Developer SDK

Platform REST surface and the client SDK that drives every signing ceremony

REST endpoints

Exposed to the browser through the /backend/* proxy

Method	Path	Role required	Description
GET	/api/session	Public	Current session: username, display name, designation, roles and enrolled credentials.
GET	/api/dashboard	officer	Workstation KPIs. "Today" is IST, and mean approval time is computed by the database.
GET	/api/files	officer	File inbox. Filters status, priority, q; paged with page and size (max 100). Filtering and ordering happen in SQL.
GET	/api/files/{id}	officer	File detail including body text and the full noting sheet.
POST	/api/files/{id}/action	approver	Record APPROVE / REJECT / RETURN. APPROVE requires a 64-hex SHA-256 digest. Returns 409 if the file is no longer pending.
GET	/api/audit	officer	Audit ledger, paged with page and size (max 200). Returns total and hasMore.
GET	/api/audit/integrity	auditor	Recomputes the hash chain in the database and reports whether it is intact, and where it breaks.
GET	/api/devices	officer	Signing device inventory. Filter: state.
POST	/api/devices/{id}/revoke	administrator	Revokes a device and its bound credential, so it can no longer authenticate. Requires a reason.
POST	/api/verify	Public	Resolve a document hash against the approval record. Public by design, rate limited to 20 per minute per caller. Each step reports whether it is REAL or SIMULATED.
POST	/q/webauthn/register	Public	WebAuthn attestation ceremony — driven by the SDK, not called directly.
POST	/q/webauthn/login	Public	WebAuthn assertion ceremony — driven by the SDK, not called directly.

SDK functions

@mobilesigner/web-sdk · MobileSignerWebSdk

Signature	Description
subscribe(listener: SdkEventListener): () => void	Registers a lifecycle listener and returns its unsubscribe function. Drives the live SDK trace panel.
getCapabilities(): Promise<Capabilities>	Probes secure context, WebAuthn support, ceremony client and platform authenticator availability.
registerCredential(req: RegistrationRequest): Promise<Session>	Runs the attestation ceremony and enrols the hardware token for an officer. One credential per officer.
authenticate(req: AuthenticationRequest): Promise<Session>	Runs the assertion ceremony; user verification is performed on the token.
getSession(): Promise<Session>	Reads the current server-side session without touching the authenticator.
signFile<T>(req: SignFileRequest): Promise<SignFileResult<T>>	Primary operation. Hashes the document, binds the digest to the identity, appends the noting, and returns the refreshed file with measured hash, request and total timings.
logout(): Promise<void>	Ends the signing session and clears the server-side credential context.
installBridge(opts?): MobileSignerBridge	Installs window.MobileSigner so a host page or WebView can drive the same ceremony without importing the package. Idempotent.

Developer Experience

Two shipped integration paths

A global for host pages that cannot import a package, and a typed npm package for applications that can. Both drive the same ceremony through the same SDK.

Installed by the workstation on the file screen. No import, no build step.

javascript

// Any page in a WebView or an existing portal. The global is installed by
// the SDK via installBridge(); no bundler and no framework required.

const signer = window.MobileSigner;

// Secure context + WebAuthn + ceremony client all present?
if (!(await signer.isAvailable())) {
  return showFallback('This device cannot run a signing ceremony.');
}

// Establishes a session if there is not one. Prompts for the security key.
await signer.authenticate('demo.user');

const result = await signer.sign({
  fileId: 3,                      // GovFile id
  action: 'APPROVE',              // or 'REJECT' | 'RETURN'
  note: 'Sanction accorded for the Q2 instalment.',
  document: documentText          // hashed in the browser with SHA-256
});

if (result.ok) {
  result.documentHash;            // 64 hex chars, bound to the officer
  result.durationMs;              // measured end to end
  result.timings;                 // { hashMs, requestMs, totalMs }
  result.file;                    // refreshed file, including the new noting
} else {
  result.code;                    // CEREMONY_CANCELLED, AUTHENTICATION_REQUIRED, …
  result.message;
}

Verified against this deployment only. There is no integration with NIC eOffice, MCA21, EPFO or the GST portal — the eFile workflow is reproduced faithfully, but nothing is wired to those systems.