Contract policy
Lifecycle, limits and retention
The OpenAPI version is 1.3.0. The HTTP resource family remains
/v1; additive contract releases do not change that base path.
Compatibility and deprecation
- Additive fields, methods and operations may be introduced within
/v1. - Existing clients must ignore response fields they do not use.
- A breaking request or response change requires a new major resource family.
- Any future retirement notice will name the affected operation and final availability date. No
/v1retirement is scheduled.
Release history
| Contract | Published capability |
|---|---|
| 1.3.0 | Optional Smart-ID and Mobile-ID authentication and PAdES signing methods. |
| 1.2.0 | Contract-fidelity and signing-result validation corrections. |
| 1.1.0 | Additional signatures, standalone validation, timestamp and archive services. |
| 1.0.0 | ATK physical/NFC authentication and qualified signing. |
Retention and deletion
The default provider retention window is 30 days and can be reduced by contract. After the window, the retention job removes document/result bytes, certificates, derived identity data, filenames, messages and per-request callback details. A pseudonymous certificate fingerprint and the minimal usage/audit row remain for replay prevention, abuse investigation and billing integrity.
Use the per-request delete operation or tenant-scoped POST /v1/erasure to trigger the
same purge earlier. Remote personal code and phone number are not stored as plaintext request fields.
Operational defaults
| Item | Default |
|---|---|
| Maximum document size | 15 MiB per provider unless contracted otherwise. |
| Sandbox content | Synthetic/test data only. |
| Delivery | Polling or at-least-once HMAC-signed webhook; deduplicate by idempotency key. |
| Health | Public API-host reachability probe. |