---
title: "Submit the card's signing certificate; receive the DTBS"
method: POST
path: "/sign/{requestId}/certificate"
tags: ["Sign"]
---

# Submit the card's signing certificate; receive the DTBS

`POST /sign/{requestId}/certificate`

## Request

- Base URL: `https://atk.tvarka.pro/v1`
- URL: `https://atk.tvarka.pro/v1/sign/{requestId}/certificate`
- Auth: HTTP bearer

Bearer clientToken. The API validates the certificate (chain, revocation, purpose =
signing/content-commitment, qualified/QSCD evidence), prepares the format-specific DTBS (for
PAdES - the SHA-256 CAdES SignedAttributes digest; SHA-256 for both key curves), and returns
it + `operationToken`. Physical/NFC only.

## Path parameters

- `requestId` string, uuid, required

## Request body

- SignSignCertificateSubmit
  - `certificate` string, byte, required: Base64 DER of the card's signing certificate.

## Response `200`

DTBS + operation token.

- SignSignCertificateChallenge
  - `requestId` string, uuid, required
  - `dtbs` string, byte, required: Base64 of the exact digest the card signs (e.g. for PAdES, the curve-matched digest of the CAdES SignedAttributes).
  - `dtbsHashAlgOid` '2.16.840.1.101.3.4.2.1' | '2.16.840.1.101.3.4.2.2', required: SHA-256 / SHA-384 OID, curve-matched.
  - `operationToken` string, required
  - `verificationCode` string
  - `cert` object, required
    - `subject` SignCertSubject
      - `serialNumber` string
      - `givenName` string
      - `sn` string
      - `cn` string
      - `c` string
  - `signing` object, required
    - `format` 'pades' | 'asice' | 'adoc' | 'raw': pades = signed PDF (PAdES B-LT); asice = XAdES-LT container; adoc = XAdES-T container; raw = a detached CAdES-BASELINE-LT package from a bare hash (no container returned). Sandbox artifacts stay at B level. Container formats require `document` or `documentRef`.
    - `signatureEncodingHints` string: Optional hint for how the card signature should be encoded before submission (P1363 vs DER).

## Other responses

- `401`: Missing/invalid credentials or client token.
- `403`: Format not allowed / origin not allowed / tenant suspended.
- `404`: Unknown request.
- `409`: Spent operation token, identity swap, terminal request, or idempotency conflict/in-progress operation.
- `422`: Cert purpose/chain/revocation/qualified reject, dtbs mismatch, bad signature, doc hash mismatch.

---

[API](https://skmtc.dev/tvarka/apis/tvarka-atk-api.md) · [All operations](https://skmtc.dev/tvarka/apis/tvarka-atk-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tvarka/apis/tvarka-atk-api/revisions/2ab888b16069?raw)