Topolo Docs Topolo Platform
Open workspace

Download Sign certificate PDF

Read the retained audit certificate PDF only after the exact envelope is completed and its certificate artifact is ready. The SDK returns contentType, contentLength and contentBase64.

Outcome

Read the retained audit certificate PDF only after the exact envelope is completed and its certificate artifact is ready. The SDK returns contentType, contentLength and contentBase64.

Before you start

  • Verify the environment, authenticated identity and specifically approved organization context.
  • The published application permission is workspace:read. Resolve and bind the exact canonical Sign workspace. A supplied id or organization membership alone grants no workspace access.
  • Session callers require read workspace access. API-key resource binding is verified by Auth; never treat a caller-supplied header as an independent grant.

Discover the target

topolo whoami --json
topolo actions get app_topolo_sign.envelopes.audit_certificate.pdf.get --detail --json
topolo resources topolo-sign --json
topolo workspaces list topolo-sign --json
  • Set SIGN_WORKSPACE_ID to the exact granted workspace returned by discovery.
  • Resolve envelopeId through envelopes.list/get or retain the exact creation response.

Request

GET /api/envelopes/{envelopeId}/audit-certificate/pdf

Inspect and test this action. Save the reviewed input as payload.json. Supply resource context separately.

Input fields

FieldRequiredMeaningConstraints
envelopeIdRequiredExact envelope.id returned by creation or envelopes.list/get in this workspace.{"minLength":1}

Read the complete input schema.

Effects

  • Reads retained bytes with existing workspace:read authorization. No agreement, consent or recipient data is changed.
  • The server verifies stored object SHA-256 before returning bytes. Artifact download records an existing operational download event.

Interpret the response

Binary transport returns no resource identifier. Retain the authorized input documentId or envelopeId; decoded bytes are the downloaded artifact.

Read envelopes.audit_certificate.get with the retained envelopeId in the same granted workspace. Base64-decode contentBase64 and compare its byte length with contentLength. SHA-256 the decoded bytes and compare with artifacts[].sha256 for kind certificate_pdf from the authorized metadata read. Never hash the Base64 string. The SDK binary projection contains bytes and type, not a new document id or filename. Retain the input identifier and choose a local filename deliberately.

Inspect the success schema. CLI/MCP add their transport envelope; --detail requests the full CLI result. HTTP 204 contains no JSON payload.

Worked examples

Captured from the exported Sign Worker with the existing SQLite-backed D1 harness applying all core, envelope and audit migrations to one local database, in-memory R2 and synthetic Auth/workspace/archive/Notify transports. These examples prove local validation, persistence and artifact production. They do not prove separate deployed D1 topology, real recipient consent, provider delivery or a live signed agreement. All identities, signing links and documents are synthetic; replace identifiers through authorized discovery and never execute a fixture against a live organization. Binary download examples use the released SDK binary projection; tests Base64-decode and compare original bytes, lengths and server SHA-256 headers.

Refused request · HTTP 409

Input · payload.json:

{
  "envelopeId": "b0db0353-6d5a-4a9b-b3f4-85f439ec4953"
}

CLI:

topolo actions validate app_topolo_sign.envelopes.audit_certificate.pdf.get --data @payload.json --json
topolo actions plan app_topolo_sign.envelopes.audit_certificate.pdf.get --resource-type workspace --resource-id "$SIGN_WORKSPACE_ID" --data @payload.json --json

Captured exported Worker response · HTTP 409:

{
  "error": "audit_certificate_not_ready"
}

HTTP 409. Resolve the exact refusal before retrying. This request is not a successful workflow.

