Overview

Signing requests to hash signing data projects can be performed directly via SignPath’s REST API.

See HTTP REST API for basic API instructions.

`SignHash` REST endpoint

To sign a single hash code, use the SignHash endpoint. It accepts the hash data in the JSON body and returns the result immediately.

Synopsis
URL	`/SigningRequests/SignHash`
Method	`POST`
Encoding	`application/json`

Request fields

JSON property	Description
`projectSlug`	The project for which you want to create the signing request
`signingPolicySlug`	Signing policy for which you want to create the signing request
`artifactConfigurationSlug`	Optional: artifact configuration to use for the signing request (default if not specified)
`description`	Optional: description for your signing request (e.g. version number)
`hashSigningData`	Hash data to sign and metadata (see below)

hashSigningData properties:

JSON property Value Remarks

hash

The Base64 encoded hash value to sign.

signatureAlgorithm

Rsa, Ecdsa

rsaOptions.hashAlgorithmName or rsaOptions.hashAlgorithmOid

The hash algorithm used to create hash. Provide either name or OID.

`hashAlgorithmName`	`hashAlgorithmOid`
`Sha1`	`1.3.14.3.2.26`
`Sha256`	`2.16.840.1.101.3.4.2.1`
`Sha384`	`2.16.840.1.101.3.4.2.2`
`Sha512`	`2.16.840.1.101.3.4.2.3`

Only used for RSA keys.

rsaOptions.paddingMode

Pkcs1 (default): PKCS #1 v1.5 padding mode
Pss: PSS padding mode (PKCS #1 v2.1)

Only used for RSA keys.

ecdsaOptions.signatureFormat

Ieee (default): IEEE P1363 fixed-size signature block
Asn1: RFC 3279 ASN.1 sequence

Only used for ECDSA keys.

metadata

sourceProcess object with commandLine, user, and operatingSystem {type, version, architecture} properties (see example below).

Can contain arbitrary metadata JSON values. SignPath crypto providers provide specific values for auditing purposes.

This endpoint creates an artifact with the file name HashSigningData.json.

Response fields

JSON property	Description
`signingRequestid`	ID of the signing request
`webLink`	Link to the UI form for the signing request
`hashSigningData.hash`	Input hash
`hashSigningResult.signature`	Base64-encoded signature block (format and length according to the key type used for signing)

Example

Request

curl -X POST https://app.signpath.io/Api/v1/$ORGANIZATION_ID/SigningRequests/SignHash \
     -H "Authorization: Bearer $API_TOKEN" \
     -H "Content-Type: application/json" \
     -H "Accept: application/json" \
     -d '{
        "projectSlug": "hash-signing",
        "signingPolicySlug": "test-signing",
        "hashSigningData": {
            "signatureAlgorithm": "Rsa",
            "rsaOptions": {
                "hashAlgorithmName": "Sha256", 
                "paddingMode": "Pkcs1"
            },
            "hash": "ZOyIygCyaOW6GjVnihtTFtIS9PNmskdyMlNKiuyjfzw=",
            "metadata": {
                "sourceProcess": { "commandLine": "SampleCommand -SampleArgument", "user": "SampleUser" }
            }
        }
     }'

Response

{
    "signingRequestId": "01486688-aa8b-44f3-9d15-071412df043f",
    "webLink": "https://app.signpath.io/Web/[...]/SigningRequests/01486688-aa8b-44f3-9d15-071412df043f",
    "hashSigningData": {
        "hash": "ZOyIygCyaOW6GjVnihtTFtIS9PNmskdyMlNKiuyjfzw="
    },
    "hashSigningResult": {
        "signature": "wGI2oiHHVSVGHR1rtjv83Pir1SEVLmnLNGuJD4..."
    }
}

Retrieve Signing Policy details

Use GET https://app.signpath.io/Api/v1/$OrganizationId/Cryptoki/MySigningPolicies?projectSlug=$Project&signingPolicySlug=$SigningPolicy to get information about the signing policy, including the X.509 certificate and RSA key parameters.

(If project and signing policy are not specified, this API returns all signing policies where user identified by the API token is assigned as Submitter.)

Example response:

{
    "signingPolicies": [
        {
            "signingPolicySlug": "test-signing",
            "projectSlug": "hash-signing-test",
            "keySizeInBits": 2048,
            "rsaParameters": {
                "publicExponent": "AQAB",
                "modulus": "2e4JTm..."
            },
            "signingPolicyId": "eacd4b78-6038-4450-9eec-4acd1c7ba6f1",
            "certificateBytes": "MIIC5zCC...",
            "keyType": "Rsa",
            "publicKeyBytes": "MIIBCgKC..."
        }
    ]
}

Crypto Providers ❯ REST API