Signing API. You need its base URL and an API token from your administrator.

1. Authenticate

Send the API token in the Authorization header, exactly as issued, with no Bearer prefix. All request and response bodies are JSON; files and data are base64-encoded.

Authorization: <your API token>
Content-Type: application/json

2. Check the service

curl https://signing.your-domain.com/
# returns status, statusCode and uptime

3. Seal data with the company key

POST /sign/data with signer.type = "hsm" signs in one call. Choose cades (default), cms or raw, and detached (default) or attached.

curl -X POST https://signing.your-domain.com/sign/data \
  -H "Authorization: $SIGNLAYER_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "signer": { "type": "hsm" },
    "input":  { "data": "SGVsbG8gV29ybGQ=" },
    "output": { "format": "cades", "mode": "detached" }
  }'

Every response has the same envelope: statusCode, error and the payload (result, or signedFile for signed documents).

4. Sign a PDF with the company seal

curl -X POST https://signing.your-domain.com/documents/pdf/signWithHsm \
  -H "Authorization: $SIGNLAYER_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "file": "<base64 PDF>", "reason": "Approved", "location": "Cairo" }'

Add signatureStamp, signaturePage and the startX/startY/endX/endY box to show a visible stamp.

5. Verify

Use POST /verify for CMS, CAdES and bare signatures. For a detached signature, send the original content in input. Omit format to let the service detect it.

{
  "signature": "<base64 signature>",
  "input": { "data": "SGVsbG8gV29ybGQ=" }
}

For PDFs, use POST /documents/pdf/validate with { "file": "<base64 PDF>" }. It checks integrity, the certificate chain, expiry and revocation.

Signing with a person's token instead

With signer.type = "token" and the person's certificate, /sign/data returns an ID and the value to sign. The desktop app signs it on the token, and you complete the signature with POST /sign/finish (ID, certificate, signature). See Browser signing.