Tutorial

Note: Payments are processed as single payments when an initiated batch only contains one payment.

How the Business Account Payment - Instant API works

1. Setup your application and integrate it with this API.
2. Initiate your payment run and generate an electronic signature, in this documentation referred to as the JSON Web Signature (JWS).
3. Use the API to send the payments to the bank
4. The bank will validate the signature and process the payments straight-through. No manual steps needed anymore.

Requirements

To use this API in a production environment, you must have the following:

• An ABN AMRO business current account number that is registered in The Netherlands.
• A contract for Internet Banking Business or Access Online.
• A TLS certificate of the type Organisation Validation (OV) or Extended Validation (EV) from Digicert, Quo Vadis, Sectigo or Entrust without wildcard options for setting up the connection.
• Your TLS certificate MUST include Client Authentication (1.3.6.1.5.5.7.3.2) value for the certificate usage which can be found in the "Enhance Key Usage" tag of your certificate.
• Note: for certificates requested or renewed after the 1st of October 2025 Client Authentication is not by default added in your certificate by your CA. Please specifically request this to your CA.
• Note: Sectigo will only issue a public TLS certificate with the client authentication EKU if you have a Sectigo Enterprise Account or a Sectigo Certificate Manager Pro Account.
• For certificates requested or renewed after the 1st of October 2025 Client Authentication is not by default added in your certificate by your CA. Please specifically request this to your CA.
• A certificate of the type Extended Validation (EV) from Digicert, Quo Vadis, Sectigo or Entrust without wildcard options for the JWS signature.
• The organisation name issued on the certificate must correspond to the name of the API contract holder.

Sandbox access

The sandbox and production environments are functionally identical. The sandbox is static, which means that you can perform all operations without making any payments on an account. Payments posted in the sandbox environment are cleaned daily.

To use the Business Account Payment - Instant API in the sandbox environment, complete the following steps:

1. Register and create an account:
   1. Click Sign up.
   2. Enter your details, and click Create new account.
   3. Developer Support will send you an activation link by email.
   4. Click the activation link.
2. Create and register an application:
   1. Log in to your account.
   2. In the left-side navigation bar, click Apps.
   3. Click Add app.
   4. In the App name field, enter a name for your application.
   5. In the APIs field, select Business Account Payment - Instant API, and click Add app.
3. Complete the How to use this API process.

To provide feedback on this API, see Contact.

Sandbox access details

• Sandbox URL: https://api-sandbox.abnamro.com
• Sandbox authorization URL: https://auth-mtls-sandbox.abnamro.com

Attribute	Value
client_id	test_client
API-Key	The API Key for your application on the Developer Portal

Certificates

Certificate files
Download public Signing certificate: Download
Download private Signing key: Download
Download public OAuth certificate: Download
Download private OAuth key: Download

Production access

Note: This API is currently in Early Access (pilot phase) and therefore limited to a fixed number of users. If you are interested in using this API, please contact us.

To get access to production:

1. Log in to your account.
2. In the left-side navigation, click Apps.
3. Click Request Production Access.
4. Select the API category that you want to request production access to.
5. Fill in the form, and click Submit.
6. You receive a confirmation email and ticket-ID.
7. ABN AMRO Developer Support validates the form.
8. When the setup is complete, ABN AMRO Developer Support contacts you and supplies you with a client_id.
9. A new app is added in Apps. This new app contains your API key.

Production access details

• Production URL: https://api.abnamro.com
• Production Token URL: https://auth-mtls.abnamro.com/as/token.oauth2

Attribute	Value for Production
client_id	As supplied to you by ABN AMRO
API-Key	The API Key for your production application on the Developer Portal

Certificates

Certificate files:
Certificate file : Your Organisation Validated (OV) or Extended Validated (EV) SSL certificate
Signing Certificate file : Your Organisation EV certificate

How to use this API

This instruction describes how to connect an application to the Business Account Payment - Instant API in the sandbox environment, and how to execute payments.

Note: Before you start this process, you must complete the steps described in Sandbox access.

Step 1 - Request an access token

In this step, the OAuth 2.0 client credentials flow is used to obtain access to the Business Account Payment - Instant API.

Request attributes

The table below defines the usage of attributes in a request.

