Sign a second PDF variant with the configured FreeSign organization seal certificate

Same zero-document contract as /seal: the browser prepares a separate PDF signature placeholder locally and POSTs only the SHA-256 of that PDF's ByteRange. The Worker signs the digest with the configured platform seal signer (SEAL_SIGNER / SEAL_*), returns CMS DER as base64, and records an OpenTimestamps anchor row. This endpoint powers the freesign_verified_seal variant; while the configured seal cert is a bootstrap cert Adobe may still show yellow, and replacing it with an Adobe-trusted organization seal cert makes this variant the green-counterparty version without changing the browser flow. Requires x-fsig-session-action=platform-seal.

post/api/envelopes/{envelope_id}/platform-seal

Request

  • Base URL: https://free-sign.com
  • URL: https://free-sign.com/api/envelopes/{envelope_id}/platform-seal
  • Auth: none declared. Required headers: x-fsig-session-signature, x-fsig-session-nonce, x-fsig-session-timestamp, x-fsig-session-action

Path parameters

envelope_idstring required

Headers

x-fsig-session-signaturestring required

Base64url ECDSA P-256 signature over canonicalJson({action, envelope_id, nonce, timestamp}). Produced by the non-extractable session keypair bound to this envelope at creation. See invariant #11 in CLAUDE.md.

x-fsig-session-noncestring required

Random 32-hex-char nonce, fresh per request.

x-fsig-session-timestampstring date-time required

ISO-8601 UTC timestamp of the request. Accepted within +/-5 minutes of server clock.

x-fsig-session-action'otp.request' | 'otp.verify' | 'sign' | 'seal' | 'platform-seal' | 'finalize' | 'webauthn.register' | 'webauthn.authenticate' required

Action name matching the route. Must equal the action field in the signed canonical payload. The webauthn.* actions gate the browser-only passkey endpoints.

Request body

signer_idstring required
signer_emailstring email required
byterange_sha256string required
evidence_jsonobject

Optional pre-seal evidence record, embedded into this CMS as signedAttribute OID 1.3.6.1.4.1.65834.1.2 (see /seal).

Response

Platform-seal CMS produced. Response shape mirrors /seal and adds variant=freesign_verified_seal plus seal_cert_subject / seal_signer_mode.

Changes

No recorded changes to this operation across all 1 revision of this API.