Skip to main content
Documentation Powered by Redocly

eIDAS Signature REST API (1.0-SNAPSHOT)

Download OpenAPI specification:Download

Sphereon: dev@sphereon.com URL: https://sphereon.com License: GNU Affero General Public License v3

The eIDAS Signature REST API allows you to sign objects using X509 / eidas compliant signatures.

Signing

Signing APIs

Determine signature input data

Determines the data that needs to be signed from an input

Authorizations:
openIdoauth2bearer
Request Body schema: application/json

Determine Sign Input Request

required
object (OrigData)

Original data that either needs to be signed, or is an image to use in visual signatures

signMode
required
string (SignMode)
Enum: "DIGEST" "DOCUMENT"

Whether the signature should be about a full document, meaning internally a hash/digest needs to be created or whether it was already digested

required
object (ConfigKeyBinding)

Provides the Key Provider ID to use. Used in payloads. This is not done through path parameters like a normal REST pattern to protect against ACCESS log statistics/insights

object (SignatureFormParameters)

The signature form parameters to use for signature creation

Responses

Request samples

Content type
application/json
{
  • "origData": {
    },
  • "signMode": "DOCUMENT",
  • "binding": {
    },
  • "signatureFormParametersOverride": {
    }
}

Response samples

Content type
application/json
{
  • "signInput": {
    }
}

Create digest value

Create a hash/digest value

Authorizations:
openIdoauth2bearer
Request Body schema: application/json

Determine Digest Request

required
object (SignInput)

The input value as previously determined that needs to be signed or digested

name
required
string

The file name

input
required
string <byte>

The input value

signMode
required
string (SignMode)
Enum: "DIGEST" "DOCUMENT"

Whether the signature should be about a full document, meaning internally a hash/digest needs to be created or whether it was already digested

digestAlgorithm
string (DigestAlgorithm)
Default: "SHA256"
Enum: "NONE" "SHA256" "SHA512" "SHA3_256" "SHA3_512"

The hash/digest algorithm to use

signingDate
required
string <date-time>

This is the date which comes from the initial configuration signing date. We need to keep a record of this, in case a PDF document does not have a document Id set. Otherwise in different steps different date/times would be used, resulting in different hashes for the PDF document. Do not change this value between calls

required
object (ConfigKeyBinding)

Provides the Key Provider ID to use. Used in payloads. This is not done through path parameters like a normal REST pattern to protect against ACCESS log statistics/insights

required
object (SignatureFormParameters)

The signature form parameters to use for signature creation

password
string

The password to open the input file

Responses

Request samples

Content type
application/json
{
  • "signInput": {
    }
}

Response samples

Content type
application/json
{
  • "signInput": {
    }
}

Create signature

Create a signature

Authorizations:
openIdoauth2bearer
Request Body schema: application/json

Create Signature Request

required
object (SignInput)

The input value as previously determined that needs to be signed or digested

maskGenFunction
string (MaskGenFunction)
Value: "MGF1"

Mask Generation Function to create random signatures.

signatureAlgorithm
string (SignatureAlgorithm)
Enum: "RSA_RAW" "RSA_SHA256" "RSA_SHA512" "RSA_SHA3_256" "RSA_SHA3_512" "DSA_SHA256" "DSA_SHA512" "RSA_SSA_PSS_RAW_MGF1" "RSA_SSA_PSS_SHA256_MGF1" "RSA_SSA_PSS_SHA512_MGF1" "RSA_SSA_PSS_SHA3_256_MGF1" "RSA_SSA_PSS_SHA3_512_MGF1"

The signature algorithm to use

Responses

Request samples

Content type
application/json
{
  • "signInput": {
    },
  • "maskGenFunction": "MGF1",
  • "signatureAlgorithm": "RSA_SSA_PSS_SHA3_256_MGF1"
}

Response samples

Content type
application/json
{
  • "signature": {
    }
}

Merges the original data with the created signature

Authorizations:
openIdoauth2bearer
Request Body schema: application/json

Merge Signature Request

required
object (OrigData)

Original data that either needs to be signed, or is an image to use in visual signatures

required
object (Signature)

The signature object

Responses

Request samples

Content type
application/json
{
  • "origData": {
    },
  • "signature": {
    }
}

