---
title: "Submit the raw card signature; receive the verified identity"
method: POST
path: "/auth/{requestId}/complete"
tags: ["Auth"]
---

# Submit the raw card signature; receive the verified identity

`POST /auth/{requestId}/complete`

## Request

- Base URL: `https://atk.tvarka.pro/v1`
- URL: `https://atk.tvarka.pro/v1/auth/{requestId}/complete`
- Auth: HTTP bearer

Called by the client with `Authorization: Bearer <clientToken>` and the single-use
`operationToken` in the body. The API verifies the signature against the stored `dtbs` and the
certificate's public key, enforces the identity-swap guard, and returns the verified identity
(and the optional `assertion` JWT). Retry-safe: a repeat with the same tuple returns the same
result; a different signature/cert after the token is claimed is rejected.

## Path parameters

- `requestId` string, uuid, required

## Request body

- AuthCompleteSubmit
  - `signature` string, byte, required: Base64 raw card signature over `dtbs` (auth key).
  - `signatureAlgorithm` 'ES256' | 'ES384', required: Card-reported JWS-style algorithm.
  - `signatureEncoding` 'P1363' | 'DER': Raw ECDSA signature encoding. P1363 = fixed-width r||s; DER = SEQUENCE(r, s). Informational - the server auto-detects and accepts either encoding regardless of this field.
  - `operationToken` string, required

## Response `200`

Authenticated - verified identity.

- AuthAuthResult
  - `status` 'done', required
  - `method` 'physical' | 'nfc', required: physical = desktop reader; nfc = phone tap.
  - `sig` string, byte, required: The raw card signature over the audience-bound challenge, returned so the relying party can verify identity independently of `assertion`. Audience-binding prevents cross-RP relay.
  - `cert` object, required
    - `subject` AuthCertSubject: Selected subject fields from the certificate. `serialNumber` holds `PNOLT-<personal code>`.
      - `serialNumber` string
      - `givenName` string
      - `sn` string: Surname.
      - `cn` string
      - `c` string
    - `der` string, byte
  - `assertion` string: Optional short-lived Tvarka-signed JWT (ES256), verifiable against the JWKS endpoint. Claims: iss=atk.tvarka.pro, sub=<personal code>, aud=<audience>, iat, exp, jti, request_id (binds the assertion to this ceremony), given_name, family_name, cert_fp, authentication_method, amr. NOT OIDC. Optional by contract - integrators may ignore it and verify the raw `sig` themselves.

## Other responses

- `401`: Missing/invalid credentials or client token.
- `403`: Authorized but not permitted (origin/format/tenant).
- `404`: Unknown request.
- `409`: State/idempotency conflict (spent operation token, identity swap, terminal request).
- `422`: Semantic reject (cert purpose/chain/revocation, dtbs mismatch, bad signature).

---

[API](https://skmtc.dev/tvarka/apis/tvarka-atk-api.md) · [All operations](https://skmtc.dev/tvarka/apis/tvarka-atk-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tvarka/apis/tvarka-atk-api/revisions/2ab888b16069?raw)