# Sign Uploaded Document

Applies a digital signature to a previously uploaded document using the specified user certificate and OTP verification. Supports visible and invisible signatures.

Endpoint: POST /documents/{doc-ulid}/sign
Version: 1.1.0
Security: user_bearer_auth

## Path parameters:

  - `doc-ulid` (string, required)
    The unique ULID of the document (obtained from the upload URL response) to be signed.
    Example: "01JE9KCR0H22PDY9C1GYZABCDE"

## Request fields (application/json):

  - `file_name` (string, required)
    The identifier of the user's certificate (obtained from GET /certificates) to use for signing.
    Example: "my-file.pdf"

  - `certificate_id` (string, required)
    The identifier of the user's certificate (obtained from GET /certificates) to use for signing.
    Example: "cert_thmb_abc123def456"

  - `signature_format` (string, required)
    The cryptographic standard to use for the signature.
    Enum: "PKCS7"

  - `otp` (object, required)
    One-Time Password details for MFA verification.

  - `otp.value` (string, required)
    The actual OTP code provided by the user.
    Example: "123456"

  - `otp.type` (string, required)
    The method used to deliver/generate the OTP.
    Enum: "sms", "totp", "email", "biometric"

  - `visible_signature_options` (object)
    Optional parameters to configure a visible signature appearance block in the PDF. Omit this object for an invisible signature.

  - `visible_signature_options.page_number` (integer, required)
    The 0-indexed page number where the visible signature should be placed.

  - `visible_signature_options.position_x` (number, required)
    Relative X coordinates for the lower-left corner of the signature block (range 0.0 to 1.0 for each axis). [0,0] is bottom-left, [1,1] is top-right.
    Example: 0.4378

  - `visible_signature_options.position_y` (number, required)
    Relative  Y coordinates for the lower-left corner of the signature block (range 0.0 to 1.0 for each axis). [0,0] is bottom-left, [1,1] is top-right.
    Example: 0.3577

  - `visible_signature_options.include_date` (boolean)
    Whether to include the signing date in the visible block.
    Example: true

  - `visible_signature_options.include_initials` (boolean)
    Whether to include the signer's initials (if available) in the visible block.

  - `visible_signature_options.include_motive` (boolean)
    Whether to include the signing motive in the visible block. Requires 'motive' to be provided if true.
    Example: true

  - `visible_signature_options.include_signature_graphic` (boolean)
    Whether to include a standard digital signature graphic element in the visible block.
    Example: true

  - `visible_signature_options.motive` (string)
    The reason or motive for signing (e.g., "Approval", "Agreement"). Required if 'include-motive' is true.
    Example: "Aprobación de documento"

## Response 200 fields (application/json):

  - `message` (string, required)
    Confirmation message.
    Example: "Document signed successfully."

  - `doc_ulid` (string, required)
    The ULID of the document that was signed.
    Example: "01JE9KCR0H22PDY9C1GYZABCDE"

## Response 401 fields (application/json):

  - `code` (string, required)
    An application-specific error code string.
    Example: "INVALID_OTP"

  - `message` (string, required)
    A human-readable explanation specific to this occurrence of the problem.
    Example: "The OTP provided is invalid or has expired."

## Response 403 fields (application/json):

  - `code` (string, required)
    An application-specific error code string.
    Example: "INVALID_OTP"

  - `message` (string, required)
    A human-readable explanation specific to this occurrence of the problem.
    Example: "The OTP provided is invalid or has expired."

## Response 404 fields (application/json):

  - `code` (string, required)
    An application-specific error code string.
    Example: "INVALID_OTP"

  - `message` (string, required)
    A human-readable explanation specific to this occurrence of the problem.
    Example: "The OTP provided is invalid or has expired."

## Response 500 fields (application/json):

  - `code` (string, required)
    An application-specific error code string.
    Example: "INVALID_OTP"

  - `message` (string, required)
    A human-readable explanation specific to this occurrence of the problem.
    Example: "The OTP provided is invalid or has expired."