Seal a PDF without uploading it

An embedded PDF seal normally means uploading the PDF, because building a PAdES signature requires modifying the document. Delegated sealing removes that requirement: the SDK prepares the signature structure locally, sends only the ByteRange SHA-256 digest, and embeds the returned cryptographic container itself. The PDF never leaves your environment.

Prerequisites

• An API key (Settings → API Keys) and a certificate id (Settings → Certificates — the platform certificate works out of the box).
• pip install sigill-sdk (0.3.0+) or dotnet add package Sigill.Sdk (0.3.0+).

Seal

Python:

from sigill_sdk import SigillClient

client = SigillClient(api_key="sigill_...")
pdf = open("contract.pdf", "rb").read()

result = client.seal_pades(pdf, certificate_id=CERT_ID,
                           label="contract.pdf", qualified=True)

open("contract_sealed.pdf", "wb").write(result.sealed_pdf)
print(result.format)   # "pades-b-lta" | "pades-b-lt" | "pades-b-t" | "pades-bes"

.NET:

using Sigill.Sdk;

using var client = new SigillClient("sigill_...");
var pdf = await File.ReadAllBytesAsync("contract.pdf");

var result = await client.SealPadesAsync(pdf, certId,
    new PadesSealOptions { Label = "contract.pdf", Qualified = true });

await File.WriteAllBytesAsync("contract_sealed.pdf", result.SealedPdf);

One call runs the whole ladder: the SDK computes the ByteRange digest locally, sigill.ai signs it with the KMS-held certificate key and returns the CMS — carrying an RFC 3161 signature timestamp when a timestamping authority responded — plus the certificate chain and OCSP responses, and the SDK embeds the container, writes the long-term validation store, and adds the archival document timestamp. The result reaches PAdES B-LTA on the Business plan and above, when the certificate chain supports long-term validation and the document timestamp succeeds — plans below Business stop at the trusted-time level (B-T), since the long-term validation material is a Business+ entitlement; if every timestamping authority is unreachable the seal is still produced at a lower level (down to PAdES-BES) rather than failing the call, and the response tells you which level you got. With qualified=True, both timestamps come from an eIDAS-qualified authority.

What crossed the wire

Digests. The signing request carries the 32-byte ByteRange digest and metadata; the archival timestamp request carries another digest. You can confirm this on your own network — or read the code: both SDKs are Apache-2.0 open source with no third-party crypto or PDF dependencies.

The guarantee, precisely

• If the SDK's local parser cannot handle a PDF's structure, seal_pades raises PdfUnsupported (SigillPdfUnsupportedException in .NET) before any network call. It never silently falls back to uploading.
• If your policy allows server-side sealing for such documents, opt in explicitly with allow_upload_fallback=True / AllowUploadFallback = true — the document is then sealed via POST /seal/sign (identical PAdES output, but the PDF is transmitted).
• With the default settings, the SDK is incapable of transmitting your document. sigill.ai has no document storage in any case — only digests and operation metadata are recorded.

Verify the result

The sealed PDF is a standard PAdES artifact:

• Standard PDF readers with signature support display and validate PAdES seals against their own trust stores.
• sigill.ai/verify validates it free, no account required. (Verification needs the PDF, so use it when transmitting the sealed file is acceptable — or validate offline with standard tools.)
• On 21 July 2026 we validated an SDK-produced PAdES seal carrying qualified RFC 3161 timestamps with the EU Commission's DSS validator — the ETSI reference implementation: PAdES-BASELINE-LTA, TOTAL_PASSED, both timestamps recognised as qualified.

Notes

• The recorded document hash for the operation is the ByteRange digest (sigill.ai never saw the PDF), so operation lookups match that digest rather than a whole-file hash.
• Post-quantum hybrid signatures are not available for embedded PDF seals — see Choosing a seal format for why, and for the detached alternative.
• The API contract behind the SDKs is documented in the API reference (POST /seal/sign-pades-hash) if you want to integrate it directly.