Submit browser-generated signature receipt

The request must contain a browser-generated public key and signature over the canonical payload. It must not contain PDF bytes. Requires the four session-binding headers (see x-fsig-session-* component parameters).

post/api/envelopes/{envelope_id}/sign

Request

  • Base URL: https://free-sign.com
  • URL: https://free-sign.com/api/envelopes/{envelope_id}/sign
  • Auth: none declared. Required headers: x-fsig-session-signature, x-fsig-session-nonce, x-fsig-session-timestamp, x-fsig-session-action

Path parameters

envelope_idstring required

Headers

x-fsig-session-signaturestring required

Base64url ECDSA P-256 signature over canonicalJson({action, envelope_id, nonce, timestamp}). Produced by the non-extractable session keypair bound to this envelope at creation. See invariant #11 in CLAUDE.md.

x-fsig-session-noncestring required

Random 32-hex-char nonce, fresh per request.

x-fsig-session-timestampstring date-time required

ISO-8601 UTC timestamp of the request. Accepted within +/-5 minutes of server clock.

x-fsig-session-action'otp.request' | 'otp.verify' | 'sign' | 'seal' | 'platform-seal' | 'finalize' | 'webauthn.register' | 'webauthn.authenticate' required

Action name matching the route. Must equal the action field in the signed canonical payload. The webauthn.* actions gate the browser-only passkey endpoints.

Request body

signer_idstring required
signer_namestring required

Typed legal name; becomes the leaf-certificate Subject CN.

signer_emailstring

Required for the WebAuthn path — binds the passkey credential to this signer.

consent_acceptedboolean required
canonical_payloadobject required

The object the browser ECDSA-signed. Full shape: https://free-sign.com/evidence/v2/schema.json ($defs/canonicalPayload).

public_key_jwkobject required

Browser-generated ECDSA P-256 public key (EC / P-256 JWK).

signature_base64urlstring required

base64url ECDSA P-256 / SHA-256 signature over canonicalJson(canonical_payload).

Response

Signature receipt stored.

Changes

No recorded changes to this operation across all 1 revision of this API.