Qualified Signature Flow

Browser Interaction

sequenceDiagram
    participant Browser
    participant API as API-Gateway
    participant PdfAs as PDF-AS
    participant ATrust as A-Trust
    autonumber
    Browser->>API: Send PDF to sign
    loop Sanity Check
        API->>API: Check if uploaded file is valid
    end
    API->>PdfAs: Send PDF to sign
    PdfAs->>ATrust: Demand signing process
    ATrust-->>PdfAs: Deliver signing request parameters
    PdfAs-->>API: Deliver signing request redirect URL
    API-->>Browser: Deliver redirect URL with `reqId`
    Browser->>PdfAs: Get form in iFrame
    PdfAs-->>Browser: Send form with automatic execution
    Browser->>ATrust: Redirect to A-Trust
    ATrust-->>Browser: Send Form for credentials in iFrame
    Browser->>ATrust: Send crendentials from iFrame
    ATrust-->>Browser: Send Form for 2FA in iFrame
    Browser->>ATrust: Send 2FA, Waiting for result
    Note over PdfAs, ATrust: Security Layer Communication<br> Create Signature
    ATrust-->>Browser: Deliver redirect URL
    Browser->>PdfAs: Redirect to PDF-AS in iFrame
    PdfAs-->>Browser: Deliver URL with to static callback
    Browser->>API: Redirect to static callback <br> invokeURL in iFrame
    API-->>Browser: Send `sessionId` to frame <br> parent in browser to download file
    Browser->>API: Send `sessionId`
    API->>PdfAs: Send `sessionId`
    PdfAs-->>API: Send signed PDF
    API-->>Browser: Deliver signed PDF

Security Layer Communication

sequenceDiagram
    participant PdfAs as PDF-AS
    participant ATrust as A-Trust
    autonumber
    PdfAs->>ATrust: Request certificate data
    ATrust-->>PdfAs: Send certificate data
    PdfAs->>ATrust: Request for signature from mobileBKU
    ATrust-->>PdfAs: Send signature response
    loop Signature Check
        PdfAs->>PdfAs: Check if signatures are valid
    end
    PdfAs->>ATrust: Send redirect URL for Browser with `sessionId`

Browser Javascript API

The response of calling /esign/qualified-signing-requests contains a url property which, in the context of a browser can be loaded in a new windows or an iframe and will redirect the user to the handy-signatur.at authentication page. After the authentication is finished the windows will forward a result to the window creator via the postMessage() API.

In case the authentication succeeded, the response is:

{
    type: 'pdf-as-callback',
    code: '<code>',
    sessionId: '<sessionId>' // deprecated, use "code" instead
}

The code can be used to retrieve the signed document via the /esign/qualifiedly-signed-documents endpoint.

In case of an error, the response is:

{
    type: 'pdf-as-error',
    error: '<A readable description of the error>',
    cause: '<Cause of the error, usually empty>',
}

The error property can be shown to the user.