BankID — Sign flow

BankID signing works like auth — only the start endpoint differs, and /sign passes your body to BankID unchanged, so you base64-encode the texts yourself.

1. Start the sign order

curl -X POST https://sandbox-api.cerrtify.com/service/bankid/sign \
  -H "X-API-Key: cert_..." \
  -H "Content-Type: application/json" \
  -d '{
    "endUserIp": "192.168.0.1",
    "userVisibleData": "QXBwcm92ZSB0aGUgdHJhbnNmZXIgb2YgNTAwIFNFSyB0byBBY21l",
    "userNonVisibleData": "<base64 of the canonical document>"
  }'

• userVisibleData — what the user sees in the BankID app, base64-encoded by you (UTF-8 text; the example is "Approve the transfer of 500 SEK to Acme"). At most 1 500 characters after encoding. Unlike /auth, the server does not encode it for you.
• userNonVisibleData — base64'd binary the user isn't shown but the signature commits to. Optional.

2. Render QR + collect

Show the QR exactly as for auth — GET /service/bankid/qr-code?orderRef=… works for sign orders too (BankID — QR code) — and poll /collect as in the auth flow. On complete, the completionData.signature field carries the BankID signature you persist.