Response samples

Content type
application/json
{
  • "signOutput": {
    }
}

Keys

Certificate and Key Entry management APIs

Import a X509 Certificate as Key Entry. Note not every Key Provider supports this method

Import a X509 certificate

Authorizations:
openIdoauth2bearer
path Parameters
providerId
required
string
Example: 89fbae00-dbf4-41a3-91ed-15a3fa2b83d5

Key Provider ID

Request Body schema: application/json

Import X509 Certificate

kid
required
string

The Key Identifier to create

certificate
required
string <byte>

encoded X509 certificate

certificateChain
Array of strings <byte>
object (Access Restrictions)

Access Restrictions

Responses

Request samples

Content type
application/json
{
  • "kid": "key1234",
  • "certificate": "<encoded X509 certificate base64>",
  • "certificateChain": [
    ],
  • "accessRestrictions": {
    }
}

Response samples

Content type
application/json
{
  • "keyEntry": {
    },
  • "accessRestrictions": {
    }
}

link Key Entry

Link a Key Entry kid to a Key/certificate id from the provider

Authorizations:
openIdoauth2bearer
path Parameters
providerId
required
string
Example: 89fbae00-dbf4-41a3-91ed-15a3fa2b83d5

Key Provider ID

Request Body schema: application/json
kid
required
string

The key identifier

providerKid
string

The id as used by the provider

object (Access Restrictions)

Access Restrictions

Responses

Request samples

Content type
application/json
{
  • "kid": "key1234",
  • "providerKid": "12abds-434223-dfss-432432",
  • "accessRestrictions": {
    }
}

Response samples

Content type
application/json
{
  • "keyEntry": {
    },
  • "accessRestrictions": {
    }
}

Create Key Entry (x509 certificate)

Create a Key Entry (x509 certificate)

Authorizations:
openIdoauth2bearer
path Parameters
providerId
required
string
Example: 89fbae00-dbf4-41a3-91ed-15a3fa2b83d5

Key Provider ID

Request Body schema: application/json

Create/Update Key Request

required
object (KeyEntry)

The Key Entry, which typically is a X509 Certificate. It requires a public key

password
string

Optional password used to access the key

object (Access Restrictions)

Access Restrictions

Responses

Request samples

Content type
application/json
{
  • "keyEntry": {
    },
  • "password": "example-password",
  • "accessRestrictions": {
    }
}

Response samples

Content type
application/json
{
  • "keyEntry": {
    },
  • "accessRestrictions": {
    }
}

Get a key Entry (X509 certificate)

Get a Key Entry

Authorizations:
openIdoauth2bearer
path Parameters
providerId
required
string
Example: 89fbae00-dbf4-41a3-91ed-15a3fa2b83d5

Key Provider ID

kid
required
string
Example: 2ZQpJ3UpbjAYXYGaXEJl8lV0TOI

Certificate/Key kid

Responses

Response samples

Content type
application/json
{
  • "keyEntry": {
    },
  • "accessRestrictions": {
    }
}

Update Key Entry

Update a Key Entry (x509 certificate)

Authorizations:
openIdoauth2bearer
path Parameters
providerId
required
string
Example: 89fbae00-dbf4-41a3-91ed-15a3fa2b83d5

Key Provider ID

kid
required
string
Example: 2ZQpJ3UpbjAYXYGaXEJl8lV0TOI

Certificate/Key kid

Request Body schema: application/json

Create/Update Key Request

required
object (KeyEntry)

The Key Entry, which typically is a X509 Certificate. It requires a public key

password
string

Optional password used to access the key

object (Access Restrictions)

Access Restrictions

Responses

Request samples

Content type
application/json
{
  • "keyEntry": {
    },
  • "password": "example-password",
  • "accessRestrictions": {
    }
}

Response samples

Content type
application/json
{
  • "keyEntry": {
    },
  • "accessRestrictions": {
    }
}

Delete Key Entry

Delete a Key Entry (x509 certificate)

Authorizations:
openIdoauth2bearer
path Parameters
providerId
required
string
Example: 89fbae00-dbf4-41a3-91ed-15a3fa2b83d5

