---
title: "POST /api/v1/cert-manager/signers/{signerId}/sign"
method: POST
path: "/api/v1/cert-manager/signers/{signerId}/sign"
tags: ["PKI Signers"]
---

# POST /api/v1/cert-manager/signers/{signerId}/sign

`POST /api/v1/cert-manager/signers/{signerId}/sign`

## Request

- Base URL: `https://us.infisical.com`
- URL: `https://us.infisical.com/api/v1/cert-manager/signers/{signerId}/sign`
- Auth: none declared

Sign a pre-hashed digest with a code signing signer

## Path parameters

- `signerId` string, uuid, required

## Request body

- object
  - `data` string, required
  - `signingAlgorithm` 'RSASSA_PSS_SHA_512' | 'RSASSA_PSS_SHA_384' | 'RSASSA_PSS_SHA_256' | 'RSASSA_PKCS1_V1_5_SHA_512' | 'RSASSA_PKCS1_V1_5_SHA_384' | 'RSASSA_PKCS1_V1_5_SHA_256' | 'ECDSA_SHA_512' | 'ECDSA_SHA_384' | 'ECDSA_SHA_256' | 'ED25519' | 'ML_DSA_44' | 'ML_DSA_65' | 'ML_DSA_87', required
  - `isDigest` boolean
  - `clientMetadata` object: Context describing the signing situation. Values here are compared against any scope declared on the approval, and are recorded on the signing operation for audit.
    - `tool` string: The signing application. Compared against a 'signingApplication' scope on the approval.
    - `signingApplication` string: Alias of 'tool', matching the name this parameter has in an approval's scope.
    - `hostname` string: The machine the sign call is made from.
    - `command` string: The command line that issued the sign call.
    - `osUsername` string: The operating system account running the signing tool.
    - `signingApplicationHash` string: SHA-256 checksum of the signing application binary.

## Response `200`

Default Response

- object
  - `signature` string, required
  - `signingAlgorithm` string, required
  - `signerId` string, required

## Other responses

- `400`: Default Response
- `401`: Default Response
- `403`: Default Response
- `404`: Default Response
- `422`: Default Response
- `500`: Default Response

## Changes

- **2026-10-08** `514021b0a05e`: 1 info
  - added the new `ED25519` enum value to the request property `signingAlgorithm`
- **2026-08-21** `483aceca65ba`: 1 warning, 4 info
  - removed the request property `clientMetadata/reportedIp`
  - added the new optional request property `clientMetadata/command`
  - added the new optional request property `clientMetadata/osUsername`
  - added the new optional request property `clientMetadata/signingApplication`
  - …1 more

[Operation history](https://skmtc.dev/infisical/apis/infisical-api/changes/api/v1/cert-manager/signers/:signerId/sign/post.md)

---

[API](https://skmtc.dev/infisical/apis/infisical-api.md) - [All operations](https://skmtc.dev/infisical/apis/infisical-api/llms.txt) - [OpenAPI document](https://skmtc.dev/infisical/apis/infisical-api/revisions/7f940199c899?raw)