CodeSign Secure Documentation
  • Overview
    • About CodeSign Secure
    • Getting Started
    • Documentation Guide
    • Portal Overview
    • Troubleshooting
      • FAQ
    • Glossary
  • Reference Guide
    • Header Bar
      • CodeSign Secure Documentation
      • Swagger API
      • Profile Section
    • Dashboard
      • Key Performance Indicators
      • Issued Certificates
      • Signatures Generated
      • HSM Health Check
    • Keys and Certificates
      • Key and Certificate Lifecycle
    • App Management
    • Signing Requests
      • Approval Workflows
    • Signing Tools
    • Reports
      • Signing Request Report
      • Audit Trail
      • Certificate Report
      • Client Report
    • Logs
    • System Setup
      • Identity Store
      • Backup
      • User
      • Roles and Permissions
      • Email
      • Signing Projects
      • SSL/TLS Management
      • Environment
      • Plugins
  • Setup & Architecture
    • Identity and Access Control
    • Architecture and Concepts
    • Installation
      • Windows
        • Installing the Server
        • Ports and Protocols
        • High Availability and Backup
        • Upgrades and Compatibility
    • Security
      • Security Hardening Checklist
      • Client Authentication
      • Designing Signing Policies
  • Release Notes
    • Releases for 2026
      • v3.2.1
    • Releases for 2025
      • v3.2.0
    • Releases for 2024
      • v3.1.0
  • API Reference
    • Getting Started
    • Authorizing Requests
    • Securing API Access
    • Request and Response Conventions
    • Endpoint Reference
      • Signing
      • Signing Requests
      • Certificates
      • Applications and Environments
      • User Management
      • Permissions
      • Email
      • System Setup
      • Reports
      • Dashboard
      • License
  • Integration Guides
    • Signing Capabilities
      • Supported Formats and Platforms
      • Timestamping
      • Windows Signing - SignTool
        • Signing
        • Macro Signing
      • Apple Signing
      • AppX & MSIX Signing
      • Visual Studio ClickOnce
      • Jar Signing
      • Sign HLK/HCK using CodeSign Secure
      • NuGet Signing
      • Mage Signing
      • Sign OVA/OVF using Encryption Consulting’s Utility Tool
      • Utility Tool for code signing
      • Container Signing
      • PKCS11 Wrapper
        • APK Signing
        • OpenSSL Signing
        • XML Signing
        • JSign Tool Signing
        • Jarsigner Signing
        • GPG2, Debian & RPM Signing
      • Reproducible Build
        • Automated Hash Validation
        • Reproducible Build Process Flow
        • Pipeline Script Components
        • Hash Validation
    • CI/CD Integration
      • GitHub Actions
      • Jenkins
      • GitLab
      • Azure DevOps
      • TeamCity
      • Bamboo
      • Securing CI/CD Credentials

Signing

The Signing endpoints sign hashes and verify signatures, serve the PKCS#11 client channel, list client certificate and signing-user mappings, manage reproducible-build signing projects, and accept source code for analysis.

For the corresponding user interface, refer to the Signing Tools section.

Endpoints

MethodEndpointDescription
GET/signing/p12_user/List client certificate mappings
GET/signing/p12_user_list/List client certificates with user detail
POST/signing/pkcs11-api/PKCS#11 client channel
POST/signing/sign/Sign a hash
GET/signing/signingProjectsList reproducible-build projects
POST/signing/signingProjectsCreate a reproducible-build project
GET/signing/signingProjects/{id}Get a reproducible-build project
PUT/signing/signingProjects/{id}Replace a reproducible-build project
PATCH/signing/signingProjects/{id}Update a reproducible-build project
GET/signing/signuser/List signing-user mappings
POST/signing/v1/code-submission/Submit source code for analysis
POST/signing/verify/Verify a signature
GET /signing/p12_user/

Returns the client authentication certificates registered for signing, with the account each is mapped to.

Example Request

curl -X GET "https://<your domain>/api/signing/p12_user/" \
  -H "Authorization: Bearer <token>"

Responses

Status CodeDescription
200The requested records.
GET /signing/p12_user_list/

As the client certificate mapping list, with the account details of each mapped user included.

Example Request

curl -X GET "https://<your domain>/api/signing/p12_user_list/" \
  -H "Authorization: Bearer <token>"

Responses

Status CodeDescription
200The requested records.
POST /signing/pkcs11-api/

Transport endpoint for the PKCS#11 client library. Requests are issued by the supplied wrapper rather than composed by hand, and results are reported in the response body, so this endpoint is not usefully exercised from this page.

