seal.ID FAQ (Integration)

Placing a visual signature

seal.ID offers the possibility to place visual signatures on the signed documents. This visual element consists of:

Field	Madatory	Note
Signer name	No	Possible values: - None - Initial data (Name submitted to application) - Verified data (Name entered by verification agent)
Timestamp	Yes	Format: dd.mm.yyy, hh:mm:ss
Image file	No	Will be placed behind the text

Example Image of a visual signature:

API call to request the visual signature

How to verify incoming webhooks via shared secret

Incoming webhook notifications will received like the following example:

{
	"method": "POST",
	"path": "/",
	"query": {},
	"client_ip": "13.229.246.66",
	"url": https://f18b0b50eae160f9d498b32d9cefca7d.m.pipedream.net/,
	"headers": {
		"host": "f18b0b50eae160f9d498b32d9cefca7d.m.pipedream.net",
		"content-length": "419",
		"user-agent": "ReactorNetty/0.9.7.RELEASE",
		"accept": "*/*",
		"ubiid-notification-signature": "ZAnC8ytlYUn3xUojxg6xVsFb1HHUIkM4cBOD4NJUcdk83DHWSAvHXLEnJiVZASQHAVjgTs+VuaQAaGKxGZvlIg==",
		"ubiid-notification-timestamp": "20221115T090914Z",
		"x-ubiid-notification-signature": "ZAnC8ytlYUn3xUojxg6xVsFb1HHUIkM4cBOD4NJUcdk83DHWSAvHXLEnJiVZASQHAVjgTs+VuaQAaGKxGZvlIg==",
		"x-ubiid-notification-timestamp": "20221115T090914Z",
		"content-type": "application/json"
	},
	"bodyRaw": "{\"id\":\"4619d136-7fac-41fa-9755-49dd7648ff85\",\"tenantId\":\"7703f5e2-4494-4b2c-8fbe-4e9795042a07\",\"ubiIdCaseId\":\"4e9aae75-1f9f-4179-abe5-449a72b4da52\",\"extPersonId\":\"\",\"identityProfile\":1,\"language\":\"DE\",\"extCaseId\":null,\"extApplication\":null,\"ubiIdCategory\":\"Standard\",\"status\":\"IDENTIFICATION_SUCCESSFUL\",\"ubiIdStatusReason\":null,\"ubiIdStatusDetails\":null,\"createdTime\":\"20221115T090914Z\",\"qTSPstatus\":\"NO_REGISTRATION\"}",
	"body": {
		"id": "4619d136-7fac-41fa-9755-49dd7648ff85",
		"tenantId": "7703f5e2-4494-4b2c-8fbe-4e9795042a07",
		"ubiIdCaseId": "4e9aae75-1f9f-4179-abe5-449a72b4da52",
		"extPersonId": "",
		"identityProfile": 1,
		"language": "DE",
		"extCaseId": null,
		"extApplication": null,
		"ubiIdCategory": "Standard",
		"status": "IDENTIFICATION_SUCCESSFUL",
		"ubiIdStatusReason": null,
		"ubiIdStatusDetails": null,
		"createdTime": "20221115T090914Z",
		"qTSPstatus": "NO_REGISTRATION"
	}
}

Steps that need to be done to verify the Webhook

1. Get the Timestamp

In this example:

20221115T090914Z

1. Append the String with a “|”

In this example:

20221115T090914Z|

1. Append the String with the JSON of the payload (body)

2. Remove all empty spaces and line-breaks to have the JSON in one string

In this example:

{"id":"4619d136-7fac-41fa-9755-49dd7648ff85","tenantId":"7703f5e2-4494-4b2c-8fbe-4e9795042a07","ubiIdCaseId":"4e9aae75-1f9f-4179-abe5-449a72b4da52","extPersonId":"","identityProfile":1,"language":"DE","extCaseId":null,"extApplication":null,"ubiIdCategory":"Standard","status":"IDENTIFICATION_SUCCESSFUL","ubiIdStatusReason":null,"ubiIdStatusDetails":null,"createdTime":"20221115T090914Z","qTSPstatus":"NO_REGISTRATION"}

⚠️ Fields with value "null" also have to be included ⚠️

1. Append the previous string with the payload string

In this example:

20221115T090914Z|{"id":"4619d136-7fac-41fa-9755-49dd7648ff85","tenantId":"7703f5e2-4494-4b2c-8fbe-4e9795042a07","ubiIdCaseId":"4e9aae75-1f9f-4179-abe5-449a72b4da52","extPersonId":"","identityProfile":1,"language":"DE","extCaseId":null,"extApplication":null,"ubiIdCategory":"Standard","status":"IDENTIFICATION_SUCCESSFUL","ubiIdStatusReason":null,"ubiIdStatusDetails":null,"createdTime":"20221115T090914Z","qTSPstatus":"NO_REGISTRATION"}

1. Calcluate the hmac-sha512 using the provided shared secret which results in a HEX output

In this example:

6409c2f32b656149f7c54a23c60eb156c15bd471d4224338701383e0d25471d93cdc31d6480bc75cb1272625590124070158e04ecf95b9a4006862b1199be522

1. Convert the HEX output to ASCII

In this example:

d	Âó+eaI÷ÅJ#ƱVÁ[ÔqÔ"C8pƒàÒTqÙ<Ü1ÖHÇ\±'&%Y
$
XàNϕ¹¤hb±›å"

1. Convert the ASCII String to Base64 (UTF-8 with Unix EOL)

In this example the calculated result should be:

ZAnC8ytlYUn3xUojxg6xVsFb1HHUIkM4cBOD4NJUcdk83DHWSAvHXLEnJiVZASQHAVjgTs+VuaQAaGKxGZvlIg==

1. Compare the result with the string we provide in the webhook notification

2. If both strings match, the notification is verified