---
title: "Create envelope from local PDF hash and bind the browser's session keypair"
method: POST
path: "/api/envelopes"
---

# Create envelope from local PDF hash and bind the browser's session keypair

`POST /api/envelopes`

## Request

- Base URL: `https://free-sign.com`
- URL: `https://free-sign.com/api/envelopes`
- Auth: none declared

Posts the SHA-256 of the local PDF AND the public-key JWK of a non-extractable ECDSA P-256 keypair generated by the browser. The pubkey is persisted write-once on the envelope row; every subsequent protected endpoint requires a signature with the matching private key (see x-fsig-session-* parameter component).

## Request body

- object
  - `document_sha256` string, required
  - `session_pubkey_jwk` object, required: Public JWK of the browser-generated, non-extractable ECDSA P-256 session keypair. Must contain ONLY {kty: 'EC', crv: 'P-256', x, y} — a private 'd' field is rejected.
    - `kty` 'EC', required
    - `crv` 'P-256', required
    - `x` string, required: Base64url EC x coordinate.
    - `y` string, required: Base64url EC y coordinate.

## Response `200`

Envelope created. Returns envelope_id, expires_at, and the canonical session_pubkey_sha256 + session_bound_at the server committed.

- object
  - `envelope_id` string, required
  - `expires_at` string, date-time, required
  - `session_pubkey_sha256` string, required
  - `session_bound_at` string, date-time, required

## Other responses

- `400`: invalid_document_sha256 / invalid_session_pubkey_jwk.

---

[API](https://skmtc.dev/free-sign/apis/freesign-free-e-signature-api.md) · [All operations](https://skmtc.dev/free-sign/apis/freesign-free-e-signature-api/llms.txt) · [OpenAPI document](https://skmtc.dev/free-sign/apis/freesign-free-e-signature-api/revisions/5d8e9854ab85?raw)