Skip to main content
POST /v1/certify Apply a PKCS#7 detached digital signature to a PDF. This cryptographically proves the document has not been tampered with since certification and identifies the certifier. 
Authorization: Bearer forme_sk_...

​
Request Body

FieldTypeRequiredDescription
pdfstringYesBase64-encoded PDF bytes
certificatePemstringYes*X.509 certificate in PEM format
privateKeyPemstringYes*RSA private key in PEM format (PKCS#8)
certificateIdstringNoID of a saved certificate (hosted API only). Use instead of inline PEM.
reasonstringNoCertification reason (e.g., “Approved”, “Reviewed”)
locationstringNoCertification location (e.g., “San Francisco, CA”)
contactstringNoCertifier contact information
visiblebooleanNoShow a visible signature annotation on the page (default: false)
xnumberNoX coordinate in points from the left edge (for visible signatures)
ynumberNoY coordinate in points from the bottom edge (for visible signatures)
widthnumberNoWidth of the visible signature in points (default: 200)
heightnumberNoHeight of the visible signature in points (default: 50)
*Either certificatePem + privateKeyPem or certificateId is required.

​
Using Inline Certificates

Pass the certificate and private key directly in the request body: 
curl -X POST https://api.formepdf.com/v1/certify \
  -H "Authorization: Bearer forme_sk_abc123..." \
  -H "Content-Type: application/json" \
  -d "{
    \"pdf\": \"$(base64 -w0 contract.pdf)\",
    \"certificatePem\": \"$(cat cert.pem)\",
    \"privateKeyPem\": \"$(cat key.pem)\",
    \"reason\": \"Approved\",
    \"location\": \"San Francisco, CA\",
    \"contact\": \"legal@acme.com\"
  }" \
  --output certified-contract.pdf

​
Using Saved Certificates

On the hosted API, you can save certificates in Credentials and reference them by ID. This avoids sending private keys in every request. 
curl -X POST https://api.formepdf.com/v1/certify \
  -H "Authorization: Bearer forme_sk_abc123..." \
  -H "Content-Type: application/json" \
  -d "{
    \"pdf\": \"$(base64 -w0 contract.pdf)\",
    \"certificateId\": \"clxyz...\",
    \"reason\": \"Approved\"
  }" \
  --output certified-contract.pdf
Saved certificates are not available on self-hosted instances. Pass certificatePem and privateKeyPem directly.

​
Response

200 OK with Content-Type: application/pdf — the certified PDF.