Sign

Submit the raw card signature; assemble the container

Bearer clientToken + single-use operationToken. Synchronous: the API verifies the signature against the stored DTBS + cert, assembles + timestamps the AdES container inline, schedules async validation, and returns 200 done with validation:{status:"pending"} (or notApplicable in sandbox/raw, or the internal ADOC verdict). finalizing is observable via GET only if a crash wedges the request until the reaper releases it. Retry-safe; a transient assembly failure returns a retryable 5xx with the operation released; one atk.sign charge at done.

post/sign/{requestId}/complete

Request

  • Base URL: https://atk.tvarka.pro/v1
  • URL: https://atk.tvarka.pro/v1/sign/{requestId}/complete
  • Auth: HTTP bearer

Path parameters

requestIdstring uuid required

Request body

signaturestring byte required

Base64 raw card signature over dtbs (QES key).

signatureAlgorithm'ES256' | 'ES384' required
signatureEncoding'P1363' | 'DER'

Informational - the server auto-detects and accepts either encoding regardless of this field.

operationTokenstring required

Response

Done - container assembled + signature verified.

status'done' required
method'physical' | 'nfc' required

physical = desktop reader; nfc = phone tap.

sigstring byte

For format:"raw", the detached signature package. Absent for container formats (download the container instead).

sigAlgOidstring
downloadTokenstring

One-off token for GET /sign/{id}/document.

Example response

{
  "method": "physical",
  "cert": {
    "subject": {
      "serialNumber": "PNOLT-39001010000",
      "c": "LT"
    }
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.