Get verified signer identities
The identity each eID actually verified, per signature — as opposed to the signer details the sender entered when creating the document.
Why this is a separate endpoint: party.nationalId is what the sender supplied. It is never overwritten with what the eID returned, so the two can differ, and this is where you read the verified one.
One shape for every eID. Keys are always present and null when a scheme issues nothing, so you never branch on provider to find where the identity lives:
identity.nationalId— the national identity number, masked per the workspace’s national ID display setting. Null for schemes that issue none: MitID without CPR scope, MitID Erhverv, and iDIN, which may never expose a BSN.identity.serialNumber— always present. A stable, non-sensitive reference for this person at your organization. Use it to recognise a returning signer without ever handling a national id. Scoped per organization, so the same person yields a different value for a different customer.identity.match— whether the verified identity matched the intended signer. Computed before masking, so it stays meaningful even whennationalIdis hidden by policy.
identity is null for drawn and click-to-sign signatures: nothing verified an identity.
Permissions: requires the READ_DOCUMENT workspace permission and the signatures:read scope. documents:read alone never returns a national identity number.
Auditing: every call is recorded on the organization audit log — who read a verified identity and when. The identity values themselves are never logged.
Authorizations
Personal API key, e.g. Authorization: Bearer sajn_sk_.... Not scope-limited — acts as the issuing user.
Headers
API version for this request. Without it, the request uses the organization's default version; an organization without a default is pinned to the latest version by its first request.
2026-09, 2026-10 ID of the workspace this request acts in, from GET /api/v1/workspaces. Without it, an API key acts in its default workspace. The token's user must be a member of the workspace; an OAuth token only accepts the workspace it was granted for. A workspace that doesn't exist or can't be reached returns 403 WORKSPACE_ACCESS_DENIED.
Path Parameters
The document ID.

