# JWKS

## Overview

The `/jwks` endpoint provides the public key for validating SignerInfo JWTs returned with signing results.

## SignerInfo JWT Claims

When you request SignerInfo JWT in your sign order (`resultContent.requestSignerInfo: true`), the response includes a signed JWT containing information about the document signer extracted from their digital certificate.

| Claim               | Description                                     | Example                           |
| ------------------- | ----------------------------------------------- | --------------------------------- |
| `sub`               | Certificate serial number                       | `"UN:NO-9578-5100-Q_5iVtjvP..."`  |
| `iss`               | Issuer (the SignDoc service domain)             | `"api.esign-stoe.cloud"`          |
| `name`              | Full name of the signer                         | `"Ola Nordmann"`                  |
| `given_name`        | First name                                      | `"Ola"`                           |
| `family_name`       | Last name                                       | `"Nordmann"`                      |
| `birthdate`         | Date of birth (YYYY-MM-DD format)               | `"1988-09-05"`                    |
| `signature_quality` | Signature quality level                         | `"QES"` or `"AES"`                |
| `cert_issuer`       | Certificate issuer DN                           | Certificate authority information |
| `iat`               | Issued at timestamp                             | Unix timestamp                    |
| `exp`               | Expiration timestamp                            | Unix timestamp                    |
| `nbf`               | Not before timestamp                            | Unix timestamp                    |
| `2.16.578.1.61.2.3` | BankID PID                                      | `"UN:NO-9578-6000-4-1911943"`     |
| `2.16.578.1.61.2.4` | Norwegian National Identity Number (if present) | `"09058812345"`                   |
| `2.16.578.1.61.2.1` | eID country code                                | `"NO"`                            |
| `2.16.578.1.61.2.2` | eID scheme                                      | `"BANKID"`                        |

## Validation Guidelines

1. Retrieve the public key from this endpoint
2. Verify the JWT signature using the public key
3. Validate that the token hasn't expired (`exp` claim)
4. Verify the issuer (`iss` claim) matches the expected SignDoc domain
5. Extract and trust the signer information claims

## API Specification

API reference: [OpenAPI specification](https://docs.stoe.no/bankid-esign-provider/apis/signdoc/jwks.external.yaml)