Note: This endpoint requires a client certificate. It is served over mutual TLS, so it can’t be called from the Swagger API page. Refer to Securing API Access.

Example Request

curl -X POST \
  --cert-type P12 --cert client.pfx:CERT_PASSWORD \
  -H "Authorization: Bearer YOUR_TOKEN" \
  https://<your domain>/api/signing/pkcs11-api/

Responses

Status CodeDescription
200The operation completed.
POST /signing/sign/

Signs a document hash with a managed signing certificate and returns the signature. The hash is computed on the client, so file contents never leave your machine.

Note: This endpoint requires a client certificate. It is served over mutual TLS, so it can’t be called from the Swagger API page. Refer to Securing API Access.

Request Body (application/json)

FieldTypeRequiredDescription
certificate_namestringYesName of the signing certificate to use. A key alias may be sent instead.
hashstringYesHash of the content to be signed.
codesign_signing_project_idstringNoReproducible-build project this signature belongs to.
codesign_build_job_idstringNoBuild job reference.
signingRequestIdintegerNoIdentifier of an approved signing request to sign against.

Example Request

curl -X POST \
  --cert-type P12 --cert client.pfx:CERT_PASSWORD \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"certificate_name":"YOUR_CERTIFICATE","hash":"BASE64_HASH"}' \
  https://<your domain>/api/signing/sign/

Responses

Status CodeDescription
200The signature, returned as the raw response body rather than as JSON.
GET /signing/signingProjects

Returns the configured reproducible-build signing projects.

Example Request

curl -X GET "https://<your domain>/api/signing/signingProjects" \
  -H "Authorization: Bearer <token>"

Responses

Status CodeDescription
200The requested records.
POST /signing/signingProjects

Registers a signing project and the source repository or build server it builds from. The repository and build server are checked with the credentials supplied before the project is saved. Credentials are stored securely and are never returned by the API. source_code_management_type must currently be git and build_server_type must be jenkins.

Request Body (application/json)

FieldTypeRequiredDescription
project_namestringYesProject name
source_code_management_typestringYesSource code management type
git_repository_urlstringYesGit repository url
git_usernamestringYesGit username
git_allowed_branchesobjectNoGit allowed branches
environmental_variablesobjectNoEnvironmental variables
build_commandstringYesBuild command
build_signer_typestringYesBuild signer type
build_file_pathstringYesBuild file path
build_server_typestringYesBuild server type
jenkins_project_urlstringYesJenkins project url
jenkins_usernamestringYesJenkins username
email_recipientsstringYesEmail recipients
created_userintegerNoCreated user
created_datestring (date-time)NoCreated date
modified_byintegerNoModified by
git_passwordstringYesPassword or access token for the repository.
jenkins_passwordstringYesPassword or API token for the build server.

Example Request

curl -X POST "https://<your domain>/api/signing/signingProjects" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"project_name":"string","source_code_management_type":"string","git_repository_url":"string","git_username":"string","build_command":"string","build_signer_type":"string","build_file_path":"string","build_server_type":"string","jenkins_project_url":"string","jenkins_username":"string","email_recipients":"string","git_password":"string","jenkins_password":"string"}'

Responses

Status CodeDescription
201The operation completed.
GET /signing/signingProjects/{id}

Returns a single signing project by identifier.

Request Parameters

NameLocated InTypeRequiredDescription
idPathintegerYesA unique integer value identifying this signing project_ table.

Example Request

curl -X GET "https://<your domain>/api/signing/signingProjects/<id>" \
  -H "Authorization: Bearer <token>"

Responses

Status CodeDescription
200The requested records.
PUT /signing/signingProjects/{id}

Replaces a signing project's configuration. Send the full set of fields. The repository and build server are checked again before the change is saved. source_code_management_type must currently be git and build_server_type must be jenkins.

Request Parameters

NameLocated InTypeRequiredDescription
idPathintegerYesA unique integer value identifying this signing project_ table.

Request Body (application/json)

FieldTypeRequiredDescription
project_namestringYesProject name
source_code_management_typestringYesSource code management type
git_repository_urlstringYesGit repository url
git_usernamestringYesGit username
git_allowed_branchesobjectNoGit allowed branches
environmental_variablesobjectNoEnvironmental variables
build_commandstringYesBuild command
build_signer_typestringYesBuild signer type
build_file_pathstringYesBuild file path
build_server_typestringYesBuild server type
jenkins_project_urlstringYesJenkins project url
jenkins_usernamestringYesJenkins username
email_recipientsstringYesEmail recipients
created_userintegerNoCreated user
created_datestring (date-time)NoCreated date
modified_byintegerNoModified by
git_passwordstringNoNew repository password or access token. Omit to keep the stored repository credentials, username included.
jenkins_passwordstringNoNew build server password or API token. Omit to keep the stored build server credentials, username included.

