Overview

This document describes the API interface for issuing certificates and for signing with those certificates. The following Figure shows the general workflow.

Ident Record service

The Ident Record service is described in (Hagelkruys and Sabet, n.d.). To use the interface, an authentication certificate is required, which can be obtained from A-Trust after the legal contract has been concluded.

Further information is available via https://github.com/A-Trust/Ident Interface

Order of operations

As shown in Figure above , the first step is identification, i.e., calling the Ident Record service.

The next step is issuing the certificate.

After successful certificate issuance, the signing process can be called as many times as needed.

Once all signatures have been completed, it is strongly recommended to use the Delete Session command to end the workflow.

Quick reference - issuing and signing service

URL	Method	Functionality
issue/<token>	POST	start the issuing of the
certificate/<ticketId>	GET	get the issued certificate
signature/<ticketId>	POST	add hash to be signed and start signature
signature/<ticketId>	DELETE	get all signature and delete document from server
session/<ticketId>	GET	retrieves session information, such as validity.
session/<ticketId>	DELETE	deletes the session and data

Generic return codes

The following return codes can be returned with any REST call. Therefore, they are not explicitly listed.

• HTTP/500 internal server error: An error occurred while processing the request.
• HTTP/400 bad request: There is an error in the request.
• HTTP/401 Unauthorized: There session timeout is reached.

Timeouts

There is a 15-minute timeout between calls to the services.

Signature format

Certificates for are issued with an ECDSA-256 private key. Signing is performed using SHA-256 hash.

$$\begin{aligned} ~signature &= Base64(~R + ~S ) \\ \text{where}~R &= \text{first coordinate of ECDSA point} \\ ~S &= \text{second coordinate of ECDSA point} \end{aligned}$$