Key Provider ID

kid
required
string
Example: 2ZQpJ3UpbjAYXYGaXEJl8lV0TOI

Certificate/Key kid

Responses

Response samples

Content type
application/json
{
  • "timestamp": "2022-06-11T22:53:40.276+00:00",
  • "path": "/signatures/create",
  • "status": 500,
  • "error": "Internal Server Error",
  • "requestId": "38fd064b"
}

SignatureConfig

Signature configuration APIs

Create configuration

Authorizations:
openIdoauth2bearer
Request Body schema: application/json

Configuration Request

object (TimestampParameters)

Timestamp parameters like url and different baseline settings

signatureLevel
required
string (SignatureLevel)
Enum: "PDF_NOT_ETSI" "PKCS7_B" "PKCS7_T" "PKCS7_LT" "PKCS7_LTA" "PAdES_BASELINE_B" "PAdES_BASELINE_T" "PAdES_BASELINE_LT" "PAdES_BASELINE_LTA"

The signature level to use

digestAlgorithm
string (DigestAlgorithm)
Default: "SHA256"
Enum: "NONE" "SHA256" "SHA512" "SHA3_256" "SHA3_512"

The hash/digest algorithm to use

required
object (SignatureFormParameters)

The signature form parameters to use for signature creation

object (Access Restrictions)

Access Restrictions

Responses

Request samples

Content type
application/json
{
  • "timestampParameters": {
    },
  • "signatureLevel": "PAdES_BASELINE_B",
  • "digestAlgorithm": "SHA256",
  • "signatureFormParameters": {
    },
  • "accessRestrictions": {
    }
}

Response samples

Content type
application/json
{
  • "configId": "12234-1324343-4344334-3443443",
  • "config": {
    }
}

List configurations

Authorizations:
openIdoauth2bearer

Responses

Response samples

Content type
application/json
[
  • {
    }
]

Update configuration

Authorizations:
openIdoauth2bearer
path Parameters
configId
required
string
Example: 5d9f2462-13c8-45b6-8e0e-8971cbe412b5

Config ID

Request Body schema: application/json

Configuration Request

object (TimestampParameters)

Timestamp parameters like url and different baseline settings

signatureLevel
required
string (SignatureLevel)
Enum: "PDF_NOT_ETSI" "PKCS7_B" "PKCS7_T" "PKCS7_LT" "PKCS7_LTA" "PAdES_BASELINE_B" "PAdES_BASELINE_T" "PAdES_BASELINE_LT" "PAdES_BASELINE_LTA"

The signature level to use

digestAlgorithm
string (DigestAlgorithm)
Default: "SHA256"
Enum: "NONE" "SHA256" "SHA512" "SHA3_256" "SHA3_512"

The hash/digest algorithm to use

required
object (SignatureFormParameters)

The signature form parameters to use for signature creation

object (Access Restrictions)

Access Restrictions

Responses

Request samples

Content type
application/json
{
  • "timestampParameters": {
    },
  • "signatureLevel": "PAdES_BASELINE_B",
  • "digestAlgorithm": "SHA256",
  • "signatureFormParameters": {
    },
  • "accessRestrictions": {
    }
}

Response samples

Content type
application/json
{
  • "configId": "12234-1324343-4344334-3443443",
  • "config": {
    }
}

Get configuration

Authorizations:
openIdoauth2bearer
path Parameters
configId
required
string
Example: 5d9f2462-13c8-45b6-8e0e-8971cbe412b5

Config ID

Responses

Response samples

Content type
application/json
{
  • "configId": "12234-1324343-4344334-3443443",
  • "config": {
    }
}

Delete configuration

Authorizations:
openIdoauth2bearer
path Parameters
configId
required
string
Example: 5d9f2462-13c8-45b6-8e0e-8971cbe412b5

Config ID

Responses

Response samples

Content type
application/json
{
  • "timestamp": "2022-06-11T22:53:40.276+00:00",
  • "path": "/signatures/create",
  • "status": 500,
  • "error": "Internal Server Error",
  • "requestId": "38fd064b"
}