Attribute	Value
client_id	test_client
API-Key	The API Key for your application on the Developer Portal
Scope	payment:signed:write

Scopes in the authorization code process

A scope defines the type of access you get to the API. Here are some generic rules on how scopes can be combined:

• Write scopes can be combined with read scopes.
• Scopes for different products cannot be combined.
• Write scopes cannot be combined with other write scopes.
• Delete scopes cannot be combined with other scopes.

Sample request

Request an access token using the following sample:

    curl -X POST "https://auth-mtls-sandbox.abnamro.com/as/token.oauth2" \
    -v \
    --cert CertificateCommercial.crt \
    --key PrivateKeyCommercial.key \
    -H 'Cache-Control: no-cache' \
    -H 'Content-Type: application/x-www-form-urlencoded' \
    -d 'grant_type=client_credentials&client_id=test_client&scope=payment:signed:write'

Sample response

    {
      "token_type": "Bearer",
      "access_token": "X1PTWZre0fnW72l263yrhAWB2FDwx3tg",
      "expires_in": 7199
    }

Step 2 - Initiate a payment

All ISO XML formatted payments have an initiating account number. The initiating account number is referred to as the DbtrAcct variable in a PAIN.001 for Credit Transfers, and the CdtrAcct variable in the PAIN.008 for Direct Debits. For more information, see ABN AMRO SEPA implementation guidelines. For documentation on Cross Border payments, Contact us.

For this step, depending on which type of payment you want to process, download and use one following samples files: SCT, or SDD .

Complete the followings steps:

1. After creating the payment file, create the electronic signature as described in the Signing the request section.
2. GZIP the SCT or SDD file.

   Note: This instruction describes an SCT payment.

3. Encode the file in BASE64 using UTF-8.
4. Initiate a payment as described in SCT payments sample below. Each file can contain one batch only, whereas a single payment is a batch of 1. For more information, see the InitiatePayment operation.

Note: To execute direct debits, the account holder must have a direct debit contract with adequate settings for the number and total value of transactions that are submitted.

Payment initiation attributes

Name	Type	In	Required	Description
Authorization	String	Header	true	Access token to be passed as a bearer token. Use the access_token obtained in Step 1.
X-Request-Id	String	Header	true	ID of the payment initiation, unique to the call, as determined by the initiating party.
API-Key	String	Header	true	The API Key for your app on the Developer Portal.
Digest	String	Header	true	Base64 encoded hash of the body and the algorithm used is SHA-256.
Signature	String	Header	true	The electronic signature of the request.
fileName	String	Body	true	Specifies the name of the file. A unique filename is recommended.
fileData	String	Body	true	A GZIP compressed SCT or SDD Payments file. The binairy GZIP file must be BASE64 encoded using UTF-8.

SCT payment sample

Note: Below sample is for a SCT payment. To upload a SDD payment, just add a SDD payment to the fileData field in the sample below.

