# API Specification Changelog

This page documents changes to the BankID Signing API specifications. It is intended to help merchants track when API contracts (required fields, validation rules, endpoint behaviour) have changed.

For service-level changes (bugfixes, performance improvements, new features), see the Release Notes:
[CSC](https://docs.stoe.no/bankid-esign-provider/release-notes/release-notes-csc.md) |
[WYSIWYS](https://docs.stoe.no/bankid-esign-provider/release-notes/release-notes-wysiwys.md) |
[Timestamp](https://docs.stoe.no/bankid-esign-provider/release-notes/release-notes-tsa.md) |
[B2B](https://docs.stoe.no/bankid-esign-provider/release-notes/release-notes-b2b.md)

For planned future changes, see the Upcoming Changes:
[CSC](https://docs.stoe.no/bankid-esign-provider/upcoming-changes/upcoming-changes-csc.md) |
[WYSIWYS](https://docs.stoe.no/bankid-esign-provider/upcoming-changes/upcoming-changes-wysiwys.md) |
[Timestamp](https://docs.stoe.no/bankid-esign-provider/upcoming-changes/upcoming-changes-tsa.md) |
[B2B](https://docs.stoe.no/bankid-esign-provider/upcoming-changes/upcoming-changes-b2b.md)

## CSC Signing API

### 2026-03-12

- **Enforcement of required field `hashAlgorithmOID` on `credentials/authorize`**: The gateway now validates that `hashAlgorithmOID` is present in the request body. This field has been marked as required in the OpenAPI specification since the initial version, but was not previously enforced at runtime. Requests without `hashAlgorithmOID` will now be rejected.
- **Enforcement of required field `hashes` on `credentials/authorize`**: The `hashes` array is now validated as required with a maximum of 50 entries. Previously not enforced at runtime.
- **Validation of `numSignatures` on `credentials/authorize`**: The `numSignatures` parameter now requires a value between 1 and 50.
- **Maximum hashes reduced from 100 to 50**: The maximum number of hashes accepted per call to `credentials/authorize` and `signatures/signHash` has been reduced from 100 to 50.
- **Token single-use enforcement**: Each access token from `csc/v2/oauth2/token` must now follow a strict endpoint order (`credentials/list` → `credentials/authorize` → `signatures/signHash`). Reusing a token at an endpoint it has already been used at will result in a `token_already_used` error (HTTP 400).

### 2026-01-26

- **Validation of `lang` parameter on `/csc/v2/oauth2/authorize`**: The `lang` parameter is now validated server-side. Only supported language codes (`nb`, `nn`, `en`) are accepted; unsupported values are ignored and the default language is used.

### 2026-01-18

- **New endpoint `credentials/info`**: Added the `POST /csc/v2/credentials/info` endpoint, returning detailed credential information including the certificate chain, key parameters, and authorisation settings.

## WYSIWYS Signing API

### 2026-09-17 (PreProd: 2026-09-14)

- **Increased maximum PDF document size**: The allowed size of PDF documents in a PAdES sign order increased to 40 MB per document (Base64-encoded size).
- **Increased maximum allowed document package size**: The limit for the overall size of all documents in a sign order was increased to 200 MB.
- **New field** `documents.followRotation`: Influences how the seal is placed on PDFs that have been rotated between creation and signing.

### 2026-07-09

- **New field** `signProperties.requestCallback`: Requests to receive a callback when signing is finished.

### 2026-07-02 (PreProd: 2026-06-23)

- **Increased maximum PDF document size**: The allowed size of PDF documents in a PAdES sign order increased to 20 MB per document (Base64-encoded size).
- **Increased maximum number of documents**: The allowed number of documents in a PAdES sign order increased from 15 to 30.
- **Introduced a maximum allowed document package size**: An additional runtime-check was added that limits the overall size of all documents in a sign order to 100 MB.
- **New field `padesSignProperties.extendToLT`**: Allows document signatures be extended to PAdES-B-LT containing an additional timestamp in order to improve recognition of short-lived certificates by Adobe Reader.

### 2026-03-19

- **Increased maximum PDF document size**: The allowed size of PDF documents in a PAdES sign order increased to 10 MB per document (Base64-encoded size).

### 2026-03-05

- **`signerInfo` field populated on DELETE**: The `signerInfo` field in the PAdES-V1-API DELETE call now contains a JSON Web Token with signer information if requested during sign order creation.

### 2026-02-18

- **New field `signProperties.continueButtonTargetText`**: Allows merchants to customise the label of the "Continue" button on the finish page.
- **New field `signProperties.merchantWorkflowState`**: Allows WYSIWYS to differentiate between a stand-alone sign order and a merchant workflow.

## B2B Signing API

### 2026-07-09

- **Documented existing hash limits on `signatures/signHash`**: This is a documentation-only change — no new restrictions are introduced. The `hashes` array on `POST /v0/b2b/csc/v2/signatures/signHash` has always been limited to **minimum 1, maximum 15** hashes per request, with each Base64-encoded hash value **44–88 characters** long. These already-existing limits are now made explicit in the API specification so merchants can see them up front. Requests exceeding 15 hashes were already rejected further down the signing chain. The `required` list was also corrected to reference `hashes`.

### 2026-07-02 (PreProd: 2026-06-23)

- **PAdES and XAdES signing support**: CRL for intermediate certificates added in revocation data

### 2026-05-21

- **PAdES and XAdES signing support**: Always producing BASELINE-LT signatures, deprecating B/LT type parameter.
- **PAdES support adds visual seal**: It is possible to create PAdES with visual seal, see api extensions.

### 2026-04-24

- **New PAdES and XAdES signing support**: Added PAdES and XAdES Baseline-B and Baseline-LT signing support.

### 2026-01-18

- **New CSC Pkcs1 endpoints**: Added CSC Pkcs1 endpoints.

## Timestamp API

No specification changes recorded yet.