> For the complete documentation index, see [llms.txt](https://docs.ascertia.com/signinghub-installation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ascertia.com/signinghub-installation/application-settings/signinghubapi.md). # SigningHub Web API Make the following changes in the “**appsettings.Production.json**” file to configure Application Settings for the SigningHub Web API. *** ## **To display the Global Sign Logo under the system tray:** ```json "ShowGlobalSignLogo": "false" ``` For the tag with the “`ShowGlobalSignLogo`” key, set the value to “True”. *** ## **To add signature policy information while performing signatures:** {% code overflow="wrap" %} ```json "SignaturePolicyURI": "" "SignaturePolicyName": "" ``` {% endcode %} 1. For the tag with the “`SignaturePolicyURI`” key, set the value to a valid downloadable link of the signature policy document. 2. For the tag with the “`SignaturePolicyURI`” key, set the value to a name of a signature policy document with extension, which is placed under the default directory in the SigningHub deployment directory at the following path:\ \ *\[SigningHub Deployment Directory]\default\signaturepolicydocuments*\ \ There is a workaround that needs to be done at the ADSS end for verification of EPES signatures, as ADSS is unable to download the document from the provided URI in the signature, due to which the policy document needs to be placed under the policy folder at the following path:\ \ *\[ADSS Installation Directory]/service/policy*\ \ Moreover, the OID and path in the 'policy.properties' file must be added at the following path:\ \ *\[ADSS Installation Directory]/service*\ \ Example:\ **Sample-OID = D:/Deployments/ADSS-Server/service/policy/Sample-Policy-Document.pdf** *** ## To disable Swagger documentation: ```json "EnableSwaggerDocumentation": "false" ``` Set the value of the `EnableSwaggerDocumentation` key to `false` (default) or omit the key to disable Swagger documentation for security reasons. To enable Swagger documentation, set the value of this key to `true`. *** ## **To hide the edit dialogue upon dropping a field** This setting controls the behaviour of the edit dialogue when a field is placed onto a document. When set to **true**, the edit dialogue will not automatically appear after a field is dropped, allowing the user to continue placing fields without interruption. If set to **false**, the edit dialogue will be displayed each time a field is added, prompting the user to configure the field’s properties immediately. ```json "HideEditDialogOnFieldDropped": "false" ``` *** ## **To add signature policy information while performing the signature:** ```json "SignaturePolicyOID": "" ``` For the tag with the “`SignaturePolicyOID`” key, set the value to the signature policy OID according to the policy document. *** ## **To display an error if no RUT value is found in the user identity table:** {% code overflow="wrap" %} ```json "ValidateRUT": "False" ``` {% endcode %} For the tag with the “`ValidateRUT`” key, set the value to “True”, else the system will work as of today and will let the user sign the document. *** ## **To add the '00' IDD prefix (if not already present) in the mobile number:** ```json "MODIFY_MOBILE_NUMBER_FOR_SAM": "true" ``` For the tag with the “`MODIFY_MOBILE_NUMBER_FOR_SAM`” key, set the value “True” SigningHub works as of today by adding the '00' prefix (if not already present) in the mobile number before sending it to the ADSS Server's SAM. If it's “False”, SigningHub will send the mobile number to the ADSS's SAM without any modifications. *** ## **To turn off the default certify policy for individual users:** ```json "DefaultCertifyForIndividualUsers": "true" ``` For the tag with ''`DefaultCertifyForIndividualUsers` '' key, set the value 'True' and SigningHub will work as of today and turn on the certify policy by default for individual users. If it's "False", the SigningHub will turn off the certify policy. *** ## **To turn on Email Address Validation:** ```json "Validate_Email_For_Signing_Authentication": "false" ``` For the tag with "`Validate_Email_For_Signing_Authentication`" key, set the value "True" and SigningHub will enforce users to use the same email address for both login authentication and signing authentication. If it's "False", SigningHub will work as of today, and the users can use a different email address for login authentication and signing authentication. *** ## **To turn off the Auto-opening of the Edit Signature Field dialogue:** {% code overflow="wrap" %} ```json "HideEditDialogOnFieldDropped": "" ``` {% endcode %} For the tag with "`HideEditDialogOnFieldDropped`" key, set the value "True" and SigningHub will turn off the Auto-opening Edit Signature Field dialogue window when the user performs a Signature field drag and drop. If it's "False", SigningHub will work as of today, and the Edit Signature Field dialogue window will open automatically. *** ## **To set the default Workflow Mode for individual users:** ```json "DefaultWorkflowForIndividualUsers": "" ``` For the