---
title: "Sign a second PDF variant with the configured FreeSign organization seal certificate"
method: POST
path: "/api/envelopes/{envelope_id}/platform-seal"
---

# Sign a second PDF variant with the configured FreeSign organization seal certificate

`POST /api/envelopes/{envelope_id}/platform-seal`

## Request

- Base URL: `https://free-sign.com`
- URL: `https://free-sign.com/api/envelopes/{envelope_id}/platform-seal`
- Auth: none declared. Required headers: `x-fsig-session-signature`, `x-fsig-session-nonce`, `x-fsig-session-timestamp`, `x-fsig-session-action`

Same zero-document contract as /seal: the browser prepares a separate PDF signature placeholder locally and POSTs only the SHA-256 of that PDF's ByteRange. The Worker signs the digest with the configured platform seal signer (SEAL_SIGNER / SEAL_*), returns CMS DER as base64, and records an OpenTimestamps anchor row. This endpoint powers the freesign_verified_seal variant; while the configured seal cert is a bootstrap cert Adobe may still show yellow, and replacing it with an Adobe-trusted organization seal cert makes this variant the green-counterparty version without changing the browser flow. Requires x-fsig-session-action=platform-seal.

## Path parameters

- `envelope_id` string, required

## Headers

- `x-fsig-session-signature` string, required
- `x-fsig-session-nonce` string, required
- `x-fsig-session-timestamp` string, date-time, required
- `x-fsig-session-action` 'otp.request' | 'otp.verify' | 'sign' | 'seal' | 'platform-seal' | 'finalize' | 'webauthn.register' | 'webauthn.authenticate', required

## Request body

- object
  - `signer_id` string, required
  - `signer_email` string, email, required
  - `byterange_sha256` string, required
  - `evidence_json` object: Optional pre-seal evidence record, embedded into this CMS as signedAttribute OID 1.3.6.1.4.1.65834.1.2 (see /seal).

## Response `200`

Platform-seal CMS produced. Response shape mirrors /seal and adds variant=freesign_verified_seal plus seal_cert_subject / seal_signer_mode.

## Other responses

- `400`: signer_email mismatch or invalid byterange_sha256.
- `409`: Variant disabled or envelope/signer not in signed state.
- `502`: TSA_URL was configured but the TSA round-trip failed.
- `503`: Platform seal signer is not configured.

---

[API](https://skmtc.dev/free-sign/apis/freesign-free-e-signature-api.md) · [All operations](https://skmtc.dev/free-sign/apis/freesign-free-e-signature-api/llms.txt) · [OpenAPI document](https://skmtc.dev/free-sign/apis/freesign-free-e-signature-api/revisions/5d8e9854ab85?raw)