> ## Documentation Index > Fetch the complete documentation index at: https://docs.didit.me/llms.txt > Use this file to discover all available pages before exploring further. # Validate Signatures > Re-check the signed documents of an Electronic Signature step: file integrity, the PAdES signature, the certificate, revocation data and timestamp. Checks the signed documents of a step again and saves the result in each signer's `validation`. Didit re-reads every signed PDF, checks its SHA-256 and validates the PAdES signature, the certificate, the revocation data and the timestamp. Nothing is signed again. In the console, this is the **Validate again** button of the session's **Signature** tab. ```bash theme={null} curl -X POST 'https://verification.didit.me/v3/session/{session_id}/signatures/{node_id}/validate/' \ -H 'x-api-key: YOUR_API_KEY' \ -H 'Content-Type: application/json' \ -d '{"signature_id": "{signature_id}"}' ``` Send `signature_id` to check one signer. Without it, Didit checks every signer of the step, and answers `409` with `signature_not_signed` if any of them hasn't signed. A stored signed PDF that no longer matches its `sha256_signed` returns `400` with `signature_document_changed`. The response is `{ "signatures": [...] }` with the checked signers. Read `validation.valid` for the overall result and `validation.documents[]` for each document. See [Validate a signature again](/core-technology/electronic-signature/report-electronic-signature#validate-a-signature-again) for every field. ## Related * [Electronic Signature report](/core-technology/electronic-signature/report-electronic-signature) * [Download a signed document](/sessions-api/electronic-signature/download-signed-document) ## OpenAPI ````yaml POST /v3/session/{sessionId}/signatures/{nodeId}/validate/ openapi: 3.0.0 info: version: 3.0.0 title: Didit Verification API description: Identity verification API. Authenticate with x-api-key header. servers: - url: https://verification.didit.me security: [] tags: [] paths: /v3/session/{sessionId}/signatures/{nodeId}/validate/: post: tags: - Sessions summary: Validate signatures again description: >- Re-check the signed documents of an Electronic Signature step. Didit re-reads every signed PDF, checks its SHA-256 and validates the PAdES signature, the certificate, the revocation data and the timestamp, then saves the result in each signer's `validation` and returns the updated items. Nothing is signed again. Send `signature_id` to check one signer; without it, every signer of the step is checked, and the call fails if any of them hasn't signed. Needs `write:sessions`; your API key works. In the console it's the **Validate again** button. operationId: post_v3_session_signature_validate parameters: - name: sessionId in: path required: true description: The User Verification (KYC) or Business Verification (KYB) session. schema: type: string format: uuid example: 11111111-2222-3333-4444-555555555555 - name: nodeId in: path required: true description: >- The Electronic Signature step: `node_id` of the item in `signatures[]`. schema: type: string example: feature_signature requestBody: required: false content: application/json: schema: type: object properties: signature_id: type: string format: uuid description: '`id` of one signer''s item in `signatures[]`.' example: signature_id: 0e6c2a8e-6c2f-4b8e-9a51-3f2f6a7d9b10 responses: '200': description: The checked signers, with their updated `validation`. content: application/json: schema: type: object properties: signatures: type: array items: $ref: '#/components/schemas/SignatureResult' '400': description: >- A stored signed PDF no longer matches the SHA-256 recorded when it was signed. content: application/json: schema: type: object properties: detail: type: string code: type: string examples: Document changed: summary: A signed file no longer matches its hash value: code: signature_document_changed detail: signature_document_changed '403': description: >- Missing or invalid credentials, or a credential that can't read this session. Didit's API-key authentication answers `403`, never `401`. content: application/json: schema: type: object properties: detail: type: string example: detail: You do not have permission to perform this action. '404': description: >- No signature matches: the session, step or signer doesn't exist or was deleted. content: application/json: schema: type: object properties: detail: type: string code: type: string examples: Unknown signer: summary: No such signature in this step value: code: signature_not_found detail: signature_not_found '409': description: A signer of the step hasn't signed, so there's nothing to validate. content: application/json: schema: type: object properties: detail: type: string code: type: string examples: Not signed: summary: A signer hasn't signed yet value: code: signature_not_signed detail: signature_not_signed security: - ApiKeyAuth: [] components: schemas: SignatureResult: type: object description: >- One signer's result for one Electronic Signature step. See the [Electronic Signature report](/core-technology/electronic-signature/report-electronic-signature). properties: id: type: string format: uuid description: >- Pass it as `signature_id` to download this signer's evidence or validate their signature. node_id: type: string description: The workflow step that produced it. status: type: string enum: - intro - review - code - signing - signed - declined description: >- Where the signer is in the step. Only `signed` means the documents are signed. verdict: type: string enum: - Not Finished - Approved - In Review - Declined description: >- The step's outcome. A warning sets it through its rule; custom status rules apply after. level: type: string enum: - aes - qes description: '`aes`. `qes` is coming soon.' format: type: string enum: - pades profile: type: string nullable: true description: '`PAdES-B-LT` once signed.' signer: type: object properties: name: type: string nullable: true description: Verified name. capacity: type: string enum: - self - company company: type: string nullable: true role: type: string nullable: true description: The key person's designation, as declared. roles: type: array items: type: string description: The key person's structured roles, as declared for the company. identity_session_id: type: string format: uuid description: The KYC session that verified the signer. identity_used: type: object properties: session_id: type: string format: uuid kyc_id: type: string format: uuid nullable: true verified: type: boolean expected_name: type: string nullable: true description: The name the signer had to match. certificate: type: object nullable: true description: The certificate the documents were signed with. `null` until signed. properties: issuer: type: string issued_to: type: string serial: type: string description: Serial number, hexadecimal. valid_from: type: string format: date-time valid_until: type: string format: date-time confirmation: type: object properties: channel: type: string enum: - email - sms destination: type: string nullable: true description: The masked contact the code went to. confirmed_at: type: string format: date-time nullable: true attempts: type: integer description: Codes entered, the right one included. timestamp: type: object nullable: true description: The trusted timestamp in the signature. `null` until signed. properties: time: type: string format: date-time qualified: type: boolean description: Always `false` for AES. valid: type: boolean documents: type: array items: type: object properties: id: type: string format: uuid description: >- The document on this signer's copy. Use it to download the signed file. uuid: type: string format: uuid description: Same as `id`. title: type: string file_name: type: string pages: type: integer description: Pages of the document signed. For Word, of the converted PDF. size_bytes: type: integer sha256_original: type: string description: SHA-256 of the document as the signer was shown it. sha256_signed: type: string nullable: true description: SHA-256 of the signed PDF, once signed. status: type: string enum: - signed - declined - not_signed - not_reached description: >- `not_signed`: opened but not signed. `not_reached`: never opened. opened_at: type: string format: date-time nullable: true read_at: type: string format: date-time nullable: true description: >- When the signer reached the end of a document without fields, when the step requires it. read_to_end: type: boolean consented_at: type: string format: date-time nullable: true description: >- When the signer agreed to a document without fields, or finished the fields of a document with fields. consent: type: boolean signed_file: type: string nullable: true description: >- Path of the signed PDF, once signed. See [Download a signed document](/sessions-api/electronic-signature/download-signed-document). mode: type: string enum: - fields - read_and_agree description: >- `fields` for a document with fields, `read_and_agree` for a document without. source_format: type: string enum: - pdf - docx description: '`pdf`, or `docx` for a Word document Didit converted to PDF.' conversion: type: object nullable: true description: >- `null` for a PDF. For a Word document, the original file and the conversion. properties: from: type: string enum: - docx file_name: type: string description: Your original Word file name. sha256: type: string description: SHA-256 of your original Word file. size_bytes: type: integer description: Size of your original Word file. converter: type: string description: Version of the converter that produced the PDF. fields: type: array description: >- Fields on the document, with their values. Empty for a document without fields. items: $ref: '#/components/schemas/SignatureFieldResult' adopted_signature: type: object nullable: true description: >- The signature and initials the signer adopted for signature and initials fields. `null` until the signer adopts one. properties: method: type: string enum: - typed - drawn description: >- `typed`: the verified name in a handwriting style. `drawn`: drawn with a finger or a mouse. font: type: string nullable: true description: The handwriting style of a typed signature. `null` when drawn. adopted_at: type: string format: date-time electronic_signature_consent_at: type: string format: date-time nullable: true description: >- When the signer agreed, on the review screen, to sign the documents electronically. Set when any document has fields. evidence_file: type: string nullable: true description: >- Path of the evidence PDF, once signed. See [Download the signature evidence](/sessions-api/electronic-signature/download-evidence). warnings: type: array description: >- Warnings raised for this signer. See [Electronic Signature warnings](/core-technology/electronic-signature/warnings-electronic-signature). items: type: object properties: code: type: string enum: - SIGNATURE_DECLINED - SIGNATURE_OTP_FAILED - SIGNATURE_NAME_MISMATCH - SIGNATURE_IDENTITY_NOT_VERIFIED - SIGNATURE_DOCUMENT_CHANGED - SIGNATURE_FIELD_DATA_MISSING node_id: type: string validation: type: object nullable: true description: >- The last cryptographic check of the signed documents. `null` until the documents are signed. If Didit can't confirm the outcome of signing, it's `{"valid": null, "reason": "signature_provider_outcome_unknown", "checked_at": ...