Mobile-ID Quantum Safe
Open Demo Lab

TRUSTED SIC API

Signing approval, activation and evidence
as one explicit lifecycle.

Reference contract for relying-party onboarding, signing requests, Passkey/WebAuthn approval, signature activation, multi-CA routing, protected signing, ASiC packaging and evidence retrieval.

Browse endpoints→Download OpenAPI / Postman→

AUTHENTICATION

Two protected channels

  • RP-to-Trusted-SIC: mTLS + OAuth2 client credential or private-key JWT
  • User approval: OIDC session + WebAuthn challenge/assertion
  • Scopes: signing.request, signing.approve, signing.execute, evidence.read
  • Audience, tenant, RP and purpose are mandatory authorization facts

REQUEST CONTROLS

Replay-safe operations

  • Idempotency-Key on all state-changing requests
  • X-Correlation-Id across RP, SIC, CA and evidence services
  • Nonce and request timestamp for approval and activation
  • Short-lived authorization with document-hash binding

ENDPOINT CATALOGUE

Business purpose and evidence output for every operation.

POST

/v1/signing-requests

Create a request with document hashes, signer, approval, signature and evidence policy.

Returns: signingRequestId, status, expiry, evidenceCorrelationId
GET

/v1/signing-requests/{id}

Read lifecycle state, selected provider, approval facts, signature and evidence links.

Scopes: signing.request.read
POST

/v1/signing-requests/{id}/approval-options

Create WebAuthn/SPC-style approval options bound to the request and relying party.

Returns: challenge, rpId, allowCredentials, transactionSummary
POST

/v1/signing-requests/{id}/webauthn/verify

Validate assertion, origin, RP ID, challenge, user presence/verification and policy.

Returns: approvalId, assurance facts, expiry
POST

/v1/signing-requests/{id}/activation

Issue a short-lived SAD or Mobile-ID activation authorization for the exact hash and key.

Returns: activationId, expiresAt, boundKeyId, policy
GET

/v1/signing-profiles

List approved classical, hybrid-evidence and controlled PQC profiles.

Includes: formats, algorithms, parameter sets, provider and verifier constraints
GET

/v1/ca-providers

Discover eligible CA/TSP routes, credentials and operational status for the RP.

Includes: connector profile, jurisdiction, credential eligibility
POST

/v1/signatures

Execute the authorized signing operation via the selected HSM/QSCD/SAM route.

Returns: signatureId, operation evidence, artifact links
POST

/v1/asic-packages

Package documents, manifest, detached signatures, timestamp and validation material.

Returns: packageId, content manifest, validation state
POST

/v1/verifications

Verify signature, certificate path, timestamp, revocation and policy conformance.

Returns: independent path results and signed report identifier
GET

/v1/evidence-packages/{id}

Retrieve correlated authentication, approval, activation, signing and validation evidence.

Evidence is access-controlled and retention-governed
POST

/v1/evidence-packages/{id}/renewals

Request timestamp/evidence renewal before the current preservation profile degrades.

Returns: renewal job and target evidence profile

EXAMPLES

Approval and activation are separate auditable steps.

WebAuthn verification

POST /v1/signing-requests/srq_01J.../webauthn/verify
{
  "credential": {"id":"masked-credential-id","response":{...}},
  "clientDataPolicy": {
    "expectedOrigin":"https://sign.example.vn",
    "expectedRpId":"sign.example.vn"
  },
  "transactionDigest":"sha256-..."
}

Activation result

{
  "activationId":"sad_01J...",
  "signingRequestId":"srq_01J...",
  "boundKeyId":"key_account_01J...",
  "boundDocumentHashes":["sha256-..."],
  "expiresAt":"2026-07-19T10:15:00Z",
  "replayPolicy":"single_use"
}

ERROR MODEL

RFC 9457-style problem details

  • approval_required — no valid signer approval
  • activation_expired — SAD/authorization expired
  • profile_not_eligible — signer/provider cannot use requested profile
  • provider_unavailable — selected route unavailable and failover not approved
  • verification_partial — one independent validation path could not be completed

VERSIONING

Predictable integration lifecycle

  • URI major version with additive minor changes
  • Deprecation and sunset headers
  • Schema and example changelog
  • Release-specific capability and interoperability record
  • No endpoint-availability inference from this reference page