    curl -X POST -k https://api-sandbox.abnamro.com/v1/customer-api/payments  \
    -v \
    -H 'Accept: application/json'  \
    -H 'Authorization: Bearer X1PTWZre0fnW72l263yrhAWB2FDwx3tg' \
    -H 'X-Request-Id: bc69c490-9524-413f-971a-21f1aecd9fe5' \
    -H 'Content-Type: application/json'  \
    -H 'API-Key: X1QTWZre0fnW72l263yrhAWB2FDwx3tg' \
    -H 'Digest:SHA-256=QBazp7jo/QrtHysfTvATARKKVRgCj9HtFkm4Ha380To=' \
    -H 'Signature:eyJiNjQiOmZhbHNlLCJjcml0IjpbImI2NCIsInNpZ1QiLCJzaWdEIl0sInNpZ1QiOiIyMDI0LTA1LTE2VDExOjI0OjIyWiIsInNpZ0QiOnsicGFycyI6WyJkaWdlc3QiXX0sIng1YyI6WyJNSUlGa3pDQ0Ezc0NGQXE0bUFUWGt2a0FjOTMrTEdMMUtlbzFXZEtlTUEwR0NTcUdTSWIzRFFFQkN3VUFNSUdGTVFzd0NRWURWUVFHRXdKT1RERVdNQlFHQTFVRUNBd05UbTl2Y21RZ1NHOXNiR0Z1WkRFU01CQUdBMVVFQnd3SlFXMXpkR1Z5WkdGdE1SQXdEZ1lEVlFRS0RBZFRZVzVrWW05NE1Rd3dDZ1lEVlFRTERBTkRRVlF4S2pBb0JnTlZCQU1NSVZOcFoyNXBibWNnUTJWeWRHbG1hV05oZEdVZ1YwbFVTRTlWVkNCVVVsVlRWREFlRncweU1qRXlNVEl3T1RNM01qTmFGdzB6TWpFeU1Ea3dPVE0zTWpOYU1JR0ZNUXN3Q1FZRFZRUUdFd0pPVERFV01CUUdBMVVFQ0F3TlRtOXZjbVFnU0c5c2JHRnVaREVTTUJBR0ExVUVCd3dKUVcxemRHVnlaR0Z0TVJBd0RnWURWUVFLREFkVFlXNWtZbTk0TVF3d0NnWURWUVFMREFORFFWUXhLakFvQmdOVkJBTU1JVk5wWjI1cGJtY2dRMlZ5ZEdsbWFXTmhkR1VnVjBsVVNFOVZWQ0JVVWxWVFZEQ0NBaUl3RFFZSktvWklodmNOQVFFQkJRQURnZ0lQQURDQ0Fnb0NnZ0lCQUxtOUNTQ0NuM29neXcrd0FKMFNpZndkWDFmdkNCZFFmNTN0bGVCZ1lmUGtTOHBGS1BEdUdCWmZIS2NOcmlkajNhRVArQVZBZjlKNEdMZ0tTV3UxMG03aFBybGRFN1ExYkR3OTJyNFVobDJFamY0cmFoMlc4ZUc5N09aRFFMRExkcTJhaExyUzk5REtlZVoyN1B2eHNORjRSL0UyMlh3R3hTeS9sRXZ6T2d3Zk02bUEzYXdSTHYwWjFOVGh1WTdOc09ocmhqMWROMnNpQkdhRUZWY0taWDZ3K0ZTeFRjS0IxbUNUeWpPaGZRSGcydDdvcHJQMUhCSytqOHp4ZnpJNXp2Q0h5WGh4RlBPZXlhNFRnS2t3OElRZ1VmbDIySGpPM3ZrNFR5TDJNWG41VjMrb0s2anhwTnJtZHJySXVLVVBNK0VqMCt2alNqbFNxY3Q3RHlQbERLOTlMNTBCanNiQTFPSXkyUmJsRVl1SWNmaW13bzFGa1drbk1qYmFUazh2VGdMSGxlZ0hTTU1DZXQrUVRiZGU1RnRKeGxxa3NYaDZraU4yK3BoUUIzcGdpQktHaEZwN2k4NngwWEhKczdIaVNxTUdxNzhrSmhaOENQcGpIb0NMTmg1T1drQ0FNMTFFK253VmJqa0JxYXpsc3k0dm4yVmdYaExCYVZNeFBvOGRpRDFOS1JMZXkrbnU5SUFQbFM3MlpFWWVraEc4bUpRTktTTDhEMzdZWlVFWmloaERtTXdISDlFWHBFRmZ0Y0lvaExQVmZIKzJYcVRaU3RjcVUrak5ZNlFNcXR1Y3FjL0YycjBhWDM2Vngya2ozSS9Ob0VBc1FWUnNST0dERUNhbUFnMEZIOStKb2lyQytRWTk5TitkZ3Z1alVsbTM0WUxrcEVSZWhsUjJzUDc3QWdNQkFBRXdEUVlKS29aSWh2Y05BUUVMQlFBRGdnSUJBR1J1dlFNaWpmUHlvMUg2U3RlejhoMmd6YmExOHhMdFB6elFJTzVKTHNyOVUxV1pRWllEb0tkN3IxejVMRjZtM2dQTDVEeWJ1N0thOGRScTVVck94NVRHOWc4UFJhSjhsOU52UmRmc1JocUx5UFpxeFlyTDFNSGNJZEFpN05rbGRIbUpVVFE2eDFzN1FHUjl2aUpHb0NzZVQ2cGhVTXd1QklDTFRZeTE1ZHFTRTJNSFd6bmcyTmdVKzJFWDVNQjBkK0Y4Q3RXMnp0TVM3V1ZudkVwWHhpdlRoSVdqekZMbUlRNnV5MWZvNWswNFYyeVVzN0Y2Wm5FaTBoOWgrV3YrbGRON3JtQ09JMU4vc1V6RklweDAwODgwWktKQk5sY0NkVkpRV0tDWkdUTUtvOHNqZWlqejVFT1VyRkxBbDkyR21YT09CdlovWFZZc0puVmtSa0JtSThVdW9VZWlaWEc1L3d2QjZ6ekJWWWFQWGtHbHBCOTZ1RkVldWF6cnR4YkhDbVZHbWMwQ1BGa2FqRDl6alB0TDNveEF4T1dWcDM3S3lQWVVVTGs0UWRYZzdSM09RL0ZIMWFrTDY2ajZ1N0FraEJjdzRnV2o2aCt5bGFkeWxrMW5WajdUdy9USHUwTUs1MDJUMjlDVGVqbGoyZHBzbmE5Wk12WVR4WXo5ZStNdi9nRHJvSklvWjJuT29tOHBHbHdiaXV4d1M4MWo2OThlZWU3Y0h5cFZuL0RvUWhwTXBtbXYvL0JrbkZXNm51M3NKcTNoT1BNTVNXWmE2V3hGYXBHQVdycWs5ZnRtYXRWbjJ1UlZrUTB6bTY2ZG1wK2VsakN3N2dYeUMrSGtGM2dpVjA2YVRsbmJyVUZKTnhsS1BBVy9KVDFLY2xSOUdQTjhFeWlabXpnK1ZEM0wiXSwidHlwIjoiSk9TRSIsImFsZyI6IlJTMjU2In0..dtbzPygYKSh2w5PieQjCJLJUAml4MA0IxinnrekuvwQ7MXqwrYrMLda3S3HQWwCQyUvlo752Qq-nJK_j4gu7p0lydJCrUo2IwAqRzRSo5NM4-eoapn0C-gRNmm50SfYRrasbN1AhHZYIbL1ZB811opzqPCtZl2S_6xdWzo_CUcosXbiv3hITIa9m4nGpN7TfbX-D88jLGvZx7khTRm7hY8CTo6_Bt71QfcYK06e5CCFGAumIWUtkJzL6bUsqPSihU40CIhXjk_Lo-AL2vsskwiXC-Ldouy-zcvyKAERbvTz4JSJtr2ZhSANrfW8AgTqoZ3rUEtcINv1faeYypzIrzd785-sQk5Tv5ZDUad0EISj_Aq1V5KWvM_D-BXbOweS__XXMcnnuc7l-RToHygk7NaN_ZfHOBzBvhAXILKb5ywAb0TviUxsfA6eBd5ehj0eEm215Y1LmwFCQoOK0D8G1fsQpfG6o1zdt8g2CGf-H9BFPrX6VtBVkzoh0otcV8JDz-HzrYJS65zinjyZntnCZZ-LGHnA1H5vrq-A-oeFOcwDcZ4Vl37INE5EXLP_sl7o2DSRrUK3vwuC9nPUaSqxrkNgB9uWMMsfrxqbQO-zVYM64aZr0CrMtn3arIsPnnsvvd0tqwdyyzY_iAY57UJfcD0l5GdaNzQ82ShnlzdbbsTQ' \
    -d '{"fileName":"sbx.xml.gz","fileData":"H4sIAAAAAAAAA7VVUXOiMBB+91c4vGsgtmoZTEdR77yqdZTe3JtDSURmJHohVnu//pagVSG093KZUch+u9/usruJ83iMN9U3JpJoyzuGVTeNKuPBlkY87Bgv3rDWNh5Jxelvg33MuARtnnSMveB2lGztRFL1xKaJsS1ZsLaPCbV3fsTrpmllv4ZRUWYARR1jLeXORuhwONQPjfpWhAiMLfRrMl4Eaxb7tYgn0ucBM0ilCstxExkLl0pPrEY8kjwTK+ib2H2n4iJQwkkSjigx02U5KNvdariC9aUXE2xaDzWzUcOWZ7Xse2zjloPO4K3J9PV55R0TAozn1xynFJvFPiZWHZtActrd6qThhzP5TpxpTJ42Ppfc92NgzCuiD81LriifrDOL5YivcqaZEFJeuN5y4C0n3vLHnrMlhsg/sILJRFLizYdKJX3/D8kDs7crxKugxVswftsUgYwbUhnMukBLNaZIZ6vS0Dhz5uw3HRwDyfvyqvgOupbfWvRfpdC4hYr12Wsk2V7oyle0UkTdIJAasnxBLkCvOyXTcRN3e9PuA6z2nXXXeoD2SAHNxyiUFundZtGEumCGER/BAPLSoHojl6TxTMcYipLuNIGUsZwCynt23LUIe4IsxoOfUOhsk9NQB4B31HdQ2tllAQ849bbwBwrP/A+rCrZiAo6yiNlVCzfu7psOutLRZFPC7nRjzRdUSJo8BbjqBu8dY/AyN06zcQZ0bvRiSFxfKoV+VS6l9A8lyyL4jC0dwLKmSZESThgOOFFpyahciMsy146Mgr8aG+syNq3mPW6UjU0Wwycp66d2rjl9bxReEikombNVPT1q4BpsQ6NlQo0nHZ3yX+z680F+uh9R8YKEMTvd1+Qvryawd+EHAAA="}'

