POST /v1/sign

The last call of a signing session. Use the authorization from authorize and return one signature per digest, in the same order. Your provider’s “sign hash” call is usually what this maps to.

Request

The common request fields, plus:

{
    "credential_id": "cred_7Qk...",
    "authorization": { "reference": "sad_3Fh..." },
    "digests": [
        {
            "value": "n4bQgYhMfWWaL+qgxVrQFaO/TxsrC4Is0V1sFbDwCgg=",
            "hash_algorithm_oid": "2.16.840.1.101.3.4.2.1"
        }
    ],
    "sign_algo_oid": "1.2.840.10045.4.3.2"
}

Field	Description
credential_id	The same value authorize received.
authorization.reference	The reference your authorize returned.
digests	The same digests as in authorize, without label.
sign_algo_oid	The algorithm SignatureAPI picked from your key_algo_oids.

Response

{ "status": "completed", "signatures": ["MEUCIQD..."] }

signatures holds one base64 value per digest, in the order of digests.

sign never answers pending. It must also be idempotent: a repeated request with the same Idempotency-Key returns the stored signatures and never signs again. SignatureAPI doesn’t retry sign on a retryable failure.

Signing input and output

Key type	What you sign	What you return
RSA	The DER DigestInfo of the digest, with PKCS#1 v1.5 padding. Don’t hash again.	The raw PKCS#1 signature, base64.
ECDSA (P-256, P-384, P-521)	The raw digest bytes. Don’t hash again.	A DER-encoded ECDSA-Sig-Value (RFC 3279), base64. Not the compact r‖s form.

Your bytes go verbatim into the PDF, and PDF readers expect DER. SignatureAPI rejects an ECDSA signature in any other encoding. If your provider returns r‖s, convert it.

SWP/1 carries raw signature values only, not a complete CMS or PKCS#7 signature from the provider.

Supported algorithms

List these OIDs in key_algo_oids, or in Key algorithm OIDs for a static certificate:

OID	Algorithm
1.2.840.10045.4.3.1	ecdsa-with-SHA224
1.2.840.10045.4.3.2	ecdsa-with-SHA256
1.2.840.10045.4.3.3	ecdsa-with-SHA384
1.2.840.10045.4.3.4	ecdsa-with-SHA512
1.2.840.113549.1.1.11	sha256WithRSAEncryption
1.2.840.113549.1.1.12	sha384WithRSAEncryption
1.2.840.113549.1.1.13	sha512WithRSAEncryption
1.2.840.113549.1.1.1	rsaEncryption (key type only)
1.2.840.10045.2.1	id-ecPublicKey (key type only)

SignatureAPI picks the first OID in your list that names a full signature algorithm, one of the first seven rows. If your list has none, it uses your first OID.