Pular para o conteúdo principal

Rest PKI Core

Rest PKI Core adds digital signatures, signature validation, timestamping and biometric identity checks to your applications through a REST API. When a step needs the user, such as choosing a certificate and signing, or taking a selfie, Rest PKI Core hosts the page: your application creates a session, sends the user to it and gets the results back, with no signature or camera code of its own.

Use it as a service at core.pki.rest, or run your own instance on Windows, Linux, Docker or Azure.

Get started on integration​

Integrating takes three steps:

  1. Get the endpoint of the instance and create an API key on its dashboard
  2. Add the client library for your language (.NET, PHP or Java) or call the REST API directly
  3. Create your first signature session

The article Get started on integration walks you through each of them. Then, see the Integration Guide for the feature you need.

Features​

Digital signatures​

  • Signature sessions: your application creates a session with the documents to sign, or lets the user upload them, and redirects the user to a signature page hosted by Rest PKI Core. When the user is done, your application gets the signed documents through the API, and can also be notified by a webhook. See Signature sessions.
  • Local and cloud certificates: users sign with the certificates installed on their computer or on a token or smart card, through Web PKI, or with cloud certificates. A session can also accept cloud certificates only, skipping the Web PKI screens.
  • Certificate requirements: restrict which certificates can sign a session, for instance only certificates on a cryptographic device, or only the certificate of a given CPF. See Certificate requirements.
  • Signature formats and policies: PAdES for PDF files, CAdES for any file and XAdES for XML files, including the ICP-Brasil signature policies (AD-RB, AD-RT, AD-RC and AD-RA).
  • Document preparation: convert PDF files to PDF/A before signing them (PDF/A conversion), attach your own metadata to the documents, and validate the files users upload before they are signed.
  • Background processing: send users back to your application as soon as they sign, while the documents are still being processed. See Background processing.
  • Desktop signing: the Rest PKI client tool signs documents from the command line, for desktop applications and scripts.

Validation and preservation​

  • Signature inspection: open PAdES, CAdES and XAdES signatures to see who signed and when, and validate them.
  • Verification codes: signed documents can carry a code that anyone can enter on the instance's validation page to check the document and its signatures.
  • Archival timestamps: extend existing signatures with archival timestamps (AD-RA), so they can still be validated long after the certificates that created them expire.

Timestamping​

Your systems can request RFC 3161 timestamps from Rest PKI Core, through the TSP protocol or a REST API. An on-premises instance forwards the requests to the timestamp providers you configure, ordered by priority, and spreads the load among providers of equal priority. See Requesting timestamps and Timestamping configuration.

Biometrics and identity​

  • Biometric sessions: pages hosted by Rest PKI Core that capture the user's face and identity documents, opened by redirecting the user or embedded in your page with a widget. See Biometric sessions.
  • Liveness: checks that a real person is in front of the camera. See Liveness.
  • Enrollment, authentication and identification: enroll a person's face, confirm later that the same person is back (1:1), or find who a face belongs to among the enrolled people (1:N). See Enrollment, Authentication and Identification.
  • ID capture: reads identity documents and matches the face on the document with the user's face. See ID capture.
  • Video identification: records the user and their identity document, with a PDF report of the results.
  • Certificate authentication: users sign in to your application with their digital certificate. See Certificate authentication.

Compatibility with Rest PKI​

Rest PKI Core also serves most of the APIs of the classic Rest PKI, such as PAdES, CAdES and XML signatures, certificate authentication and PDF marks, which eases moving applications built on Rest PKI to Rest PKI Core. See Moving from Rest PKI to Rest PKI Core.

Integrations​

  • REST API and client libraries: every feature is available through a REST API, described on the API reference, with client libraries for .NET, PHP, Java and Node.js. See Get started on integration.
  • Webhooks: Rest PKI Core notifies your application when a document is signed. See Webhooks.
  • Sign-in: dashboard users sign in through GrantID, Lacuna's OpenID Connect identity provider. See Configure OpenID Connect.
  • File storage: documents are kept on the local file system, on Azure Blob Storage, on Amazon S3 (or an S3-compatible service) or on Google Cloud Storage. See Blob storage configuration.

Deployment​

Choose where Rest PKI Core runs:

See also​

View as Markdown