tag with "`DefaultWorkflowForIndividualUsers`" key, set the value of the workflow mode, SigningHub will set that workflow mode as a default for the individual users. If it's not present, then SigningHub will work as of today and set the workflow mode "ONLY\_OTHERS". There are three types of workflow modes supported in the application. Possible values are "ONLY\_ME", "ME\_AND\_OTHERS" and "ONLY\_OTHERS". *** ## **To set the time zone that is used when sending verification time to the ADSS Server's Verification Service:** ```json "ADSS_SERVER_TIMEZONE": "" ``` For the tag with "`ADSS_SERVER_TIMEZONE`" key, set the value of the time zone. SigningHub will use that time zone when sending verification time to the ADSS Server's Verification Service. If it's not present, it sends the verification time in the UTC time zone. There are three types of time zones supported in the application. Possible values are "GMT+06", "GMT+03" and "GMT+02". *** ## **To perform an XAdES Extended signature for an XML document:** ```json "XADES_SIGNATURE_TYPE": "" ``` For the tag with "`XADES_SIGNATURE_TYPE`" key, set the value "ES-X-L", SigningHub will perform an XAdES Extended signature for backwards compatibility with ADSS Server version 6.9 or lesser. If it's not present, then SigningHub will work as of today and perform the "XAdES-Baseline-LTA" ETSI-compliant signatures. *** ## **To enable user validation for OIDC authentication:** {% code overflow="wrap" %} ```json "ValidateOidcUserEmailAndNationalId": "false" ``` {% endcode %} When `ValidateOidcUserEmailAndNationalId` is set to true: * The system will enforce the following validations during authentication: * The combination of the email address and the national ID of the authenticated user must match the combination of the email address and the national ID present in SigninHub. * The format BID:{USER\_NATIONAL\_ID} will be passed as login\_hint in the authorisation request only if the Login Hint is enabled with the BID value in the OIDC connector. When `ValidateOidcUserEmailAndNationalId` is set to false or the key is not present: * The system will continue to operate under the existing conditions as it does today, without enforcing the specified validations. *** ## **To specify the language file path:** The path for language resource files must be specified using the `LanguageFilePath` configuration in **appsettings.Production.json**. This setting defines the directory from which SigningHub loads language files. ```json "LanguageFilePath": { "Languages": "wwwroot/Languages" } ``` *** ## **To hide password profiles and email password fields** This setting controls the visibility of password profiles and the Email Password field within SigningHub. To hide these options, add the setting to the **appsettings.Production.json** file and set its value to **true**. When enabled, users will not be able to view or configure password profiles or the Email Password field. When set to **false**, these options remain visible and available for use. ```json "HidePasswordProfile": "true" ``` *** ## **To configure the maximum allowed HTTP request content length:** ```json "RequestLimits": { "maxAllowedContentLength": 1024000000 (Default value: 1024000000 bytes) } ``` The `RequestLimits` tag allows you to configure the maximum allowed HTTP request content length for the Web API. The `maxAllowedContentLength` setting specifies the maximum size of the HTTP request body, in bytes, that can be accepted by the API. This setting is used to support large document uploads through SigningHub. This configuration is added to the **web.config** file and **appsettings.Production.json** of the Web API. *** ## **To configure default settings:** The default resource paths for SigningHub must be specified using the 'Default Settings' configuration in **appsettings.Production.json.** This section defines the directories from which SigningHub loads various resources, such as email templates, country and timezone data, logos, fonts, appearances, document templates, and common language files. ```json "DefaultsSettings": { "EmailTemplates": "default/emailtemplates/", "CountryPath": "default/languages/country/", "TimeZonePath": "default/languages/timezone/", "LogoPath": "default/companylogo/", "FontPath": "default/fonts/", "DefaultJsonPath": "default/", "Appearances": "default/appearances/", "EmailLanguagesFolder": "default/languages/emails/", "Document": "default/document/", "CommonLanguagesPath": "default/languages/common/" } ``` *** ## **To validate the allowed audience of JWT:** ```json "ValidateAudience": "false" ``` Set the value of the `ValidateAudience` key to `false` (default) to ignore audience validation. To enforce audience validation against the allowed audience of JWT, set the value of this key to true. *** ## **To enable Kerberos authentication:** Make the following change in the “**web.config**” file for the SigningHub Web API. {% code overflow="wrap" %} ```xml / ``` {% endcode %} For Kerberos authentication, uncomment the location tag above. SigningHub will work as of today and