Response attributes

Name	Type	In	Required	Description
X-Request-Id	String	Header	true	ID of the payment initiation, unique to the call, as determined by the initiating party.
Trace-Id	String	Header	true	Unique end-to-end trace ID generated by the Enterprise API Gateway EAG
accountNumber	String	Body	true	The initiating account number in IBAN format for the delivered payment(s).
paymentId	String	Body	true	Unique Payment ID attached to the delivered payment(s). This ID is also known as Transaction ID.

Sample response

    {
        "accountNumber": "NL12ABNA9999876523",
        "paymentId": "FCF000001414BC80"
    }

For more information, see the postInitiatePayment operation.

Step 3 - Retrieve the status of a payment

The ability to retrieve statuses is currently under construction. For reconciliation purposes, it is recommended to use the Business Account Insight API or another form of account statements. The Business Account Insight API gives you insight in the execution of the payment or possible returns.

Signing the request

This section provides steps for signing the payment request and generating a valid JWS signature.

Note: Occasionally, we also refer to the RFC7515 Internet Standard Track document. Instructions in this section need to be followed to generate a proper JWS signature for payments initiated through this API.

Step 1 - Identify the private key and corresponding signing certificate for signing

The signer must use a private key that has a corresponding digital signing certificate (that contains the corresponding public key) accepted by ABN AMRO. The signing certificate must be valid at the time of creating the JWS and during payment execution lifecycle.

Step 2 - Form the JOSE Header

The JOSE Header for the signature must contain the following fields:

Claim	Description
crit	This must be a string array consisting of the values "b64", "sigT", "sigD". This indicates that the JWS signature validator must understand and process the three additional claims.
b64	This must have the boolean value false. It indicates that the message payload is not base64 url encoded. (See RFC 7797 - The "b64" header Parameter).
sigT	Timestamp when the signature was generated in UTC (see example in https://www.ietf.org/rfc/rfc3339.txt, section 5.8). Please note: the signature is only valid for 24 hours after the entered timestamp.
sigD	Lower case HTTP Header fields to be signed.
alg	RS256 is the supported algorithms used for signing JWS.
x5c	X.509 public key certificate CHAIN encoding according to RFC 7515.

All claims are mandatory.

