Upload & Sign Files (API)

Apr 5, 2026 · 448 views

The upload endpoint is the workhorse of the API: send a file, get it signed. It handles PDFs and code-signing targets alike, matching the right profile automatically from your token's tenant.

Upload & Auto-Sign

POST /api/upload
Authorization: Bearer TENANT_TOKEN
Content-Type: multipart/form-data

Parameters

• file (required, repeatable) — the file(s) to upload. PDFs are matched to PDF profiles; .exe/.dll/.msi/… to code-signing profiles.
• target_folder (optional) — custom destination folder (subject to Custom Folders policy).
• download=true (query, optional) — return the signed file directly instead of JSON.
• fixedPage, fixedX, fixedY, signBoxWidth, signBoxHeight (optional) — per-request signature position override in PDF points; see Positional Signing API.

Examples

# Sign a PDF and get JSON status
curl -X POST http://localhost:9440/api/upload \
  -H "Authorization: Bearer TOKEN" \
  -F "file=@document.pdf"

# Sign and download the result in one call
curl -X POST "http://localhost:9440/api/upload?download=true" \
  -H "Authorization: Bearer TOKEN" \
  -F "file=@document.pdf" -o document-signed.pdf

# Code-sign an installer and get it back
curl -X POST "http://localhost:9440/api/upload?download=true" \
  -H "Authorization: Bearer TOKEN" \
  -F "file=@setup.msi" -o setup-signed.msi

# Multiple files in one request
curl -X POST http://localhost:9440/api/upload \
  -H "Authorization: Bearer TOKEN" \
  -F "file=@doc1.pdf" -F "file=@doc2.pdf"

JSON Response (signing engine enabled)

{
  "success": true,
  "message": "Files uploaded and signing triggered (1 file(s))",
  "files": ["document.pdf"],
  "signing": [
    { "file": "document.pdf", "profile": "auto-sign",
      "success": true, "message": "Signed successfully with 1 signature(s)",
      "SignaturesApplied": 1 }
  ]
}

Code-Sign Endpoint

curl -X POST http://localhost:9440/api/codesign \
  -H "Authorization: Bearer TOKEN" \
  -F "file=@myapp.exe" -F "profileId=codesign-main" -o myapp-signed.exe

Always returns the signed binary directly. profileId is optional — omitted, the tenant's code-signing profile is used.

Manual Sign by Profile (Admin)

POST /api/signing/sign
Authorization: Bearer ADMIN_TOKEN
Content-Type: application/json

{ "profileId": "pdf-main", "sourcePath": "C:/contracts/agreement.pdf" }

Signs a file already on the server; also accepts the positional override parameters.

File Management

# List files in a folder
GET /api/list?folder=signed

# Download a file
GET /api/getfile?filename=document-signed.pdf&folder=signed

# Delete a file
DELETE /api/remove?file=document.pdf&folder=upload

All with Authorization: Bearer TOKEN; tenant tokens see only their own folders.

Related: Need to sign a file that is already on the server, or place the signature at exact coordinates? That is the Signing Engine API.