}` and `status` stays `signing`: treat it as not signed. properties: valid: type: boolean nullable: true description: >- `true` when every document is valid. `null` when the outcome of signing couldn't be confirmed. reason: type: string description: >- Set when `valid` is `null`: `signature_provider_outcome_unknown`. checked_at: type: string format: date-time documents: type: array items: type: object properties: id: type: string format: uuid checked_at: type: string format: date-time valid: type: boolean description: >- `true` when the signature and the timestamp are both valid and trusted. integrity: type: boolean description: '`true` when the document is unchanged since signing.' trusted: type: boolean description: >- `true` when the signing certificate chains to a trusted root. revoked: type: boolean trusted_list: type: object description: >- EU Trusted List check. For AES: `{"status": "not_applicable", "reason": "aes_not_qualified"}`. properties: status: type: string reason: type: string certificate: type: object nullable: true description: >- The certificate the documents were signed with. `null` until signed. properties: issuer: type: string issued_to: type: string serial: type: string description: Serial number, hexadecimal. valid_from: type: string format: date-time valid_until: type: string format: date-time timestamp: type: object nullable: true description: >- The trusted timestamp in the signature. `null` until signed. properties: time: type: string format: date-time qualified: type: boolean description: Always `false` for AES. valid: type: boolean declined_at: type: string format: date-time nullable: true declined_action: type: string enum: - DECLINE - REVIEW - NO_ACTION signed_at: type: string format: date-time nullable: true expires_at: type: string format: date-time description: When the signing link stops working. email_sent_at: type: string format: date-time nullable: true email_unavailable_reason: type: string nullable: true ip_address: type: string nullable: true description: The signer's IP address when they asked for their code. place: type: string nullable: true description: 'Not collected: always `null`.' place_unavailable_reason: type: string nullable: true enum: - not_collected SignatureFieldResult: type: object description: >- A field of a signed document, with its value on this signer's copy. See [Fields](/core-technology/electronic-signature/report-electronic-signature#fields). properties: key: type: string description: The field's key, as used in `sign.field_values`. type: type: string enum: - signature - initials - full_name - date_signed - text - checkbox - email - data role: type: string enum: - verified_person - legal_representative - key_people label: type: string page: type: integer description: >- Page number, from 1. For a Word document, a page of the converted PDF. x: type: number description: Left edge, as a fraction of the page width. 'y': type: number description: Top edge, as a fraction of the page height. width: type: number description: Width, as a fraction of the page width. height: type: number description: Height, as a fraction of the page height. required: type: boolean value: nullable: true description: >- A string for `text`, `email`, `full_name`, `date_signed` and `data`, a boolean for a `checkbox`, and `true` for an applied signature or initials. `null` when empty. display_value: type: string nullable: true description: >- The value as stamped on the page: dates in the field's `date_format`, `Yes` or `No` for a checkbox, `Signed` for a signature or initials. value_source: type: string nullable: true enum: - signer - identity - contact - company - session - metadata - api - signing_time - null description: >- Where the value came from: `signer` (typed, ticked or applied by the signer), `identity` (the verified ID), `contact` (the verified email or phone), `company` (the verified company), `session` (`vendor_data`), `metadata`, `api` (`sign.field_values`) or `signing_time` (the date signed). filled_at: type: string format: date-time nullable: true image_url: type: string nullable: true description: >- Signature and initials only: the path of the applied image. See [Download a signature image](/sessions-api/electronic-signature/download-field-image). value_unavailable_reason: type: string nullable: true enum: - source_empty - null description: >- `source_empty` when a pre-filled field had no value in the session and `signature_field_data_missing_action` let the signer sign anyway. securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: >- Your application's API key, from Developers -> API keys in the Business Console. The primary key has full access. A named key can be scoped: none, read or write per resource, limited to some workflows or to approved sessions, to a list of IP addresses, and to an expiry date. 401 means the key is missing, wrong, revoked or expired; 403 means the key has no access to this resource or action, or the request came from an address outside its IP list; 404 on a session route means the session is outside the key's workflows or statuses. A key without media access receives image, video and PDF URLs as null, and a key without sessions write receives session links and tokens as null. See https://docs.didit.me/console/api-keys. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.