Supported request · Read the retained certificate PDF and verify its SHA-256

Input · payload.json:

{
  "envelopeId": "b0db0353-6d5a-4a9b-b3f4-85f439ec4953"
}

CLI:

topolo actions validate app_topolo_sign.envelopes.audit_certificate.pdf.get --data @payload.json --json
topolo actions plan app_topolo_sign.envelopes.audit_certificate.pdf.get --resource-type workspace --resource-id "$SIGN_WORKSPACE_ID" --data @payload.json --json
topolo actions call app_topolo_sign.envelopes.audit_certificate.pdf.get --resource-type workspace --resource-id "$SIGN_WORKSPACE_ID" --data @payload.json --detail --json

MCP tool and arguments:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_sign.envelopes.audit_certificate.pdf.get",
    "input": {
      "envelopeId": "b0db0353-6d5a-4a9b-b3f4-85f439ec4953"
    },
    "resourceType": "workspace",
    "resourceId": "<exact granted id from discovery>",
    "detail": true
  }
}

Captured canonical SDK binary projection of the exported Worker response · HTTP 200:

{
  "contentType": "application/pdf",
  "contentLength": 4503,
  "contentBase64": "JVBERi0xLjcKJYGBgYEKCjEgMCBvYmoKPDwKL1R5cGUgL1BhZ2VzCi9LaWRzIFsgNyAwIFIgXQovQ291bnQgMQo+PgplbmRvYmoKCjIgMCBvYmoKPDwKL1R5cGUgL0NhdGFsb2cKL1BhZ2VzIDEgMCBSCj4+CmVuZG9iagoKMyAwIG9iago8PAovUHJvZHVjZXIgPEZFRkYwMDU0MDA2RjAwNzAwMDZGMDA2QzAwNkYwMDIwMDA1MzAwNjkwMDY3MDA2RT4KL01vZERhdGUgKEQ6MjAyNjEwMDUxODA3NDBaKQovQ3JlYXRvciA8RkVGRjAwNTQwMDZGMDA3MDAwNkYwMDZDMDA2RjAwMjAwMDUzMDA2OTAwNjcwMDZFPgovQ3JlYXRpb25EYXRlIChEOjIwMjYxMDA1MTgwNzQwWikKL1RpdGxlIDxGRUZGMDA0MzAwNjUwMDcyMDA3NDAwNjkwMDY2MDA2OTAwNjMwMDYxMDA3NDAwNjUwMDIwMDA2RjAwNjYwMDIwMDA2MzAwNkYwMDZEMDA3MDAwNkMwMDY1MDA3NDAwNjkwMDZGMDA2RT4KL1N1YmplY3QgPEZFRkYwMDYyMDAzMDAwNjQwMDYyMDAzMDAwMzMwMDM1MDAzMzAwMkQwMDM2MDA2NDAwMzUwMDYxMDAyRDAwMzQwMDYxMDAzOTAwNjIwMDJEMDA2MjAwMzMwMDY2MDAzNDAwMkQwMDM4MDAzNTAwNjYwMDM0MDAzMzAwMzkwMDY1MDA2MzAwMzQwMDM5MDAzNTAwMzM+Ci9LZXl3b3JkcyA8RkVGRjAwNjMwMDY1MDA3MjAwNzQwMDY5MDA2NjAwNjkwMDYzMDA2MTAwNzQwMDY1MDAyRDAwNzMwMDY4MDA2MTAwMzIwMDM1MDAzNjAwM0EwMDY1MDAzMjAwMzkwMDY0MDAzNjAwMzMwMDY0MDA2NDAwMzgwMDMwMDA2NjAwNjIwMDMxMDAzODAwNjMwMDM1MDA2NDAwMzQwMDMxMDAzMTAwMzMwMDMwMDAzMjAwMzAwMDM0MDAzNjAwMzIwMDMzMDAzMzAwNjYwMDY1MDA2MzAwMzEwMDM1MDA2MzAwNjYwMDY0MDA2NDAwMzUwMDMzMDAzODAwMzMwMDYxMDA2MzAwMzYwMDMyMDAzMTAwMzcwMDM5MDA2NDAwNjMwMDY0MDA2NjAwNjQwMDYyMDA2MzAwMzYwMDMzMDAzMTAwNjUwMDYzMDA2MzAwMzYwMDYzMDAyMDAwNjMwMDZGMDA2RDAwNzAwMDZDMDA2NTAwNzQwMDY1MDA2NDAwMkQwMDczMDA2ODAwNjEwMDMyMDAzNTAwMzYwMDNBMDA2MTAwNjQwMDYyMDAzMTAwNjEwMDY0MDA2NTAwMzAwMDY0MDAzNDAwMzcwMDM1MDA2MTAwNjEwMDMyMDA2MzAwNjUwMDYzMDAzNzAwNjYwMDY2MDAzODAwMzQwMDM4MDA2NDAwMzcwMDMyMDA2NTAwMzQwMDYxMDA2NjAwMzMwMDYzMDAzNTAwMzcwMDM1MDA2NjAwMzcwMDM5MDAzNTAwNjUwMDY2MDAzOTAwNjUwMDM0MDA2NjAwNjUwMDMyMDAzNTAwMzcwMDM1MDA2MzAwMzIwMDYxMDAzMzAwNjYwMDM5MDAzODAwMzIwMDMyMDA2NTAwMzMwMDM2MDAzMz4KPj4KZW5kb2JqCgo0IDAgb2JqCjw8Ci9UeXBlIC9Gb250Ci9TdWJ0eXBlIC9UeXBlMQovQmFzZUZvbnQgL0hlbHZldGljYQovRW5jb2RpbmcgL1dpbkFuc2lFbmNvZGluZwo+PgplbmRvYmoKCjUgMCBvYmoKPDwKL1R5cGUgL0ZvbnQKL1N1YnR5cGUgL1R5cGUxCi9CYXNlRm9udCAvSGVsdmV0aWNhLUJvbGQKL0VuY29kaW5nIC9XaW5BbnNpRW5jb2RpbmcKPj4KZW5kb2JqCgo2IDAgb2JqCjw8Ci9UeXBlIC9Gb250Ci9TdWJ0eXBlIC9UeXBlMQovQmFzZUZvbnQgL0hlbHZldGljYS1Cb2xkCi9FbmNvZGluZyAvV2luQW5zaUVuY29kaW5nCj4+CmVuZG9iagoKNyAwIG9iago8PAovVHlwZSAvUGFnZQovUGFyZW50IDEgMCBSCi9SZXNvdXJjZXMgPDwKL0ZvbnQgPDwKL0hlbHZldGljYS1Cb2xkLTcwOTg0ODA3ODkgNSAwIFIKL0hlbHZldGljYS05NzQyNjgyNTY4IDQgMCBSCi9IZWx2ZXRpY2EtMjAwMDgwNTk4NiA0IDAgUgovSGVsdmV0aWNhLTk3NTA0NjkyMDcgNCAwIFIKL0hlbHZldGljYS03NTcyNTMzNjg2IDQgMCBSCi9IZWx2ZXRpY2EtODQ1MDE4MDEwNyA0IDAgUgovSGVsdmV0aWNhLTg2NTk4NzE4NzggNCAwIFIKL0hlbHZldGljYS01ODI0NjYyMzM4IDQgMCBSCi9IZWx2ZXRpY2EtMTg0ODUyNDE3NSA0IDAgUgovSGVsdmV0aWNhLTc4ODg5MTEwNjMgNCAwIFIKL0hlbHZldGljYS05NzkzNDQ5MjkgNCAwIFIKL0hlbHZldGljYS0yNzA4MTk5OTU2IDQgMCBSCi9IZWx2ZXRpY2EtNjcwMzY4MjY2NCA0IDAgUgovSGVsdmV0aWNhLTczNTU2OTQ4NyA0IDAgUgovSGVsdmV0aWNhLTg3ODQwMTU3MTEgNCAwIFIKL0hlbHZldGljYS05NjY4MzMzNDkzIDQgMCBSCi9IZWx2ZXRpY2EtMjUwODEyMDQ0IDQgMCBSCi9IZWx2ZXRpY2EtQm9sZC0xMjc1MzIyODMyIDUgMCBSCi9IZWx2ZXRpY2EtQm9sZC03NzIwOTY2Mjk1IDUgMCBSCi9IZWx2ZXRpY2EtNDUyNTA3Mjc2MiA0IDAgUgovSGVsdmV0aWNhLTU1NjM4NTM2MDUgNCAwIFIKL0hlbHZldGljYS00ODY5MDcwOTU5IDQgMCBSCi9IZWx2ZXRpY2EtQm9sZC03OTU5NTgyNDgyIDUgMCBSCi9IZWx2ZXRpY2EtMjE2Mzc5OTMzNyA0IDAgUgovSGVsdmV0aWNhLTQ4MjQ5OTAyMjIgNCAwIFIKL0hlbHZldGljYS01ODQ1MDQ3OTYwIDQgMCBSCi9IZWx2ZXRpY2EtNzU5Mjg0MDQ1MCA0IDAgUgovSGVsdmV0aWNhLTU3ODgzMDc4NiA0IDAgUgovSGVsdmV0aWNhLTY2MTE1Nzg3MDMgNCAwIFIKL0hlbHZldGljYS02ODM3NTkwNzEzIDQgMCBSCi9IZWx2ZXRpY2EtNjIzNTQ2NzY5MyA0IDAgUgovSGVsdmV0aWNhLTI2NjgxMjQxNjkgNCAwIFIKL0hlbHZldGljYS0xMTg2MDEwNzI2IDQgMCBSCi9IZWx2ZXRpY2EtQm9sZC04MjY4NjEyMDAyIDUgMCBSCj4+Ci9YT2JqZWN0IDw8Cj4+Ci9FeHRHU3RhdGUgPDwKPj4KPj4KL01lZGlhQm94IFsgMCAwIDYxMiA3OTIgXQovQW5ub3RzIFsgXQovQ29udGVudHMgWyA4IDAgUiBdCj4+CmVuZG9iagoKOCAwIG9iago8PAovRmlsdGVyIC9GbGF0ZURlY29kZQovTGVuZ3RoIDE0NDUKPj4Kc3RyZWFtCnicxVjbjmM1EHzPV5xnpF3sbrvblhDSTiYRD7wg5QcQLAi0CC1CfD9V7WR2JhMPa9gVinIuvva1unze7+5Ou/Q61Q2Xhotsf/y8+/Kbt+/+evvnLz98/+ru93c/vvLUW2nJW98kbaefdlK207e7vCX88lbL5rltp992XxW16uLFuhn+ahnPVZIdzXBV3O892R6jOOZoh6+306+70xe7w2n33e79EEcpSeHfrsTpXsSaVGtbvy1Iyq9riFKLNeuuse1NoVysUiTcC8e5Y8YRd8UotwN6C964DlWodnDDdY8ZeJP9eQba+WwZM56M94Y2hcTJClRVr3Yfq4zdYpz3q/0WDSIppZZqb7a1mwaxll7wzK3N5sHQvSYsAIkn1jfzs/Uta9NsFVfBr8m9Ju0qpngqCiHU5B72EXXNeBKtaGu4F85ht2YVSdKqllYwButUtTWRHUpXVZh6JnI9C1yxfDeYCaOLUYgES1GIhia4BoJl/BSKCP4cKXhTY1AoehhMFnOxI+Yr3R+jMpTE2saVOUKiXWkgiw0xqK85vpWacksZvpg4XvvZFwVZ4Iw+KLFmPQRob8htn6WbiccWYRGhS6FrCmfXSns1fYNnx7Wg/QDLFBjzzZqutUmhKzBiomu+ZH25ytI1fTNgrkrJXif61t7HNsghb0jkShCJ5PeAk4cUZ+BCZKY+baOMCdjFGB3GYC5IkW4Soc8AKGhrkQSwEHoYU0iUmLcYG95a6zkD+Cb2qk0v9rpCplVA6FpKlz4zl+ePNNci6nlqufdeZ6hXa70o+LTmLKeAeQJ6CPw207HoagoAEVdTwLGY9dJm2V7lgryVFY121rD0lX8l/Rc0BRCUlOHVPDNGPqMpEc4Z6UqIz3A48HNgKNok+ojLma3sNRaFDDBMAxeROcwZC6MiG6IsWNydq0Z5kSgz7OmxB7G0o/+mWi+wCjOgtZY+y5fS+zScPrWNpSK2JZVZvDEGRoUNaAnThrlo3DA5DUzv0wUoNzZMZOwVGhAjRv2pMd5YnOgOPIWhWdBCcvYCfbAeAaqPWk63cfKaVsEjszgWFiyzZb2tnNmHMD6TIrCWf7MZACbBsdJnWF6q3ASnOmhhh5P7xaG692et5ULxzuEgBwYECm3RA9D/nmHwQYfRMsjmeNe8phXkreCsbjKL0pLOxlvFoiFcxPbBdainaAW0P8Lq4KyP+PGZww6O/SwHogZX8l/MxrqDdKJtH5y3xioHg5fA1Fmrj6zZH4y2yoSBjwqqaDDgxDzSn0ZWfuTzO5IFRlqICjHrfRjgH2NjTcgCcyUcp2rf/LaQuT0wGSdRJ8YcBpY/RRUhBS2RxQ0ZC/qJDGWuOwknkSngskfec0wJgCSB7UEviBIDoGsAMv1DBCWSEIh59TMsC2FkEGOuSf6+WkhHUkJzsrk2RQAsPdQHCcNmPPClCKEMY+wXaQKPX70DBichgXPJxdo3t4u4ZrBEWi+mK9TsPYnIBH/Ux8mMxxyNOshThRF2Gw3P0wfeWD+RyrhanCl4pCIg85RhUT81ioBEMo/5nEdXUiWu3uFU9nKFFIcv1sxxSpE1tSoPHsW7pS0Yxy3F6iIKxVGKKPTsjI3ID+zJD7X2OBI1WgCmcxBePSd2AbeBbnO1UJIX1SKW3lQLeMLQ+uxqYRF4HCvNtdJF+sozSfp/tULYg4Q2MPO5WiLravlELX2oaZ9LISR8RWHILyiU82ppzyP6njMXpNU+iu9dPUbvow8En1FJIFQBlvYXlExpnb/oTMmr73gLBG6RseP4kKWgYkwVk9bXFaszSHx+BIHQ9CHf7tdqZM7N+BVJZkdp8YeTpUVYoHwEg7t85/yoE5EJ57C+ki1eMxmGGjjoEXeMkaM/3unod84PeHmM9kUFg3fgAI8FJCWZ8C4d2F6D7lItzZev1lc8/W/fL/2SCmVuZHN0cmVhbQplbmRvYmoKCnhyZWYKMCA5CjAwMDAwMDAwMDAgNjU1MzUgZiAKMDAwMDAwMDAxNiAwMDAwMCBuIAowMDAwMDAwMDc2IDAwMDAwIG4gCjAwMDAwMDAxMjYgMDAwMDAgbiAKMDAwMDAwMTI4MyAwMDAwMCBuIAowMDAwMDAxMzgxIDAwMDAwIG4gCjAwMDAwMDE0ODQgMDAwMDAgbiAKMDAwMDAwMTU4NyAwMDAwMCBuIAowMDAwMDAyNzI3IDAwMDAwIG4gCgp0cmFpbGVyCjw8Ci9TaXplIDkKL1Jvb3QgMiAwIFIKL0luZm8gMyAwIFIKPj4KCnN0YXJ0eHJlZgo0MjQ2CiUlRU9G"
}

