---
title: "Attach the document to sign"
method: PUT
path: "/tasks/{id}/signature-doc"
tags: ["tasks"]
---

# Attach the document to sign

`PUT /tasks/{id}/signature-doc`

## Request

- Base URL: `https://app.tascan.io/api/v1`
- URL: `https://app.tascan.io/api/v1/tasks/{id}/signature-doc`
- Auth: HTTP bearer

Attach (or replace, before anyone signs) the document a response_type "signature" task asks the worker to read and sign with their passkey. The server stores the bytes privately and records their SHA-256; that hash is inside every signature challenge, so a signature proves which exact document was signed. Replacing bumps version; a document is frozen once a signature lands. Write tier (API key or an owner/admin session).

## Path parameters

- `id` string, required

## Request body

- object
  - `doc_base64` string, required: The document bytes, base64 (at most 10 MB).
  - `mime` 'application/pdf' | 'image/png' | 'image/jpeg', required
  - `signer_scope` 'any_list_worker' | 'assigned_worker': Who may sign: any worker on the list (default) or only the assigned worker.
  - `consent_text_id` string: Consent text shown before signing (default esign-v1).

## Response `200`

{ data: { doc_sha256, version, mime, bytes, signer_scope, consent_text_id } } (the storage path is never returned)

## Other responses

- `403`: Not write tier, or not an owner/admin session
- `409`: signature_doc_frozen: a signature already landed on this task

---

[API](https://skmtc.dev/tascan/apis/tascan-api.md) · [All operations](https://skmtc.dev/tascan/apis/tascan-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tascan/apis/tascan-api/revisions/56fcd2861498?raw)