Validation API

Machine interface for the same governed validation as the public form.

Service status

Advanced (non-qualified) validation service. Optional ETSI Signature Validation Report (svr=true) is not a qualified validation report under eIDAS. EU-path qualification follows DSS / ETSI TS 119 615 when the worker TL source is ready; see the Validation Policy (policy id VP-1.1).

Endpoint

POST https://api.fidelir.com/v1/validate

api.fidelir.com is the only public Fidelir HTTP API. Integrate against it. One request, one file. Maximum 25 MB after decode. PDF (PAdES), ASiC, XAdES and CAdES. The connection is held until validation finishes (up to 120 seconds). Scope and indications follow the Validation Policy.

Legacy path — trust.fidelir.com/api/v1/validate

The identical endpoint on this host is deprecated and kept only for dual-run. It answers the same responses from the same engine and will remain available for at least two releases after api.fidelir.com became primary. New integrations must not use it; existing ones should change the host and nothing else.

Authentication

Anonymous calls are accepted: send no Authorization header. Billable calls carry either a scoped API key (Authorization: Bearer fld_…, created in My Fidelir → Organizations → API keys, scope validate) or a short-lived browser ticket minted by My. API keys are for machines; never put one in browser JavaScript.

Multipart

Form field file. Same encoding as the public upload form. 

curl -sS -X POST -F "file=@document.pdf" https://api.fidelir.com/v1/validate

JSON

Content-Type: application/json. Property file is Base64 (line breaks allowed). Optional filename. The HTTP body may be up to 36 MB so a 25 MB document still fits after Base64. 

curl -sS -X POST -H "Content-Type: application/json" -d '{"filename":"document.pdf","file":"<base64>"}' https://api.fidelir.com/v1/validate

Optional

  • Form field or JSON property detailed=true — include the DSS detailed report XML (internal DSS diagnostic tree; not the ETSI SVR).
  • Form field or JSON property svr=true — include the ETSI TS/EN 319 102-2 Signature Validation Report XML in result.signatureValidationReportXml (not result-cached).
  • Header Idempotency-Key — retry the same POST with the same key (max 128 characters).

TS 119 442 protocols

Machine interfaces aligned with ETSI TS 119 442 (same engine and Validation Policy as the product interface). Reports are not qualified validation reports under eIDAS.

  • POST https://api.fidelir.com/v1/etsi/validate — validation protocol (JSON or XML; profile …/validationprotocol#; SVR always returned). Supports embedded documents, detached sigObj, docHash, transformed, and attachments for attRef (no remote fetch).
  • POST https://api.fidelir.com/v1/etsi/augment — augmentation protocol (JSON; profile …/augmentationprotocol#; optInp.targetLevel e.g. B-T / B-LTA).
  • POST https://api.fidelir.com/v1/etsi/validate-and-augment — combined protocol (JSON; profile …/validationAndAugmentationprotocol#). 
curl -sS -X POST -H "Content-Type: application/json" -d '{"profile":["http://uri.etsi.org/19442/v1.1.1/validationprotocol#"],"reqID":"demo","inDocs":{"doc":[{"ID":"document.pdf","b64Data":{"val":"<base64>"}}]}}' https://api.fidelir.com/v1/etsi/validate

Responses

  • 200 — finished (status is completed or failed)
  • 400 — empty file or invalid request
  • 405 — method other than POST
  • 413 — over 25 MB decoded, or JSON body over 36 MB
  • 429 / 503 / 504 — rate limit, queue, or wait cap; honour Retry-After

A completed job with overallIndication NO_SIGNATURES means the file was processed and no signatures were found — not a transport error. Cryptographic pass is not a statement of legal effect.