Skip to main content
Every Electronic Signature step produces one result per signer. You find it as an item of signatures[] in: signatures is only in the decision when the workflow has an Electronic Signature step. It’s an empty array until a signer reaches the step. A KYC step has one item; a KYB step has one item per signer.

​
Example

​
The signature object

A null certificate, timestamp or signed_file means there is no signature yet. Never treat a signer as having signed until status is signed.

​
Signer

​
Documents

​
Fields

Each item of documents[].fields[] is one field of the document, with its value on this signer’s copy:

​
Download the signed documents

Use the paths in signed_file and evidence_file with your API key. Each route answers with the PDF itself.
Before answering, Didit checks the stored file against its recorded SHA-256. If they differ, the signed PDF and evidence routes return 409 and the image route returns 400, each with signature_document_changed. Always pass signature_id to the evidence route when a KYB step has several signers.

​
The signed PDF

The signed PDF holds, in order:
  1. The pages of the document the signer was shown, with every field value stamped where you placed it.
  2. The evidence page, unless you turned off signature_evidence_page.
  3. The PAdES signature, with the trusted timestamp and the revocation data needed to validate it in the future.
The signature covers every byte before it, field values and evidence page included. Changing anything in the file afterwards invalidates it, and any PAdES-capable validator shows that. The signature’s details name the signer and refer to their verified identity session and code confirmation. Field values become part of the page content, not form fields, so they can’t be edited later and every PDF viewer shows them. A ticked checkbox shows a tick, and an unticked one is left as the document drew it. A signature box taller than 24 points also gets a small caption under the signature: Signed with Didit · followed by the first 8 characters of the signature’s id. Didit adds the field values, the evidence page and the signature after the bytes of the document the signer was shown. That document is an exact prefix of the signed file, so sha256_original can still be checked against the signed PDF.

​
The evidence PDF

The evidence PDF records, for one signer:
  • The level and format.
  • The signer’s name, their signing capacity and, for KYB, the company.
  • The verified identity session.
  • The confirmation: channel, masked destination and time.
  • The signer’s IP address.
  • Each document: title, number of pages and SHA-256 of the original. For a Word document, the Word file’s name and SHA-256, the converter version and the SHA-256 of the PDF.
  • The adopted signature: typed (with its handwriting style) or drawn, when it was adopted, and the signature and initials images.
  • Each field, per document: its label, page and type, its value (the image for a signature or initials), where the value came from (for example Typed by the signer, Verified ID or Your API), when it was filled (UTC) and, for a value the signer typed, their IP address at that time.
  • The final consent: the text the signer agreed to on the review screen, and when.
  • The certificate (issued to, issuer, serial and validity), the timestamp and the SHA-256 of every signed file.
The page appended to each signed PDF has the same content without the certificate section, because it’s added before the signature is applied.

​
Validate a signature again

POST /v3/session/{session_id}/signatures/{node_id}/validate/ re-reads every signed PDF of the step, checks its SHA-256 and validates the PAdES signature, its certificate, the revocation data and the timestamp. It saves the result in validation and returns the updated signatures[]. Send signature_id to check one signer. It needs write:sessions, and in the console it’s the Validate again button. A stored signed PDF that no longer matches its sha256_signed returns 400 with signature_document_changed. Until the documents are signed, validation is null. If Didit can’t confirm the outcome of signing, validation is { "valid": null, "reason": "signature_provider_outcome_unknown", "checked_at" } and status stays signing until it’s resolved: treat it as not signed.

​
In the PDF report

The PDF report prints a signature section with the signer, the confirmation, the certificate, the timestamp and the documents with their hashes. When the documents have fields, an Electronic signature · fields page follows, with one table per document: every field’s value, the signature and initials images, the times and the sources. The signature section comes after Bank verification in a KYC report and after Documents in a KYB report. Pass pages=signature to print only that section.