Signing API
Your applications and ours
Signs PDFs, files and data; validates signatures and certificates; timestamps; keeps per-customer trust and branding; logs every operation.
Platform
One platform, six building blocks.
SignLayer is a set of focused services and SDKs. Use the ones you need; they all meet in the Signing API.
eInvoice Service
Your ERP or accounting system
Builds ETA's canonical invoice, seals it through the Signing API and the HSM, and submits, fetches, cancels or rejects documents at ETA.
HSM gateway
The Signing API
Holds the connection to your hardware security module over PKCS#11 and signs with the company seal on request. The key never leaves the HSM.
Trpass / Tawqe3y desktop app
People signing in a browser
A tray app for Windows, macOS and Linux that lets approved websites use the person's smart card or USB token. The PIN and key stay on the device.
Browser SDK
Web developers
JavaScript that connects your web page to the desktop app and the Signing API for smart-card signing.
iOS and Android remote-signing SDKs
Mobile app developers
Sign PDFs with an ITIDA remote certificate and an OTP, with a visible stamp. White-label per brand.
Platform
What you can sign, and how
Which signature types each channel supports today.
| Smart card (browser) | Phone (remote) | Company seal (HSM) | |
|---|---|---|---|
| PDF signature (PAdES) with visible stamp | Supported | Supported | Supported |
| Data or file signature (CAdES-B-B or CMS) | Supported | Not offered | Supported |
| Bare (raw) signature | Supported | Not offered | Supported |
| ETA e-invoice (CAdES, detached) | Not offered | Not offered | Supported |
| Timestamp during signing | Supported | Not offered | Not offered |
Supported Not offered
API
Signing API operations
The public operations of the Signing API, grouped by job. Full request and response details are in the API reference.
Sign
POST/sign/data | Sign data or a file as CMS, CAdES-B-B or a bare signature, attached or detached. One call with the HSM; the first of two calls with a token. | Smart cardHSM seal |
POST/sign/finish | Complete a token signature started with /sign/data. The certificate is checked again here. | Smart card |
POST/documents/pdf/prepare | Prepare a PDF for signing with a token: signature field, visible stamp, reason and location. Returns what the token must sign. | Smart card |
POST/documents/pdf/finish | Embed the token signature into the prepared PDF and return the signed PDF (PAdES). | Smart card |
POST/documents/pdf/signWithHsm | Sign a PDF in one call with the company seal held in the HSM, with an optional visible stamp. | HSM seal |
POST/remote/pdf/embed | Embed a signature produced on the phone (remote certificate) into a PDF prepared by the mobile SDK. | Phone |
POST/raw/file/prepare | Prepare any file for a detached or attached CMS signature with a token. Legacy flow; prefer /sign/data. | Smart card |
POST/raw/file/finish | Complete a file signature started with /raw/file/prepare. Legacy flow; prefer /sign/finish. | Smart card |
Validate and verify
POST/verify | Verify a CMS, CAdES or bare signature, attached or detached. The format can be detected automatically. | Any |
POST/documents/pdf/validate | Validate every signature in a PDF: integrity, certificate chain, expiry, and revocation through OCSP and CRL. | Any |
POST/remote/pdf/validate | Check a remotely signed PDF for integrity and later modifications. Use /documents/pdf/validate for full trust checks. | Phone |
POST/documents/office/validate | Validate the signatures in an Office document. | Any |
POST/raw/file/validate | Validate a file against its detached or attached CMS signature (.p7s). | Any |
POST/raw/text/validate | Validate a signature over a piece of text with the signer certificate. | Any |
POST/tools/certificate/validate | Validate a certificate: chain to a trusted CA, validity period and revocation status. | Any |
Timestamp
POST/documents/pdf/timestamp | Add a trusted document timestamp to a PDF from your RFC 3161 Timestamp Authority. | Any |
POST/raw/file/timestamp | Get an RFC 3161 timestamp token for any file. | Any |
POST/raw/uuid/timestamp | Get a timestamp token bound to an identifier. | Any |
Status
GET/ | Health check: service status and uptime. | Any |
E-invoicing
eInvoice Service operations
For ERP and accounting integrations with the Egyptian Tax Authority.
POST/invoice/sign | Sign invoices with the company seal. You submit them to ETA yourself. |
POST/invoice/submit | Sign and submit up to 100 documents to ETA in one call. |
POST/invoice/validate | Check the signature on a document you hold. |
GET/invoice/:uuid | Fetch a submitted document from ETA. |
GET/invoice/:uuid/details | Fetch document details and validation results from ETA. |
GET/invoice/recent | List recent documents. |
PUT/invoice/:uuid/cancel | Cancel an issued document. |
PUT/invoice/:uuid/reject | Reject a received document. |
Platform
Built for operators
- Per-customer configuration
- Trust bundle, Timestamp Authority, HSM connection, branding assets and validation policy for each customer, with safe defaults.
- Health checks
- A health endpoint for load balancers, and a configuration check that reports whether the HSM and Timestamp Authority are reachable.
- Usage statistics
- Signing, validation and timestamp counts per customer, per type and per day, for reporting and billing.
- Audit log
- Every operation is recorded with its customer, type, result and time.
Platform
Ways to buy
- On-premises licence
- Install on your own Ubuntu 20.04+ or RHEL-family 8+ servers, x86-64 or arm64. Minimum 2 CPU cores, 4 GB RAM. Licensed per server.
- Hosted API
- Use the SignLayer-hosted Signing API, with one account per customer. No servers to run.
- White-label
- Your brand on the mobile apps and SDKs, backed by SignLayer. Used today by partner apps such as NTRA and FEDIS.
- Hybrid
- Run the HSM gateway next to your HSM in your data centre, and the rest where it suits you.