PDF Signatures

Appends an RFC 3161 document timestamp to a PDF.#

Appends a cryptographic document timestamp (subfilter ETSI.RFC3161): an authority proves the whole file existed at a point in time, without naming a signer. The timestamp is appended incrementally, so signatures already in the document stay intact. The authority comes from the request or from the server's configured 'DocumentSigning:TimestampAuthority'; the request fails when neither is available. The timestamped document is stored on the server and returned as a file ID together with an independent verification of the output. This is a pure document processing operation that does not require an AI model. Returns 422 Unprocessable Entity with an ErrorResponse body if the input file cannot be processed. The 'error' field contains one of: 'password_required' (encrypted PDF), 'invalid_format' (not a valid PDF), 'unsupported_security' (unsupported encryption), 'page_error' (content error).

Request body

application/json · PdfTimestampRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/pdf-timestamp" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "input": "",
  "input_format": "Base64EncodedFile",
  "password": "string",
  "timestamp_authority": "string",
  "field_name": "DocTimeStamp1"
}'

Signs a PDF with a digital signature (PAdES).#

Applies a PAdES (ETSI.CAdES.detached) digital signature to a PDF using a PKCS#12 (.p12/.pfx) identity: the one carried by the request, or the server's configured signing certificate when the request carries none. Signing is fully managed and in-process; keys never enter an OS store. The signature can be invisible (no 'field') or render a visible mark whose text is composed automatically (localized via 'appearance_language'), supplied as custom lines, or drawn from an uploaded image. An RFC 3161 authority can attest the signing time (PAdES B-T), and the signature can certify the document (DocMDP). The signed document is stored on the server and returned as a file ID together with an independent verification of the output. This is a pure document processing operation that does not require an AI model. Returns 422 Unprocessable Entity with an ErrorResponse body if the input file cannot be processed. The 'error' field contains one of: 'password_required' (encrypted PDF), 'invalid_format' (not a valid PDF), 'unsupported_security' (unsupported encryption), 'page_error' (content error).

Request body

application/json · PdfSignRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/pdf-sign" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "input": "",
  "input_format": "Base64EncodedFile",
  "password": "string",
  "certificate": "string",
  "certificate_password": "string"
}'

Verifies the digital signatures of a PDF.#

Validates every digital signature and document timestamp in a PDF and reports each one's verdict on four independent axes: integrity (are the signed bytes untouched), identity (does the signer chain to a trust anchor), revocation, and timestamp. Trust anchors come from the server's configured trust directory ('DocumentSigning:TrustAnchorsDirectory'), the request's own 'trust_roots', and the OS root store when enabled. PAdES (ETSI.CAdES.detached), adbe.pkcs7.detached, and ETSI.RFC3161 document timestamps are supported. This is a pure document processing operation that does not require an AI model. Returns 422 Unprocessable Entity with an ErrorResponse body if the input file cannot be processed. The 'error' field contains one of: 'password_required' (encrypted PDF), 'invalid_format' (not a valid PDF), 'unsupported_security' (unsupported encryption), 'page_error' (content error).

Request body

application/json · PdfVerifySignaturesRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/pdf-verify-signatures" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "input": "",
  "input_format": "Base64EncodedFile",
  "password": "string",
  "trust_roots": [
    "string"
  ],
  "trust_system_roots": false
}'

Embeds long-term validation (LTV) material into a signed PDF.#

Embeds validation material (certificates, CRLs, OCSP responses) into the document security store (/DSS, PAdES B-LT), so signatures stay verifiable after their certificates expire or the issuing infrastructure disappears. By default the material already carried by the document's signatures is gathered automatically; the request can add more. The material is appended incrementally, so existing signatures stay intact. The extended document is stored on the server and returned as a file ID together with an independent verification of the output. This is a pure document processing operation that does not require an AI model. Returns 422 Unprocessable Entity with an ErrorResponse body if the input file cannot be processed. The 'error' field contains one of: 'password_required' (encrypted PDF), 'invalid_format' (not a valid PDF), 'unsupported_security' (unsupported encryption), 'page_error' (content error).

Request body

application/json · PdfLtvRequest

Responses

curl -X POST "$LMKIT_ONE_URL/lmkit/v1/pdf-ltv" \
  -H "Authorization: Bearer $LMKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "input": "",
  "input_format": "Base64EncodedFile",
  "password": "string",
  "certificates": [
    "string"
  ],
  "crls": [
    "string"
  ]
}'