HTTP 200. Read envelopes.audit_certificate.get with the retained envelopeId in the same granted workspace. Base64-decode contentBase64 and compare its byte length with contentLength. SHA-256 the decoded bytes and compare with artifacts[].sha256 for kind certificate_pdf from the authorized metadata read. Never hash the Base64 string. The SDK binary projection contains bytes and type, not a new document id or filename. Retain the input identifier and choose a local filename deliberately.

Refused request · HTTP 401

Input · payload.json:

{
  "envelopeId": "ed22fca5-d5f0-4392-8e71-96e247bf3875"
}

CLI:

topolo actions validate app_topolo_sign.envelopes.audit_certificate.pdf.get --data @payload.json --json
topolo actions plan app_topolo_sign.envelopes.audit_certificate.pdf.get --resource-type workspace --resource-id "$SIGN_WORKSPACE_ID" --data @payload.json --json

Captured exported Worker response · HTTP 401:

{
  "error": "Token validation failed"
}

HTTP 401. Resolve the exact refusal before retrying. This request is not a successful workflow.

Refused request · HTTP 403

Input · payload.json:

{
  "envelopeId": "synthetic-unresolved-fixture"
}

CLI:

topolo actions validate app_topolo_sign.envelopes.audit_certificate.pdf.get --data @payload.json --json
topolo actions plan app_topolo_sign.envelopes.audit_certificate.pdf.get --resource-type workspace --resource-id "$SIGN_WORKSPACE_ID" --data @payload.json --json

Captured exported Worker response · HTTP 403:

{
  "error": "You do not have access to this workspace",
  "code": "workspace_forbidden"
}

HTTP 403. Resolve the exact refusal before retrying. This request is not a successful workflow.

Verify the result

  • Read envelopes.audit_certificate.get with the retained envelopeId in the same granted workspace.
  • Base64-decode contentBase64 and compare its byte length with contentLength. SHA-256 the decoded bytes and compare with artifacts[].sha256 for kind certificate_pdf from the authorized metadata read. Never hash the Base64 string.
  • The SDK binary projection contains bytes and type, not a new document id or filename. Retain the input identifier and choose a local filename deliberately.

Errors and recovery

  • envelope_not_found (HTTP 404): Discover the exact retained identifier in this authorized workspace; do not substitute an identifier from another workspace.
  • artifact_integrity_failed (HTTP 500): Stored artifact bytes do not match the retained SHA-256. Preserve the envelope, expected hash and request id and report the integrity incident; do not substitute a new hash.
  • audit_certificate_not_ready (HTTP 409): Read the retained envelope and restore the complete intended recipient list through an authorized draft update before attempting send.
  • auth_error (HTTP 401): Reauthenticate in the same approved context before retrying.
  • workspace_forbidden (HTTP 403): Discover the actual workspace grant and obtain the documented required access; do not retry with a guessed workspace or broader organization.

Some existing refusals return a human message as error rather than a stable code; preserve the actual response, status and request id. Platform validation, authentication and resource checks can refuse before the handler.

Recovery boundary

A download changes no agreement. Resolve the actual grant and artifact readiness, then repeat the same read. Never recreate or re-sign an agreement to make a download succeed.

  • Get Sign audit certificate: Get the immutable audit certificate issued when an envelope completed: signer identities, capacities, consent and evidence hashes, the source and completed document SHA-256 and a hash chain over the audit trail, plus the certificate's own hash.

Evidence

Captured from the exported Sign Worker with the existing SQLite-backed D1 harness applying all core, envelope and audit migrations to one local database, in-memory R2 and synthetic Auth/workspace/archive/Notify transports. These examples prove local validation, persistence and artifact production. They do not prove separate deployed D1 topology, real recipient consent, provider delivery or a live signed agreement. All identities, signing links and documents are synthetic; replace identifiers through authorized discovery and never execute a fixture against a live organization. Binary download examples use the released SDK binary projection; tests Base64-decode and compare original bytes, lengths and server SHA-256 headers.