Signing Engine API

Apr 5, 2026 · 486 views

Admin endpoints for operating the signing engine: health, profiles, certificates, and helpers for building your own signing front ends. All require the admin token.

Engine Status

GET /api/signing/status

Returns: engine enabled, active profile count, queue depth, total signed / failed, last sign time, last error. Wire this into your monitoring — it catches unplugged tokens and lost sessions before users do.

Profiles

GET /api/signing/profiles

Lists configured signing profiles (id, name, type, tenant, folders, enabled state).

Certificates

GET /api/signing/certificates

Enumerates certificates visible to the signing session, including which hardware token type holds each (SafeNet, YubiKey, generic smart card) — handy for building profile-selection UIs.

Find Text in a PDF

POST /api/signing/find-text
file=@document.pdf
textPattern=Authorized Signature

Returns the page number and X/Y coordinates (PDF points) of the matched text — the building block for computing signature positions programmatically. Pairs with the positional signing parameters.

Render a Page as PNG

POST /api/signing/render-page
file=@document.pdf
page=1

Returns a PNG of the page — used by the portal's own visual signing UI, available to yours too.

Set a Token PIN

POST /api/signing/set-pin
Content-Type: application/json

{ "certificateSerial": "ABCDEF1234", "pin": "123456" }

Stores the PIN encrypted with Windows DPAPI for the signing profiles using that certificate. (AKV proxy mappings manage their PIN in their own profile.)

Test Sign

POST /api/signing/test-sign
file=@test.pdf
certificateSerial=ABCDEF1234
textPattern=Sign Here

Signs with a temporary, throwaway profile — verify certificate, PIN and placement without touching saved configuration.

Reload Configuration

POST /api/reload-config

Applies appsettings.json changes without restarting the service.