> ## Documentation Index > Fetch the complete documentation index at: https://docs.didit.me/llms.txt > Use this file to discover all available pages before exploring further. # Download the Signature Evidence > Download a signer's evidence PDF: identity, code confirmation, document hashes, field values, certificate and timestamp of an Electronic Signature. Returns the evidence PDF of one signer, once they have signed. The path is in the signer's `signatures[].evidence_file`, with `signature_id` already set. ```bash theme={null} curl -L 'https://verification.didit.me/v3/session/{session_id}/signatures/{node_id}/evidence/?signature_id={signature_id}' \ -H 'x-api-key: YOUR_API_KEY' \ -o signature-evidence.pdf ``` Always pass `signature_id`. A Business Verification step can have several signers, and without it the route picks one of them. The evidence PDF records the level and format, the signer and their verified identity session, the code confirmation, the IP address, each document with its original SHA-256, the adopted signature, every field's value with its source and time, the final consent, the certificate, the timestamp and the SHA-256 of every signed file. See [The evidence PDF](/core-technology/electronic-signature/report-electronic-signature#the-evidence-pdf). A signer who hasn't signed returns `404` with `signature_not_signed`. After you [delete the session](/sessions-api/delete-session), the route returns `404`. ## Related * [Download a signed document](/sessions-api/electronic-signature/download-signed-document) * [Electronic Signature report](/core-technology/electronic-signature/report-electronic-signature) ## OpenAPI ````yaml GET /v3/session/{sessionId}/signatures/{nodeId}/evidence/ openapi: 3.0.0 info: version: 3.0.0 title: Didit Verification API description: Identity verification API. Authenticate with x-api-key header. servers: - url: https://verification.didit.me security: [] tags: [] paths: /v3/session/{sessionId}/signatures/{nodeId}/evidence/: get: tags: - Sessions summary: Download the signature evidence description: >- Download a signer's evidence PDF: the level and format, the signer and their verified identity session, the code confirmation, the IP address, each document with its original SHA-256 and field values, the certificate, the timestamp and the SHA-256 of every signed file. Use the `evidence_file` path of the signer's item in `signatures[]`. Always pass `signature_id` when a Business Verification step has several signers: without it, the route picks one of the step's signers. Needs `read:sessions`; your API key works. operationId: get_v3_session_signature_evidence parameters: - name: sessionId in: path required: true description: The User Verification (KYC) or Business Verification (KYB) session. schema: type: string format: uuid example: 11111111-2222-3333-4444-555555555555 - name: nodeId in: path required: true description: >- The Electronic Signature step: `node_id` of the item in `signatures[]`. schema: type: string example: feature_signature - name: signature_id in: query required: false description: '`id` of the signer''s item in `signatures[]`.' schema: type: string format: uuid responses: '200': description: The evidence PDF. headers: Content-Disposition: description: Attachment with the file name. schema: type: string example: attachment; filename="signature-evidence.pdf" content: application/pdf: schema: type: string format: binary '403': description: >- Missing or invalid credentials, or a credential that can't read this session. Didit's API-key authentication answers `403`, never `401`. content: application/json: schema: type: object properties: detail: type: string example: detail: You do not have permission to perform this action. '404': description: >- No evidence matches: the session, step or signer doesn't exist, was deleted, or hasn't signed. content: application/json: schema: type: object properties: detail: type: string code: type: string examples: Not signed yet: summary: The signer hasn't signed value: code: signature_not_signed detail: signature_not_signed Unknown signer: summary: No such signature in this step value: code: signature_not_found detail: signature_not_found '409': description: >- The stored file no longer matches its recorded SHA-256. Nothing is returned. content: application/json: schema: type: object properties: detail: type: string code: type: string examples: Changed file: summary: Stored file doesn't match its hash value: code: signature_document_changed detail: signature_document_changed security: - ApiKeyAuth: [] components: securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: >- Your application's API key, from Developers -> API keys in the Business Console. The primary key has full access. A named key can be scoped: none, read or write per resource, limited to some workflows or to approved sessions, to a list of IP addresses, and to an expiry date. 401 means the key is missing, wrong, revoked or expired; 403 means the key has no access to this resource or action, or the request came from an address outside its IP list; 404 on a session route means the session is outside the key's workflows or statuses. A key without media access receives image, video and PDF URLs as null, and a key without sessions write receives session links and tokens as null. See https://docs.didit.me/console/api-keys. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.