For the complete documentation index, see llms.txt. You can also append .md to any page URL to get its markdown version.
Skip to main content
For the complete documentation index, see llms.txt.

For the complete documentation index, see llms.txt

Estonian ID-card signing

Signicat's ESTEID signing method enables certificate-based electronic signatures with an Estonian ID card. Signing with ESTEID is supported through the Sign API v2 PKISIGNING flow. This guide details how to configure and invoke the flow.

Note

This guide focuses on electronic signing. To learn more about the identity provider and authentication, see our Estonian ID-card documentation.

Supported capabilities​

CapabilitySupport
VendorESTEID
Signing flowPKISIGNING
Input formatPDF (application/pdf)
Result formatPAdES-BASELINE-LT (application/pdf)
Multiple documentsSupported; one signed PDF is produced for each input PDF.
Packaging with packageToNot supported.
Note

Estonian ID-card signing accepts PDF documents only.

Signer requirements​

The signer needs all of the following:

  • an Estonian ID card with a valid and enabled signing certificate
  • a compatible card reader and supported ID card software or browser integration
  • the card's PIN2.

Signing setup​

In your HTTP POST request to the Signing sessions endpoint, set the signingSetup parameter as follows:

[
  {
    "vendor": "ESTEID",
    "signingFlow": "PKISIGNING",
    "identityProviders": [],
    "requestedAttributes": [
      "nin"
    ]
  }
]

Signer attributes​

The verified signer name and identity provider name are returned by default. The national identity number is returned only when nin is requested.

Requested valueOutput fieldDescription
ninoutput.userInfo.ninEstonian personal identification code
Note

The Estonian ID-card signing certificate does not contain a date of birth attribute.

Attribute response​

Output fieldDescription
signingTimeSignature time in ISO 8601 format, including an offset when available
fullName, firstName, lastNameVerified signer name
idpNameesteid
ninEstonian personal identification code; present when requested
uniqueIdETSI EN 319 412-1 natural person identifier in the format <type><country>-<identifier>; for Estonian ID-card, for example PNOEE-49001010033
extraValues under extra, including client IP and user agent.

Restrict signing to a known person​

To require a particular Estonian personal identification code, request nin and enable national identity number validation:

[
  {
    "signer": {
      "nationalIdentificationNumber": "49001010033",
      "prefill": [],
      "validations": [
        "NATIONAL_IDENTIFICATION_NUMBER"
      ]
    },
    "signingSetup": [
      {
        "vendor": "ESTEID",
        "signingFlow": "PKISIGNING",
        "identityProviders": [],
        "requestedAttributes": [
          "nin"
        ]
      }
    ]
  }
]

The session is rejected if the identity number in the Estonian ID-card signing result differs from the configured value. Setting nationalIdentificationNumber without "validations": ["NATIONAL_IDENTIFICATION_NUMBER"] does not enforce a match. Identity prefill is not supported because the signer is identified by the card used during the signing ceremony.

Signing result​

A completed session contains one PAdES result (PAdES-BASELINE-LT) for each signed input document:

{
  "lifecycle": {
    "state": "SIGNED",
    "stateIsFinal": true
  },
  "output": {
    "signatures": [
      {
        "resultDocumentId": "01a08ac4-37a4-79e1-9bc7-b8eb37295b13",
        "originalDocumentId": "01a08ac1-b34c-72c7-86af-1e80e87c8537",
        "signatureType": "PADES"
      }
    ],
    "packages": [],
    "userInfo": {
      "signingTime": "2026-08-11T14:24:18+03:00",
      "fullName": "Mari Tamm",
      "idpName": "esteid",
      "nin": "49001010033",
      "uniqueId": "PNOEE-49001010033",
      "firstName": "Mari",
      "lastName": "Tamm",
      "extra": {
        "client-ip": "203.0.113.42",
        "user-agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/148.0.0.0 Safari/537.36"
      }
    },
    "seals": []
  }
}

Use resultDocumentId to retrieve the signed PDF. For multiple documents, match each result to its input using originalDocumentId rather than array order.

Limitations​

  • The ESTEID vendor can currently be enabled only for sandbox accounts.
  • Only PDF documents are supported.
  • packageTo cannot be used with Estonian ID-card PKISIGNING.

Test accounts​

The Estonian ID-card signing method does not provide a personal-code-only simulator. Testing the signing functionality requires a physical Estonian test ID card.

Additional resources​

On this page