--- title: "Rest PKI Core" description: "Rest PKI Core adds signatures, validation, timestamping and biometric identity checks to your apps through a REST API, as a service or your own instance." canonical: "https://docs.lacunasoftware.com/en-us/articles/rest-pki/core" locale: "en" product: "Rest PKI Core" last_updated: "2026-10-20" --- # Rest PKI Core **Rest PKI Core** adds digital signatures, signature validation, timestamping and biometric identity checks to your applications through a REST API. When a step needs the user, such as choosing a certificate and signing, or taking a selfie, Rest PKI Core hosts the page: your application creates a session, sends the user to it and gets the results back, with no signature or camera code of its own. Use it as a service at [core.pki.rest](https://core.pki.rest/), or run your own instance on Windows, Linux, Docker or Azure. ## Get started on integration Integrating takes three steps: 1. Get the **endpoint** of the instance and create an **API key** on its dashboard 1. Add the client library for your language ([.NET](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/get-started#dotnet), [PHP](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/get-started#php) or [Java](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/get-started#java)) or [call the REST API directly](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/get-started#rest) 1. Create your first [signature session](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/signature-sessions) The article [Get started on integration](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/get-started) walks you through each of them. Then, see the [Integration Guide](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration) for the feature you need. ## Features ### Digital signatures * **Signature sessions**: your application creates a session with the documents to sign, or lets the user upload them, and redirects the user to a signature page hosted by Rest PKI Core. When the user is done, your application gets the signed documents through the API, and can also be notified by a [webhook](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/webhooks). See [Signature sessions](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/signature-sessions). * **Local and cloud certificates**: users sign with the certificates installed on their computer or on a token or smart card, through [Web PKI](https://docs.lacunasoftware.com/en-us/articles/web-pki), or with cloud certificates. A session can also accept cloud certificates only, skipping the Web PKI screens. * **Certificate requirements**: restrict which certificates can sign a session, for instance only certificates on a cryptographic device, or only the certificate of a given CPF. See [Certificate requirements](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/signature-sessions/certificate-requirements). * **Signature formats and policies**: PAdES for PDF files, CAdES for any file and XAdES for XML files, including the ICP-Brasil signature policies (AD-RB, AD-RT, AD-RC and AD-RA). * **Document preparation**: convert PDF files to PDF/A before signing them ([PDF/A conversion](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/signature-sessions/pdf-a-conversion)), attach your own [metadata](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/signature-sessions/document-metadata) to the documents, and [validate the files](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/signature-sessions/file-validation) users upload before they are signed. * **Background processing**: send users back to your application as soon as they sign, while the documents are still being processed. See [Background processing](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/signature-sessions/background-processing). * **Desktop signing**: the [Rest PKI client tool](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/client-tool) signs documents from the command line, for desktop applications and scripts. ### Validation and preservation * **Signature inspection**: open PAdES, CAdES and XAdES signatures to see who signed and when, and validate them. * **Verification codes**: signed documents can carry a code that anyone can enter on the instance's validation page to check the document and its signatures. * **Archival timestamps**: extend existing signatures with archival timestamps (AD-RA), so they can still be validated long after the certificates that created them expire. ### Timestamping Your systems can request RFC 3161 timestamps from Rest PKI Core, through the TSP protocol or a REST API. An on-premises instance forwards the requests to the timestamp providers you configure, ordered by priority, and spreads the load among providers of equal priority. See [Requesting timestamps](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/requesting-timestamps) and [Timestamping configuration](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/on-premises/configure-timestamp). ### Biometrics and identity * **Biometric sessions**: pages hosted by Rest PKI Core that capture the user's face and identity documents, opened by redirecting the user or embedded in your page with a widget. See [Biometric sessions](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/bio-sessions). * **Liveness**: checks that a real person is in front of the camera. See [Liveness](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/bio-sessions/liveness). * **Enrollment, authentication and identification**: enroll a person's face, confirm later that the same person is back (1:1), or find who a face belongs to among the enrolled people (1:N). See [Enrollment](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/bio-sessions/enrollment), [Authentication](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/bio-sessions/authentication) and [Identification](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/bio-sessions/identification). * **ID capture**: reads identity documents and matches the face on the document with the user's face. See [ID capture](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/bio-sessions/id-capture). * **Video identification**: records the user and their identity document, with a PDF report of the results. * **Certificate authentication**: users sign in to your application with their digital certificate. See [Certificate authentication](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/cert-auth). ### Compatibility with Rest PKI Rest PKI Core also serves most of the APIs of the classic [Rest PKI](https://docs.lacunasoftware.com/en-us/articles/rest-pki), such as PAdES, CAdES and XML signatures, certificate authentication and PDF marks, which eases moving applications built on Rest PKI to Rest PKI Core. See [Moving from Rest PKI to Rest PKI Core](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/migrating-from-rest-pki). ## Integrations * **REST API and client libraries**: every feature is available through a REST API, described on the [API reference](https://core.pki.rest/swagger), with client libraries for .NET, PHP, Java and Node.js. See [Get started on integration](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/get-started). * **Webhooks**: Rest PKI Core notifies your application when a document is signed. See [Webhooks](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration/webhooks). * **Sign-in**: dashboard users sign in through [GrantID](https://docs.lacunasoftware.com/en-us/articles/grant-id), Lacuna's OpenID Connect identity provider. See [Configure OpenID Connect](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/on-premises/configure-oidc). * **File storage**: documents are kept on the local file system, on Azure Blob Storage, on Amazon S3 (or an S3-compatible service) or on Google Cloud Storage. See [Blob storage configuration](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/on-premises/configure-blob-storage). ## Deployment Choose where Rest PKI Core runs: * **Cloud (SaaS)**: use Lacuna's instance at [core.pki.rest](https://core.pki.rest/), with nothing to install or maintain. * **On-premises**: run your own instance on [Windows Server](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/on-premises/windows-server), [Linux](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/on-premises/linux) (Ubuntu or Rocky Linux), [Docker](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/on-premises/docker) or [Azure App Service](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/on-premises/azure), with a SQL Server or PostgreSQL database. A single instance can serve several [subscriptions](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/on-premises/create-sub), each with its own users, applications and settings. Start with [Rest PKI Core on-premises](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/on-premises). ## See also * [Integration Guide](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/integration) * [Rest PKI Core on-premises](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/on-premises) * [Operation Guide](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/operation) * [Changelog](https://docs.lacunasoftware.com/en-us/articles/rest-pki/core/changelog)