Sample JOSE Header

    {
      "b64": false,
      "crit": [
        "b64",
        "sigT",
        "sigD"
      ],
      "sigT": "2024-05-16T11:24:22Z",
      "sigD": {
        "pars": [
          "digest"
        ]
      },
      "x5c": [
    "MIIFkzCCA3sCFAq4mATXkvkAc93+LGL1Keo1WdKeMA0GCSqGSIb3DQEBCwUAMIGFMQswCQYDVQQGEwJOTDEWMBQGA1UECAwNTm9vcmQgSG9sbGFuZDESMBAGA1UEBwwJQW1zdGVyZGFtMRAwDgYDVQQKDAdTYW5kYm94MQwwCgYDVQQLDANDQVQxKjAoBgNVBAMMIVNpZ25pbmcgQ2VydGlmaWNhdGUgV0lUSE9VVCBUUlVTVDAeFw0yMjEyMTIwOTM3MjNaFw0zMjEyMDkwOTM3MjNaMIGFMQswCQYDVQQGEwJOTDEWMBQGA1UECAwNTm9vcmQgSG9sbGFuZDESMBAGA1UEBwwJQW1zdGVyZGFtMRAwDgYDVQQKDAdTYW5kYm94MQwwCgYDVQQLDANDQVQxKjAoBgNVBAMMIVNpZ25pbmcgQ2VydGlmaWNhdGUgV0lUSE9VVCBUUlVTVDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALm9CSCCn3ogyw+wAJ0SifwdX1fvCBdQf53tleBgYfPkS8pFKPDuGBZfHKcNridj3aEP+AVAf9J4GLgKSWu10m7hPrldE7Q1bDw92r4Uhl2Ejf4rah2W8eG97OZDQLDLdq2ahLrS99DKeeZ27PvxsNF4R/E22XwGxSy/lEvzOgwfM6mA3awRLv0Z1NThuY7NsOhrhj1dN2siBGaEFVcKZX6w+FSxTcKB1mCTyjOhfQHg2t7oprP1HBK+j8zxfzI5zvCHyXhxFPOeya4TgKkw8IQgUfl22HjO3vk4TyL2MXn5V3+oK6jxpNrmdrrIuKUPM+Ej0+vjSjlSqct7DyPlDK99L50BjsbA1OIy2RblEYuIcfimwo1FkWknMjbaTk8vTgLHlegHSMMCet+QTbde5FtJxlqksXh6kiN2+phQB3pgiBKGhFp7i86x0XHJs7HiSqMGq78kJhZ8CPpjHoCLNh5OWkCAM11E+nwVbjkBqazlsy4vn2VgXhLBaVMxPo8diD1NKRLey+nu9IAPlS72ZEYekhG8mJQNKSL8D37YZUEZihhDmMwHH9EXpEFftcIohLPVfH+2XqTZStcqU+jNY6QMqtucqc/F2r0aX36Vx2kj3I/NoEAsQVRsROGDECamAg0FH9+JoirC+QY99N+dgvujUlm34YLkpERehlR2sP77AgMBAAEwDQYJKoZIhvcNAQELBQADggIBAGRuvQMijfPyo1H6Stez8h2gzba18xLtPzzQIO5JLsr9U1WZQZYDoKd7r1z5LF6m3gPL5Dybu7Ka8dRq5UrOx5TG9g8PRaJ8l9NvRdfsRhqLyPZqxYrL1MHcIdAi7NkldHmJUTQ6x1s7QGR9viJGoCseT6phUMwuBICLTYy15dqSE2MHWzng2NgU+2EX5MB0d+F8CtW2ztMS7WVnvEpXxivThIWjzFLmIQ6uy1fo5k04V2yUs7F6ZnEi0h9h+Wv+ldN7rmCOI1N/sUzFIpx00880ZKJBNlcCdVJQWKCZGTMKo8sjeijz5EOUrFLAl92GmXOOBvZ/XVYsJnVkRkBmI8UuoUeiZXG5/wvB6zzBVYaPXkGlpB96uFEeuazrtxbHCmVGmc0CPFkajD9zjPtL3oxAxOWVp37KyPYUULk4QdXg7R3OQ/FH1akL66j6u7AkhBcw4gWj6h+yladylk1nVj7Tw/THu0MK502T29CTejlj2dpsna9ZMvYTxYz9e+Mv/gDroJIoZ2nOom8pGlwbiuxwS81j698eee7cHypVn/DoQhpMpmmv//BknFW6nu3sJq3hOPMMSWZa6WxFapGAWrqk9ftmatVn2uRVkQ0zm66dmp+eljCw7gXyC+HkF3giV06aTlnbrUFJNxlKPAW/JT1KclR9GPN8EyiZmzg+VD3L"
      ],
      "typ": "JOSE",
      "alg": "RS256"
    } 

Step 3 - Compute the JWS

The signer must compute the signature as a detached JWS through the following steps:

• 3.1. Create the JWS protected Header by filling the above mentioned JOSE Header with the appropriate values.

• 3.2. Convert the JWS Protected Header (without line breaks or extra spaces) into a Base64url encoded string.

Note: Do not confuse BASE64URL with BASE64! In BASE64URL:

• all trailing = are removed
• Character + is replaced by -
• Character / is replaced by _ .

