> ## Documentation Index
> Fetch the complete documentation index at: https://docs.didit.me/llms.txt
> Use this file to discover all available pages before exploring further.

# Download a Signature Image

> Download the signature or initials a signer applied to a field of an Electronic Signature document, as a PNG.

Returns, as a PNG, the signature or initials a signer applied to a field. The path is in the field's `image_url`, in `signatures[].documents[].fields[]`, so you don't need to build it. It needs `read:sessions`.

```bash theme={null}
curl -L 'https://verification.didit.me/v3/session/{session_id}/signatures/{node_id}/fields/{field_id}/image/' \
  -H 'x-api-key: YOUR_API_KEY' \
  -o signature.png
```

A drawn signature is the image the signer drew, and it's the image stamped into the signed PDF. A typed signature is their verified name in the handwriting style they chose, and the signed PDF carries it as text in the same style. For proof of the signature itself, use the [signed document](/sessions-api/electronic-signature/download-signed-document) and the [evidence](/sessions-api/electronic-signature/download-evidence).

A field that isn't the signer's, or has no applied signature or initials, returns `404` with `signature_field_not_found`. A stored image that no longer matches its recorded SHA-256 returns `400` with `signature_document_changed`. After you [delete the session](/sessions-api/delete-session), the route returns `404`.

## Related

* [Fields on the document](/core-technology/electronic-signature/overview#fields-on-the-document)
* [Electronic Signature report](/core-technology/electronic-signature/report-electronic-signature#fields)


## OpenAPI

````yaml GET /v3/session/{sessionId}/signatures/{nodeId}/fields/{fieldId}/image/
openapi: 3.0.0
info:
  version: 3.0.0
  title: Didit Verification API
  description: Identity verification API. Authenticate with x-api-key header.
servers:
  - url: https://verification.didit.me
security: []
tags: []
paths:
  /v3/session/{sessionId}/signatures/{nodeId}/fields/{fieldId}/image/:
    get:
      tags:
        - Sessions
      summary: Download a signature image
      description: >-
        Download the signature or initials a signer applied to a field, as PNG.
        Use the `image_url` of the field in `signatures[].documents[].fields[]`.
        Needs `read:sessions`; your API key works.
      operationId: get_v3_session_signature_field_image
      parameters:
        - name: sessionId
          in: path
          required: true
          description: The User Verification (KYC) or Business Verification (KYB) session.
          schema:
            type: string
            format: uuid
            example: 11111111-2222-3333-4444-555555555555
        - name: nodeId
          in: path
          required: true
          description: >-
            The Electronic Signature step: `node_id` of the item in
            `signatures[]`.
          schema:
            type: string
            example: feature_signature
        - name: fieldId
          in: path
          required: true
          description: The field on this signer's copy, as in the field's `image_url`.
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: The image.
          content:
            image/png:
              schema:
                type: string
                format: binary
        '400':
          description: The stored image no longer matches its recorded SHA-256.
          content:
            application/json:
              schema:
                type: object
                properties:
                  detail:
                    type: string
                  code:
                    type: string
              example:
                code: signature_document_changed
                detail: signature_document_changed
        '403':
          description: >-
            Missing or invalid credentials, or a credential that can't read this
            session. Didit's API-key authentication answers `403`, never `401`.
          content:
            application/json:
              schema:
                type: object
                properties:
                  detail:
                    type: string
              example:
                detail: You do not have permission to perform this action.
        '404':
          description: >-
            No image matches: the session, step or field doesn't exist, was
            deleted, or has no applied signature or initials.
          content:
            application/json:
              schema:
                type: object
                properties:
                  detail:
                    type: string
                  code:
                    type: string
              examples:
                Unknown field:
                  summary: No such field
                  value:
                    code: signature_field_not_found
                    detail: signature_field_not_found
      security:
        - ApiKeyAuth: []
components:
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key
      description: >-
        Your application's API key, from Developers -> API keys in the Business
        Console. The primary key has full access. A named key can be scoped:
        none, read or write per resource, limited to some workflows or to
        approved sessions, to a list of IP addresses, and to an expiry date. 401
        means the key is missing, wrong, revoked or expired; 403 means the key
        has no access to this resource or action, or the request came from an
        address outside its IP list; 404 on a session route means the session is
        outside the key's workflows or statuses. A key without media access
        receives image, video and PDF URLs as null, and a key without sessions
        write receives session links and tokens as null. See
        https://docs.didit.me/console/api-keys.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.