---
title: "Sign hash"
method: POST
path: "/csc/v0/signatures/signHash"
tags: ["CSC (v0)"]
---

# Sign hash

`POST /csc/v0/signatures/signHash`

## Request

- Base URL: `https://one.digicert.com/documentmanager`
- URL: `https://one.digicert.com/documentmanager/csc/v0/signatures/signHash`
- Auth: one of:
  - API key in header `X-API-Key`
  - OAuth 2
    - Client credentials
    - Token URL: `/imauth/oauth2/token` scopes: `service`
  - OAuth 2
    - Authorization code: `/imauth/oauth2/authorize`
    - Token URL: `/imauth/oauth2/token` scopes: `service`
- TypeScript: <https://skmtc.dev/digicert/apis/digicert-content-trust-manager/docs/csc/v0/signatures/signHash/post.ts> (a function with typed inputs; its response is checked against the schema)

Use this endpoint to sign the given hash string values using the given SAD (Signature Activation Data), credential, and signature algorithm.

The following parameters are required in the request body fields:

`hash` — Hash string value to be signed. Multiple values can be passed as an array.

`SAD` — Signature Activation Data.

`credentialID` — Credential to be used for signing.

`signAlgo` — Signature algorithm.

## Request body

- SignHashRequest
  - `hash` string[], required: One or more Base64-encoded hash values to be signed.
  - `hashAlgo` string: Specifies the OID of the algorithm used to calculate the hash value(s), in case it’s not implicitly specified by the signAlgo algorithm. Only hashing algorithms as strong or stronger than SHA256 shall be used.
  - `signAlgo` string, required: Specifies the OID of the algorithm to use for signing. It shall be one of the values allowed by the credential as returned in keyAlgo by the credentials/info method.
  - `signAlgoParams` string: Specifies the Base64-encoded of DER-encoded ASN.1 signature parameters, if required by the signature algorithm. Some algorithms like RSA-PSS [RFC 3447] may require additional parameters.
  - `clientData` string: Arbitrary data from the Signature Application. It can be used to handle a transaction identifier or other application-specific data.
  - `credentialID` string, required: The identifier associated to the credential.
  - `SAD` string, required: The Signature Activation Data returned by the Credential Authorization methods.

## Response `200`

Signatures

- SignHashResponse
  - `signatures` string[]

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `500`: Internal Server Error

---

[API](https://skmtc.dev/digicert/apis/digicert-content-trust-manager.md) - [All operations](https://skmtc.dev/digicert/apis/digicert-content-trust-manager/llms.txt) - [OpenAPI document](https://skmtc.dev/digicert/apis/digicert-content-trust-manager/revisions/8dec322a0e2b?raw)