Signed PDFs and certificates

What you get when everyone signs, how to download it, and how anyone can check a signed PDF.

The signed PDF

When the last signer signs, squiggli draws every signature and value onto the documents and joins them into one PDF, with a footer on each page naming the envelope. Download it with GET /v1/envelopes/{id}/signed.pdf, or use files.signed_pdf_download from the envelope or the completed webhook: a link that works without a key for 7 days.

The completion certificate

GET /v1/envelopes/{id}/certificate.pdf. It records:

• the envelope, who sent it, and when it was sent and completed;
• each document's SHA-256 hash as sent, and the signed PDF's hash;
• each signer: name, email, how they were identified, when they first viewed and signed, IP address, device and their signature;
• the exact agreement and intent wording they accepted;
• the full audit trail, in order.

Verifying a signed PDF

Anyone can check a signed PDF hasn't been changed at https://squiggli.billy-965.workers.dev/verify: the browser works out the file's SHA-256 and squiggli checks it. The file never leaves their device. You can do the same from code:

curl https://squiggli.billy-965.workers.dev/api/verify -H "Content-Type: application/json" \
  -d "{ \"sha256\": \"$(shasum -a 256 signed.pdf | cut -d' ' -f1)\" }"

Keeping records

Sent envelopes, their documents, signatures, certificates and audit trails can't be deleted through squiggli and are kept while the account is open. Download and store your own copies as well, so they stay complete wherever you keep records.