KeyProvider

Key Provider APIs

Create Key Provider

Authorizations:
openIdoauth2bearer
Request Body schema: application/json

Create key provider request

cacheEnabled
boolean
Default: false

Whether to cache Keys or not

cacheTTLInSeconds
number
Default: 300

The cache TTL in seconds

type
required
string (KeyProviderType)
Enum: "PKCS11" "PKCS12" "AZURE_KEYVAULT"

The Key Provider type. PKCS11 is an interface to HSM, usb and smart cards. PKCS12 are keystores. The Azure keyvault options allows for an intergration with Azure Keyvault and Azure Managed HSM

object (AzureKeyvaultSetting)

Azure Keyvault and Managed HSM settings

object (Access Restrictions)

Access Restrictions

Responses

Request samples

Content type
application/json
{
  • "cacheEnabled": false,
  • "cacheTTLInSeconds": 300,
  • "type": "AZURE_KEYVAULT",
  • "azureKeyvaultSettings": {
    },
  • "accessRestrictions": {
    }
}

Response samples

Content type
application/json
{
  • "providerId": "12abds-434223-dfss-432432",
  • "cacheEnabled": false,
  • "cacheTTLInSeconds": 300,
  • "type": "AZURE_KEYVAULT",
  • "azureKeyvaultSettings": {
    },
  • "accessRestrictions": {
    }
}

Get Key Providers

Authorizations:
openIdoauth2bearer

Responses

Response samples

Content type
application/json
{
  • "keyProviders": [
    ]
}

Update Key provider

Update the Key Provider Settings

Authorizations:
openIdoauth2bearer
path Parameters
providerId
required
string
Example: 89fbae00-dbf4-41a3-91ed-15a3fa2b83d5

Key Provider ID

Request Body schema: application/json

Update key provider request

providerId
string

The id of the provider

cacheEnabled
boolean
Default: false

Whether to cache Keys or not

cacheTTLInSeconds
number
Default: 300

The cache TTL in seconds

type
required
string (KeyProviderType)
Enum: "PKCS11" "PKCS12" "AZURE_KEYVAULT"

The Key Provider type. PKCS11 is an interface to HSM, usb and smart cards. PKCS12 are keystores. The Azure keyvault options allows for an intergration with Azure Keyvault and Azure Managed HSM

object (AzureKeyvaultSetting)

Azure Keyvault and Managed HSM settings

object (Access Restrictions)

Access Restrictions

Responses

Request samples

Content type
application/json
{
  • "providerId": "12abds-434223-dfss-432432",
  • "cacheEnabled": false,
  • "cacheTTLInSeconds": 300,
  • "type": "AZURE_KEYVAULT",
  • "azureKeyvaultSettings": {
    },
  • "accessRestrictions": {
    }
}

Response samples

Content type
application/json
{
  • "keyProviders": [
    ]
}

Get Key Provider

Authorizations:
openIdoauth2bearer
path Parameters
providerId
required
string
Example: 89fbae00-dbf4-41a3-91ed-15a3fa2b83d5

Key Provider ID

Responses

Response samples

Content type
application/json
{
  • "providerId": "12abds-434223-dfss-432432",
  • "cacheEnabled": false,
  • "cacheTTLInSeconds": 300,
  • "type": "AZURE_KEYVAULT",
  • "azureKeyvaultSettings": {
    },
  • "accessRestrictions": {
    }
}

Delete Key Provider

Authorizations:
openIdoauth2bearer
path Parameters
providerId
required
string
Example: 89fbae00-dbf4-41a3-91ed-15a3fa2b83d5

Key Provider ID

Responses

Response samples

Content type
application/json
{
  • "timestamp": "2022-06-11T22:53:40.276+00:00",
  • "path": "/signatures/create",
  • "status": 500,
  • "error": "Internal Server Error",
  • "requestId": "38fd064b"
}

EzDocSeal

Eeasy Document Seals and signatures APIs

Sign a PDF creating a blue bar

Request Body schema:

Sign request

object (SignData)
content
string <byte>
object (ConfigKeyBinding)

Provides the Key Provider ID to use. Used in payloads. This is not done through path parameters like a normal REST pattern to protect against ACCESS log statistics/insights

Responses

Request samples

Content type
{
  • "signData": {
    },
  • "content": "<content byte>",
  • "binding": {
    }
}