Signing certificate

When every party has signed, sajn seals the document and appends a signing certificate (Signeringscertifikat) to the end of the PDF. The certificate is part of the signed file, not a separate download. It travels with the document, and the same PAdES seal covers it. The certificate is written in the document’s language and every timestamp is Swedish time (Europe/Stockholm).

​

Document facts

The first section identifies the document itself: Set the responsible person with responsibleUserId when you create or update the document, or with Ansvarig in the document settings. It defaults to the creating user, so the row names the creator unless you set it to someone else.

​

Parties

Each party that signed gets its own block. Which rows appear depends on the signing method: A green badge next to the name means an eID vouched for that identity, either as the signature itself or as a verified gate in front of it. The visual signature appears beside each party: the drawn or typed signature mark for click-to-sign and drawn signatures, or the scheme’s logo for BankID and other eID methods.

​

Verification block

The certificate ends with a QR code and a verification link of the form https://app.sajn.se/verify/VERIFY_TOKEN. Anyone holding the document can scan or open it to confirm the file is the one sajn sealed. The closing paragraphs state the eIDAS basis for the signatures, that the file carries a PAdES seal and timestamp that Adobe Acrobat Reader can check, and that all times are Swedish time.

​

What the signing certificate isn’t

The signing certificate is a summary, not the full record. Two other artifacts carry the detail:

• The signing journal. A separate PDF with the complete event log. Get it with GET /documents/{id}/files/JOURNAL. See Downloading signed documents.
• Embedded evidence files. The sealed PDF carries two attachments inside the PAdES ByteRange: audit-trail.html, the event log up to sealing, and evidence.json, machine-readable evidence data for independent verification. The eID artifacts themselves — the BankID XMLDSig, the OCSP response, the OIDC ID token — are committed to by SHA-256 rather than embedded, so the JSON file discloses nothing the certificate doesn’t already print.

​

Next steps