does not allow Kerberos authentication when the location tag is commented out. *** ## **To use the SigningHub administrator API:** Make the following change in the “**web.config**” file for the SigningHub Web API. {% code overflow="wrap" %} ```xml ``` {% endcode %} For SigningHub Admin API usage, uncomment the location tag above. SigningHub will work as of today and is not allowed to use the SigningHub Web APIs when the location tag is commented out. *** ## **To enable TLS/SSL authentication:** Make the following change in the “**web.config**” file for the SigningHub Web API. ```xml ``` For the TLS/SSL authentication, uncomment the above location tag. SigningHub will work as of today and does not allow TLS/SSL authentication when the location tag is commented out. *** ### **To use HashiCorp Vault:** SigningHub Admin API supports retrieving sensitive configuration values securely from HashiCorp Vault instead of specifying them directly in the configuration. To configure HashiCorp Vault, add the following section to **appsettings.Production.json**: ```json "Vault_Configurations": { "HashiCorp": { "Login_Url": "", "Uami_Url": "", "Uami_Name": "", "Uami_Client_Id": "", "Namespace": "" } } ``` For the tag with the **`Login_Url`** key, specify the URL where the HashiCorp Vault can be accessed for authentication and authorisation. For the tag with the **`Uami_Url`** key, specify the URL endpoint associated with the User-Assigned Managed Identity (UAMI) used to authenticate with HashiCorp Vault. For the tag with the **`Uami_Name`** key, specify the name of the User-Assigned Managed Identity (UAMI) used to authenticate with HashiCorp Vault. For the tag with the **`Uami_Client_Id`** key, specify the client ID of the User-Assigned Managed Identity (UAMI) used to authenticate with HashiCorp Vault. For the tag with the **`Namespace`** key, specify the HashiCorp Vault namespace in which the required secrets are stored. Once HashiCorp Vault is configured, it can be used to securely retrieve sensitive values for the following configuration settings: * **`TokenSettings`** * **`ConnectionStrings`** * **`Credentials`** To retrieve a value from HashiCorp Vault for any of these settings, add the **`Vault_Settings`** section to the respective configuration tag and specify the **`Vault_Path`** and **`Secret_Key`** that reference the required secret in HashiCorp Vault. The **`TokenSettings`** tag uses the following **`Vault_Settings`** configuration: ```json "TokenSettings": { "Secret": "", "Vault_Settings": { "Vault_Path": "", "Secret_Key": "" } } ``` The **`ConnectionStrings`** tag uses the following **`Vault_Settings`** configuration: ```json "ConnectionStrings": { "DBConnectionString": "", "Vault_Settings": { "Vault_Path": "", "Secret_Key": "", "Secret_Key_Type": "" } } ``` The **`Credentials`** tag uses the following **`Vault_Settings`** configuration: ```json "Credentials": { "ClientId": "", "ClientSecret": "", "Vault_Settings": { "Vault_Path": "", "Secret_Key": "" } } ``` When **`Vault_Settings`** is configured, SigningHub retrieves the corresponding sensitive value from the specified HashiCorp Vault location instead of using the value provided directly in the relevant configuration field. {% hint style="info" %} For **`Credentials`**, the configuration must be added to the **appsettings.Production.json** files of the **Web** application. {% endhint %} *** ### **To configure connection strings** The **ConnectionStrings** section is used to configure the database connection required by SigningHub. These settings can be configured in **appsettings.Production.json**. ```json "ConnectionStrings": { "DBConnectionString": "data source=192.168.3.45;initial catalog=SH10-Core-QA2;user id=sa;password=p@ssword12;Max Pool Size=3000;Min Pool Size=100;MultipleActiveResultSets=True;Pooling=true;TrustServerCertificate=True", "DBProvider": "SQL", "Vault_Settings": { "Vault_Path": "", "Secret_Key": "", "Secret_Key_Type": "" } } ``` The **`DBConnectionString`** field specifies the connection string used to connect SigningHub to the database. The **`DBProvider`** field specifies the database provider used by SigningHub. The **`Vault_Settings`** section allows the database connection string to be retrieved securely from HashiCorp Vault instead of specifying it directly in the **`DBConnectionString`** field. For the tag with the **`Vault_Path`** key, specify the path to the secret in HashiCorp Vault. For the tag with the **`Secret_Key`** key, specify the key of the secret to retrieve from the specified Vault path. For the tag with the **`Secret_Key_Type`** key, specify the type of secret stored in HashiCorp Vault. When **`Vault_Settings`** is configured, SigningHub retrieves the database connection string from the specified HashiCorp Vault location. Otherwise, the value specified in **`DBConnectionString`** is used. {% hint style="info" %} The **`Vault_Settings`** subtag is not added by default and must be manually added to the configuration when retrieving the database connection string from HashiCorp Vault. {% endhint %}