API Sigalion
Build timestamping and verification into your applications: RFC 3161 timestamping, free or qualified eIDAS, and verification of signatures and timestamps.
API keys are created in your Client Area and let you use your qualified timestamp credits.
To use the API without Sigalion Vault, for professional purposes, we open dedicated API accounts, with no software licence. For such an account, heavy use or a custom integration, write to us at contact@sigalion.fr.
Service endpoints
Both endpoints follow the RFC 3161 protocol and can be used as they are in Acrobat, OpenSSL or any signing tool.
Sigalion timestamping
Free, no account. Up to ten tokens in a row, then one per minute.
No availability guarantee. These limits may change. See the terms and conditions.
https://api.sigalion.fr/tsa
eIDAS qualified timestamping
API key, one credit per token.
https://api.sigalion.fr/tsa/qualified/auto(the first available provider)https://api.sigalion.fr/tsa/qualified/certigna(Certigna)
Verification and account balance
Two JSON routes complement the timestamping addresses.
Verify a timestamp or a signature
Free, no key. The document never leaves your machine: you send the token or the signature and, if you want to check that it matches, the SHA-256, SHA-384 and SHA-512 digests of the document. The response tells whether the proof is valid, who issued it, and whether it is qualified under eIDAS according to the EU Trusted Lists, at its date.
Up to 30 verifications in a row, then one every 2 seconds; 1 MB at most per request.
No availability guarantee. These limits may change. See the terms and conditions.
POST https://api.sigalion.fr/v1/verify
curl https://api.sigalion.fr/v1/verify \
-H "Content-Type: application/json" \
-d "{\"kind\":\"token\",\"token\":\"$(openssl base64 -A -in jeton.tst)\"}"Response, excerpt:
{"kind":"timestamped",
"timestamp":{"verdict":"valid","time":"2026-03-16T21:34:36Z",
"authority":{"name":"Sectigo Limited","country":"GB"},"level":"standard"}}Account balance
With an API key, in Basic authentication (the key as username, no password): the number of remaining timestamp credits, to monitor an integration in production.
GET https://api.sigalion.fr/v1/account/balance
Response:
{"credits_remaining": 9, "account_type": "individual"}Sigalion root certificate
Tokens from the free service are signed under our own certification authority. The Sigalion applications and the Verify page already embed this root, so they need no installation. Any other tool, OpenSSL, a PDF reader or a system certificate store, does need it: the token already carries the signer's certificate and the intermediate authority.
Root in PEM format (OpenSSL, curl, libraries, the Linux certificate store) or DER (the Windows certificate store). Both files contain the same certificate, and macOS accepts either one.
SHA-256 fingerprint: A0:DF:11:28:7F:DD:6A:C8:6D:D6:E2:8F:29:28:03:7D:B8:5B:8A:E4:9E:73:9C:AF:F0:93:BE:5C:D1:1B:1F:93
This authority is not eIDAS qualified. Qualified timestamping is issued by qualified trust service providers, which are recognised in the trusted lists of the Member States, and Sigalion verifies it without requiring any installation.
Card manufacturers and certification authorities
The Vault Diagnostics tab reads smart cards, keys and certificates on macOS, Windows and Linux, then tests signing and decryption. Vault supports IAS-ECC cards with the IDOpte middleware and YubiKey and Nitrokey keys in PIV mode.
Do you make cards or issue certificates, and want your media to work with Vault? Write to us at contact@sigalion.fr to have them tested.