---
title: "Submit the raw card signature; assemble the container"
method: POST
path: "/sign/{requestId}/complete"
tags: ["Sign"]
---

# Submit the raw card signature; assemble the container

`POST /sign/{requestId}/complete`

## Request

- Base URL: `https://atk.tvarka.pro/v1`
- URL: `https://atk.tvarka.pro/v1/sign/{requestId}/complete`
- Auth: HTTP bearer

Bearer clientToken + single-use `operationToken`. Synchronous: the API verifies the signature
against the stored DTBS + cert, assembles + timestamps the AdES container inline, schedules
async validation, and returns `200 done` with `validation:{status:"pending"}` (or
`notApplicable` in sandbox/raw, or the internal ADOC verdict). `finalizing` is observable via
GET only if a crash wedges the request until the reaper releases it. Retry-safe; a transient
assembly failure returns a retryable 5xx with the operation released; one `atk.sign` charge
at `done`.

## Path parameters

- `requestId` string, uuid, required

## Request body

- SignSignCompleteSubmit
  - `signature` string, byte, required: Base64 raw card signature over `dtbs` (QES key).
  - `signatureAlgorithm` 'ES256' | 'ES384', required
  - `signatureEncoding` 'P1363' | 'DER': Informational - the server auto-detects and accepts either encoding regardless of this field.
  - `operationToken` string, required

## Response `200`

Done - container assembled + signature verified.

- SignSignResult
  - `status` 'done', required
  - `method` 'physical' | 'nfc', required: physical = desktop reader; nfc = phone tap.
  - `validation` SignValidation, required: The advisory validation axis. Independent of `status`. See the two-axes note.
    - `status` 'pending' | 'passed' | 'failed' | 'notApplicable', required
    - `level` string: e.g. QUALIFIED_VALID, VALID_NOT_QUALIFIED, INDETERMINATE.
    - `report` string: Optional pointer/id to the stored validation report.
  - `sig` string, byte: For `format:"raw"`, the detached signature package. Absent for container formats (download the container instead).
  - `sigAlgOid` string
  - `cert` object, required
    - `subject` SignCertSubject
      - `serialNumber` string
      - `givenName` string
      - `sn` string
      - `cn` string
      - `c` string
  - `downloadToken` string: One-off token for GET /sign/{id}/document.

## Other responses

- `401`: Missing/invalid credentials or client token.
- `404`: Unknown request.
- `409`: Spent operation token, identity swap, terminal request, or idempotency conflict/in-progress operation.
- `422`: Cert purpose/chain/revocation/qualified reject, dtbs mismatch, bad signature, doc hash mismatch.

---

[API](https://skmtc.dev/tvarka/apis/tvarka-atk-api.md) · [All operations](https://skmtc.dev/tvarka/apis/tvarka-atk-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tvarka/apis/tvarka-atk-api/revisions/2ab888b16069?raw)