Example Request

curl -X PUT "https://<your domain>/api/signing/signingProjects/<id>" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"project_name":"string","source_code_management_type":"string","git_repository_url":"string","git_username":"string","build_command":"string","build_signer_type":"string","build_file_path":"string","build_server_type":"string","jenkins_project_url":"string","jenkins_username":"string","email_recipients":"string"}'

Responses

Status CodeDescription
200The record after the update.
PATCH /signing/signingProjects/{id}

Updates selected fields of a signing project. Send only the fields to change.

Request Parameters

NameLocated InTypeRequiredDescription
idPathintegerYesA unique integer value identifying this signing project_ table.

Request Body (application/json)

FieldTypeRequiredDescription
project_namestringYesProject name
source_code_management_typestringYesSource code management type
git_repository_urlstringYesGit repository url
git_usernamestringYesGit username
git_allowed_branchesobjectNoGit allowed branches
environmental_variablesobjectNoEnvironmental variables
build_commandstringYesBuild command
build_signer_typestringYesBuild signer type
build_file_pathstringYesBuild file path
build_server_typestringYesBuild server type
jenkins_project_urlstringYesJenkins project url
jenkins_usernamestringYesJenkins username
email_recipientsstringYesEmail recipients
created_userintegerNoCreated user
created_datestring (date-time)NoCreated date
modified_byintegerNoModified by

Example Request

curl -X PATCH "https://<your domain>/api/signing/signingProjects/<id>" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"project_name":"string","source_code_management_type":"string","git_repository_url":"string","git_username":"string","build_command":"string","build_signer_type":"string","build_file_path":"string","build_server_type":"string","jenkins_project_url":"string","jenkins_username":"string","email_recipients":"string"}'

Responses

Status CodeDescription
200The record after the update.
GET /signing/signuser/

Returns the mapping between signing client identities and user accounts.

Example Request

curl -X GET "https://<your domain>/api/signing/signuser/" \
  -H "Authorization: Bearer <token>"

Responses

Status CodeDescription
200The requested records.
POST /signing/v1/code-submission/

Submits a source archive, and the repository it came from, for vulnerability analysis ahead of signing. Send as multipart/form-data.

Request Body (multipart/form-data)

FieldTypeRequiredDescription
github_urlstring (uri)YesRepository URL.
github_usernamestringYesRepository account name.
github_passwordstringYesRepository access token.
github_emailstring (email)YesRepository account email.
vulnerability_percentagenumberYesMaximum tolerated vulnerability percentage.
source_code_zipfileYesZipped source code.
allowed_branchstringNoBranch to analyse. Defaults to main.

Example Request

curl -X POST "https://<your domain>/api/signing/v1/code-submission/" \
  -H "Authorization: Bearer <token>" \
  -F "github_url=<github_url>" \
  -F "github_username=<github_username>" \
  -F "github_password=<github_password>" \
  -F "github_email=<github_email>" \
  -F "vulnerability_percentage=<vulnerability_percentage>" \
  -F "source_code_zip=@<source_code_zip file>"

Responses

Status CodeDescription
200The operation completed.
POST /signing/verify/

Checks a signature against the content it was produced from and reports whether it is valid.

Note: This endpoint requires a client certificate. It is served over mutual TLS, so it can’t be called from the Swagger API page. Refer to Securing API Access.

Request Body (application/json)

FieldTypeRequiredDescription
certificate_namestringYesCertificate the signature was produced with.
signaturestringYesSignature to verify.
hashstringNoHash of the signed content.
contentstringNoSigned content, if a hash is not supplied.

Example Request

curl -X POST \
  --cert-type P12 --cert client.pfx:CERT_PASSWORD \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"certificate_name":"YOUR_CERTIFICATE","hash":"BASE64_HASH","signature":"BASE64_SIGNATURE"}' \
  https://<your domain>/api/signing/verify/

Responses

Status CodeDescription
200The verification result, returned as the raw response body rather than as JSON.
On this Page:
Support Privacy Policy Terms of Service

Copyright Encryption Consulting LLC. All rights reserved.