# eContract Verify

> Free web tool and API by eContract that checks the digital signatures in a PDF: who signed, when, whether the signed bytes changed, the signature, the certificate chain embedded in the PDF and certificate validity dates. No account, no API key.

eContract Verify (https://verify.econtract.online) reads every digital signature in an uploaded PDF and reports, per signature:

- Signer (name, email, organization, country from the certificate subject), signing time and reason
- Integrity: the SHA-256 hash of the signed byte range matches the digest in the signature, so the signed content was not changed
- Signature: the RSA signature verifies with the signer's certificate
- Certificate chain: each certificate embedded in the PDF is signed by the next one, up to a root
- Certificate validity: signer and chain certificates are within their validity dates today
- RFC 3161 timestamp, when present: TSA name, time and hash algorithm (shown, not cryptographically verified)

Limits of the check, so answers stay accurate:

- The chain is not compared with a trust list (Adobe AATL, EU trusted lists): a self-signed certificate can pass. A "valid" result says the signed bytes and signature are intact, not that the signer is trusted.
- Changes saved after signing as a new PDF revision are outside the signed bytes and are not flagged.
- Only RSA keys with SHA-256 can be checked; other algorithms (ECDSA, SHA-384, ...) are reported as invalid.
- The tool reports technical facts. Whether a signature has legal effect depends on the jurisdiction and the type of signature.
- The PDF is processed in memory and not stored; server logs record the file name and size.

## API

- Endpoint: `POST https://api.econtract.online/verify-pdf`
- Body: `multipart/form-data` with the field `file` (the PDF, up to 50 MB)
- Authentication: none (public endpoint)
- Rate limit: 50 requests a day per IP address (`429` when exceeded)
- Errors: `400` with `"error": "INVALID_FILE"` when no file is sent or the file is not a PDF

```
curl -X POST https://api.econtract.online/verify-pdf -F "file=@document.pdf"
```

Response (JSON): `document` (`filename`, `hash` as `sha256:<hex>`, `size`, `tampered`), `signatures[]` (`signer`, `signed_at`, `reason`, `verdict`: `valid`, `tampered`, `invalid_signature`, `invalid_chain`, `expired` or `invalid`; booleans `integrity`, `signature`, `chain`, `expired`; `certificate` with `subject`, `issuer`, `valid_from`, `valid_until`; optional `timestamp`, `errors`, `warnings`), `summary` (`total`, `valid`, `invalid`, `verdict`: `all_valid`, `some_invalid`, `all_invalid` or `no_signatures`), `verified_at`, `verified_by`.

## Links

- [Verify tool](https://verify.econtract.online/): upload a PDF in the browser
- [Verify API reference](https://developers.econtract.online/docs/api/public-verify/PublicVerifyController_verifyPdf): request and response schema with code samples
- [OpenAPI document](https://api.econtract.online/api/v1/openapi.json): the public eContract API, including `/verify-pdf`
- [eContract developer docs](https://developers.econtract.online/llms.txt): REST API, OAuth 2.1, webhooks and the MCP server (its `verify_pdf` tool runs the same check)
- [eContract](https://econtract.online): the e-signature platform