Result of above sample JOSE

    Output: eyJiNjQiOmZhbHNlLCJjcml0IjpbImI2NCIsInNpZ1QiLCJzaWdEIl0sInNpZ1QiOiIyMDI0LTA0LTIyVDE0OjA0OjQxWiIsInNpZ0QiOnsicGFycyI6WyJkaWdlc3QiXX0sIng1YyI6WyJNSUlGa3pDQ0Ezc0NGQXE0bUFUWGt2a0FjOTMrTEdMMUtlbzFXZEtlTUEwR0NTcUdTSWIzRFFFQkN3VUFNSUdGTVFzd0NRWURWUVFHRXdKT1RERVdNQlFHQTFVRUNBd05UbTl2Y21RZ1NHOXNiR0Z1WkRFU01CQUdBMVVFQnd3SlFXMXpkR1Z5WkdGdE1SQXdEZ1lEVlFRS0RBZFRZVzVrWW05NE1Rd3dDZ1lEVlFRTERBTkRRVlF4S2pBb0JnTlZCQU1NSVZOcFoyNXBibWNnUTJWeWRHbG1hV05oZEdVZ1YwbFVTRTlWVkNCVVVsVlRWREFlRncweU1qRXlNVEl3T1RNM01qTmFGdzB6TWpFeU1Ea3dPVE0zTWpOYU1JR0ZNUXN3Q1FZRFZRUUdFd0pPVERFV01CUUdBMVVFQ0F3TlRtOXZjbVFnU0c5c2JHRnVaREVTTUJBR0ExVUVCd3dKUVcxemRHVnlaR0Z0TVJBd0RnWURWUVFLREFkVFlXNWtZbTk0TVF3d0NnWURWUVFMREFORFFWUXhLakFvQmdOVkJBTU1JVk5wWjI1cGJtY2dRMlZ5ZEdsbWFXTmhkR1VnVjBsVVNFOVZWQ0JVVWxWVFZEQ0NBaUl3RFFZSktvWklodmNOQVFFQkJRQURnZ0lQQURDQ0Fnb0NnZ0lCQUxtOUNTQ0NuM29neXcrd0FKMFNpZndkWDFmdkNCZFFmNTN0bGVCZ1lmUGtTOHBGS1BEdUdCWmZIS2NOcmlkajNhRVArQVZBZjlKNEdMZ0tTV3UxMG03aFBybGRFN1ExYkR3OTJyNFVobDJFamY0cmFoMlc4ZUc5N09aRFFMRExkcTJhaExyUzk5REtlZVoyN1B2eHNORjRSL0UyMlh3R3hTeS9sRXZ6T2d3Zk02bUEzYXdSTHYwWjFOVGh1WTdOc09ocmhqMWROMnNpQkdhRUZWY0taWDZ3K0ZTeFRjS0IxbUNUeWpPaGZRSGcydDdvcHJQMUhCSytqOHp4ZnpJNXp2Q0h5WGh4RlBPZXlhNFRnS2t3OElRZ1VmbDIySGpPM3ZrNFR5TDJNWG41VjMrb0s2anhwTnJtZHJySXVLVVBNK0VqMCt2alNqbFNxY3Q3RHlQbERLOTlMNTBCanNiQTFPSXkyUmJsRVl1SWNmaW13bzFGa1drbk1qYmFUazh2VGdMSGxlZ0hTTU1DZXQrUVRiZGU1RnRKeGxxa3NYaDZraU4yK3BoUUIzcGdpQktHaEZwN2k4NngwWEhKczdIaVNxTUdxNzhrSmhaOENQcGpIb0NMTmg1T1drQ0FNMTFFK253VmJqa0JxYXpsc3k0dm4yVmdYaExCYVZNeFBvOGRpRDFOS1JMZXkrbnU5SUFQbFM3MlpFWWVraEc4bUpRTktTTDhEMzdZWlVFWmloaERtTXdISDlFWHBFRmZ0Y0lvaExQVmZIKzJYcVRaU3RjcVUrak5ZNlFNcXR1Y3FjL0YycjBhWDM2Vngya2ozSS9Ob0VBc1FWUnNST0dERUNhbUFnMEZIOStKb2lyQytRWTk5TitkZ3Z1alVsbTM0WUxrcEVSZWhsUjJzUDc3QWdNQkFBRXdEUVlKS29aSWh2Y05BUUVMQlFBRGdnSUJBR1J1dlFNaWpmUHlvMUg2U3RlejhoMmd6YmExOHhMdFB6elFJTzVKTHNyOVUxV1pRWllEb0tkN3IxejVMRjZtM2dQTDVEeWJ1N0thOGRScTVVck94NVRHOWc4UFJhSjhsOU52UmRmc1JocUx5UFpxeFlyTDFNSGNJZEFpN05rbGRIbUpVVFE2eDFzN1FHUjl2aUpHb0NzZVQ2cGhVTXd1QklDTFRZeTE1ZHFTRTJNSFd6bmcyTmdVKzJFWDVNQjBkK0Y4Q3RXMnp0TVM3V1ZudkVwWHhpdlRoSVdqekZMbUlRNnV5MWZvNWswNFYyeVVzN0Y2Wm5FaTBoOWgrV3YrbGRON3JtQ09JMU4vc1V6RklweDAwODgwWktKQk5sY0NkVkpRV0tDWkdUTUtvOHNqZWlqejVFT1VyRkxBbDkyR21YT09CdlovWFZZc0puVmtSa0JtSThVdW9VZWlaWEc1L3d2QjZ6ekJWWWFQWGtHbHBCOTZ1RkVldWF6cnR4YkhDbVZHbWMwQ1BGa2FqRDl6alB0TDNveEF4T1dWcDM3S3lQWVVVTGs0UWRYZzdSM09RL0ZIMWFrTDY2ajZ1N0FraEJjdzRnV2o2aCt5bGFkeWxrMW5WajdUdy9USHUwTUs1MDJUMjlDVGVqbGoyZHBzbmE5Wk12WVR4WXo5ZStNdi9nRHJvSklvWjJuT29tOHBHbHdiaXV4d1M4MWo2OThlZWU3Y0h5cFZuL0RvUWhwTXBtbXYvL0JrbkZXNm51M3NKcTNoT1BNTVNXWmE2V3hGYXBHQVdycWs5ZnRtYXRWbjJ1UlZrUTB6bTY2ZG1wK2VsakN3N2dYeUMrSGtGM2dpVjA2YVRsbmJyVUZKTnhsS1BBVy9KVDFLY2xSOUdQTjhFeWlabXpnK1ZEM0wiXSwidHlwIjoiSk9TRSIsImFsZyI6IlJTMjU2In0

