PANDA DEVELOPER API V1

Developer API Documentation

Server-to-server access to SigVerify's Panda verification engine. The Developer API is available through the web platform only and has no free API credits.

Base URL

Primary

https://sigverify.pages.dev/api/v1

All endpoint paths below are relative to this base URL.

Custom-domain alias

https://sigverfiy.in/api/v1

The Pages domain above is the durable public API address. The custom domain is an alias while it is active — prefer the Pages domain in production integrations.

Authentication

The public verification endpoint is authenticated with a secret API key, sent on every request:

X-API-Key: sv_live_YOUR_KEY

Keys are created and managed from the authenticated Developer Portal (Google sign-in) — never via the API itself. Portal account-management endpoints (create/rotate/revoke key, usage, billing) use your portal session, not the API key, and are documented separately below for completeness.

Rate limits

Each API account has a per-minute request limit tied to its plan. Requests over the limit receive 429 with a Retry-After: 60 header.

Plan	Requests / minute
Starter	10
Growth	30
Scale	60
Business	120

The limit updates automatically the moment your account's plan/rate limit changes — no need to reconnect or re-issue your key.

Verify a PDF API key

POST /verify

Upload one signed PDF as multipart form data. One API credit is consumed only after Panda successfully returns a result — a timeout, network error, or 5xx never consumes a credit.

curl -X POST https://sigverify.pages.dev/api/v1/verify \
  -H "X-API-Key: sv_live_YOUR_KEY" \
  -F "file=@signed-document.pdf"

Response

{
  "object": "verification",
  "apiVersion": "2026-08-01",
  "engine": "Panda",
  "status": "valid",
  "result": {
    "...": "Panda verification evidence (signature, certificate, trust chain)"
  }
}

Response headers

Header	Meaning
`X-SigVerify-API-Version`	The API version that served the request, e.g. `2026-08-01`
`X-SigVerify-Credits-Remaining`	Your account's credit balance immediately after this request

Account & portal endpoints Portal session

These endpoints back the Developer Portal UI and require a signed-in Firebase session (Authorization: Bearer <ID token>), not an API key. They are not meant to be called from your verification backend — listed here for completeness.

GET /developer/account

Your account's credit balance, verification total, status, plan rate limit, and masked key prefix.

POST /developer/account

Creates your API account (0 credits, active, 10 req/min default) and issues your first key. The key is shown once.

POST /developer/rotate-key

Issues a new key and immediately invalidates the previous one.

POST /developer/revoke-key

Disables the account. /verify requests then fail with 403 api_key_disabled until reactivated.

GET /developer/usage

Your most recent verification log entries (filename, status, latency).

POST /developer/create-order

Creates a Razorpay order for a credit plan; credits land on your account once the payment is confirmed.

Public metadata No auth

GET /health

Service status — does not require an API key. Used by the Developer Portal's live status indicator.

{
  "object": "api_health",
  "service": "SigVerify Developer API",
  "version": "v1",
  "engine": "Panda",
  "status": "operational"
}

GET /plans

Current API credit plans, pricing, and rate limits — the same data as the pricing table below, machine-readable.

{
  "currency": "INR",
  "freeCredits": 0,
  "plans": [
    { "id": "starter", "name": "Starter", "credits": 100, "amount": 3000, "pricePerVerification": 30, "rateLimitPerMinute": 10 }
  ]
}

Errors

Errors from /verify, /health, and /plans use a consistent JSON shape:

{ "error": { "code": "insufficient_credits", "message": "No API verification credits remain..." } }

Status	Code	Meaning
400	`file_required`	No file was attached to the request
401	`invalid_api_key`	Missing, malformed, or unrecognized API key
402	`insufficient_credits`	No API credits remain — purchase more from the portal
403	`api_key_disabled`	Account revoked or disabled
404	`not_found`	No route matches the requested method/path
415	`pdf_required`	Only PDF documents are accepted
429	`rate_limit_exceeded`	Plan's requests-per-minute limit exceeded — see `Retry-After`
500	`verification_error`	Panda could not complete this verification — no credit consumed
504	`verification_timeout`	Panda timed out (30s) — no credit consumed

Pricing

Plan	Credits	Price	Per verification	Rate limit
Starter	100	₹3,000	₹30	10/min
Growth	500	₹12,500	₹25	30/min
Scale	2,000	₹40,000	₹20	60/min
Business	10,000	₹1,50,000	₹15	120/min

There is no free API credit tier. API credits are separate from normal SigVerify retail (app/website) credits — they live in a different balance and are purchased separately.

Request limits

Limit	Value
Max file size	20 MB
Files per request	1
Accepted format	PDF only (`application/pdf` or `.pdf` filename)
Verification timeout	30 seconds

Security

Never put your API key in Android, browser JavaScript, GitHub, or a public repository.

Use it only from your own server/backend. If a key is compromised, rotate or revoke it immediately from the Developer Portal — the old key stops working the moment you do.