---
title: "Fetch the detached signatures of an x401 Verifiable Credential Presentation"
method: POST
path: "/verifiable-credentials/v1/x401-signatures"
tags: ["OID4VP"]
---

# Fetch the detached signatures of an x401 Verifiable Credential Presentation

`POST /verifiable-credentials/v1/x401-signatures`

## Request

- Base URL: `https://api.proof.com`
- URL: `https://api.proof.com/verifiable-credentials/v1/x401-signatures`
- Auth: none declared

Presentations delivered through x401 to an organization billed by invoice, with no card or bank account on file, omit the signature segment of both the Issuer-signed JWT and the Key Binding JWT. The Key Binding JWT header carries a critical `proof.com#sig-1` parameter whose value is the `id` to send here. Authenticate with a `private_key_jwt` client assertion from the OAuth Application that requested the presentation, with `aud` set to this endpoint URL. 

When the transaction is not yet paid, the first call answers `402` with x402 payment requirements (https://www.x402.org) for the transaction price; repeat the request with the `PAYMENT-SIGNATURE` header to settle and receive the signatures. A `409` means the transaction is still being finalized: retry after the `Retry-After` delay. Records expire one hour after the presentation.

## Request body

- object
  - `id` string, required: The value of the `proof.com#sig-1` header parameter of the Key Binding JWT.
  - `client_assertion_type` 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer', required
  - `client_assertion` string, required: A `private_key_jwt` assertion signed by a key registered on your OAuth Application, with `aud` set to this endpoint URL.

## Response `200`

OK

- X401SignatureResponse
  - `issuer_signature` string, required: The base64url signature segment of the Issuer-signed JWT, to splice back into the first `~`-separated part of the SD-JWT.
  - `kb_signature` string, required: The base64url signature segment of the Key Binding JWT, to splice back into the last `~`-separated part of the SD-JWT.

## Other responses

- `401`: Unauthorized
- `402`: Payment Required
- `404`: Not Found
- `409`: Conflict

---

[API](https://skmtc.dev/proof/apis/proof-verifiable-credentials-api-specification.md) - [All operations](https://skmtc.dev/proof/apis/proof-verifiable-credentials-api-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/proof/apis/proof-verifiable-credentials-api-specification/revisions/09d16a4195bc?raw)