PDF Signature Verifier API

Check every digital signature in a PDF: integrity, edits after signing, signer (MST / CCCD), signing time, timestamp and chain to Vietnam's Root CA.

POSThttps://apibox.io.vn/v1/pdf-sign-verify

Security & Crypto▶ Try it online

Upload a signed PDF (contract, e-invoice, official letter, report) and get every signature and document timestamp it contains. For each one the API checks the integrity of the signed bytes (the message digest of the /ByteRange), the CMS / PKCS#7 signature with the signer certificate, and whether bytes were added after it (modified_after_signing: later revisions are normal for a second signature or LTV data, but worth looking at). document_unchanged_since_last_signature tells whether the last signature covers the whole file.

The signer certificate is decoded: name, organisation, tax code (MST) or citizen ID (CCCD / CMND) from the subject, issuing CA, serial number, validity and whether it was valid at the signing time. The signing time comes from an RFC 3161 timestamp when there is one (its imprint and signature are checked), otherwise from the signed attributes or the time claimed in the PDF. The chain is built from the certificates in the signature plus the root and CA certificates published by the Vietnam National Electronic Authentication Centre (NEAC, rootca.gov.vn: VNPT-CA, Viettel-CA, BkavCA, FPT-CA, MISA-CA and every licensed public CA) and the Government specialised CA (Ban Cơ yếu Chính phủ); every link is verified cryptographically, and trusted_root is true when it ends at one of these roots.

Revocation is not checked (no OCSP / CRL request): the CRL and OCSP URLs of the certificate are returned so you can check them yourself. The result is a technical check, not a legal validation of the document. Supported: adbe.pkcs7.detached, ETSI.CAdES.detached, adbe.pkcs7.sha1 and ETSI.RFC3161 document timestamps; RSA and ECDSA.

Parameters

Name	In	Type	Required	Default
`file`	body	file	no		The signed PDF (multipart, raw body or `file_base64`), within the file size of your plan.
`url`	body\|query	string	no		Public URL of the PDF, instead of uploading it.

Example

curl -X POST "https://apibox.io.vn/v1/pdf-sign-verify" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -F "0=@./my-file"

const form = new FormData();
form.append('0', fileInput.files[0]);

const res = await fetch('https://apibox.io.vn/v1/pdf-sign-verify', {
  method: 'POST',
  headers: { Authorization: 'Bearer YOUR_API_KEY' },
  body: form,
});
console.log(await res.json());

import requests

res = requests.post(
    "https://apibox.io.vn/v1/pdf-sign-verify",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    files={"0": open("my-file", "rb")},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/pdf-sign-verify');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY'],
    CURLOPT_POSTFIELDS => ['0' => new CURLFile('my-file')],
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

Response

{
  "signed": true,
  "signature_count": 1,
  "timestamp_count": 0,
  "all_valid": true,
  "all_trusted": true,
  "document_unchanged_since_last_signature": true,
  "has_ltv_data": false,
  "file_size": 222785,
  "signatures": [
    {
      "index": 1,
      "type": "signature",
      "sub_filter": "adbe.pkcs7.detached",
      "reason": "CHÍNH PHỦ<cp@chinhphu.vn> đã ký lên văn bản này!",
      "location": "Hà Nội",
      "claimed_signing_time": "2026-11-10T07:20:38.000Z",
      "covers_whole_file": true,
      "modified_after_signing": false,
      "integrity_valid": true,
      "signature_valid": true,
      "digest_algorithm": "SHA-256",
      "signing_time": "2026-11-10T07:20:39.000Z",
      "signing_time_source": "timestamp",
      "timestamp": {
        "time": "2026-11-10T07:20:39.000Z",
        "tsa": "Máy chủ cấp dấu thời gian CPNET",
        "serial_number": "42198483DA95DD67",
        "imprint_valid": true,
        "signature_valid": true
      },
      "certificate": {
        "common_name": "CHÍNH PHỦ",
        "organization": "CHÍNH PHỦ",
        "tax_code": null,
        "citizen_id": null,
        "issuer_common_name": "CA phục vụ các cơ quan Nhà nước G2",
        "serial_number": "75E92DD9AD56BD4D",
        "not_before": "2025-11-04T07:09:12.000Z",
        "not_after": "2030-11-03T07:09:12.000Z",
        "valid_at_signing": true,
        "expired": false,
        "key": {
          "algorithm": "RSA",
          "bits": 3072
        },
        "revocation_urls": {
          "crl": [
            "http://ca.gov.vn/pki/pub/crl/cpcag2.crl"
          ],
          "ocsp": [
            "http://ocsp.ca.gov.vn"
          ],
          "ca_issuers": [
            "http://ca.gov.vn/pki/pub/crt/cpcag2.crt"
          ]
        }
      },
      "chain": [
        {
          "subject": "CHÍNH PHỦ",
          "issuer": "CA phục vụ các cơ quan Nhà nước G2",
          "signature_verified_by_issuer": true,
          "in_ca_list": false,
          "trust_anchor": false
        },
        {
          "subject": "CA phục vụ các cơ quan Nhà nước G2",
          "issuer": "RootCA chuyên dùng Chính phủ G2",
          "signature_verified_by_issuer": true,
          "in_ca_list": true,
          "trust_anchor": false,
          "ca": "ban-co-yeu-chinh-phu"
        },
        {
          "subject": "RootCA chuyên dùng Chính phủ G2",
          "issuer": "RootCA chuyên dùng Chính phủ G2",
          "signature_verified_by_issuer": true,
          "in_ca_list": true,
          "trust_anchor": true,
          "ca": "ban-co-yeu-chinh-phu"
        }
      ],
      "chain_complete": true,
      "trusted_root": true,
      "trusted_root_name": "RootCA chuyên dùng Chính phủ G2",
      "certificates_valid_at_signing": true,
      "valid": true
    }
  ],
  "revocation_checked": false
}

Use cases

Check contracts and documents signed by customers before accepting them
Detect PDFs edited after signing in an approval workflow
Extract the signer tax code (MST) and certificate details for records
Verify official documents downloaded from government portals

FAQ

Does it check revocation?

No. The certificate CRL / OCSP addresses are returned in revocation_urls; check them if your process requires it. The result notes revocation_checked: false.

Which certification authorities are trusted?

The roots published by NEAC on rootca.gov.vn (Vietnam National Root CA, G3 and the 2025 roots) with all licensed public CAs, plus the Government specialised CA (Ban Cơ yếu Chính phủ). The list is refreshed weekly.

Is my PDF stored?

No. The file is processed in memory for this request only and is not kept.

PDF Signature Verifier API

Parameters

Example

Response

Use cases

FAQ

Related APIs

Hash Generator

Encode / Decode

Password Generator