Note: Using a different date in the JWS header as in the example above will result in a different output

• 3.3. Calculate the hash of the HTTP Body. The HTTP Body is the payload without HTTP header and following empty line, like shown in below example. We only accept SHA-256 hashing.

Please use the below payload example as is in order to compare the output during development.

Example

    Http Body(Payload): 
    {"fileName":"sbx.xml.gz","fileData":"H4sIAAAAAAAAA7VVUXOiMBB+91c4vGsgtmoZTEdR77yqdZTe3JtDSURmJHohVnu//pagVSG093KZUch+u9/usruJ83iMN9U3JpJoyzuGVTeNKuPBlkY87Bgv3rDWNh5Jxelvg33MuARtnnSMveB2lGztRFL1xKaJsS1ZsLaPCbV3fsTrpmllv4ZRUWYARR1jLeXORuhwONQPjfpWhAiMLfRrMl4Eaxb7tYgn0ucBM0ilCstxExkLl0pPrEY8kjwTK+ib2H2n4iJQwkkSjigx02U5KNvdariC9aUXE2xaDzWzUcOWZ7Xse2zjloPO4K3J9PV55R0TAozn1xynFJvFPiZWHZtActrd6qThhzP5TpxpTJ42Ppfc92NgzCuiD81LriifrDOL5YivcqaZEFJeuN5y4C0n3vLHnrMlhsg/sILJRFLizYdKJX3/D8kDs7crxKugxVswftsUgYwbUhnMukBLNaZIZ6vS0Dhz5uw3HRwDyfvyqvgOupbfWvRfpdC4hYr12Wsk2V7oyle0UkTdIJAasnxBLkCvOyXTcRN3e9PuA6z2nXXXeoD2SAHNxyiUFundZtGEumCGER/BAPLSoHojl6TxTMcYipLuNIGUsZwCynt23LUIe4IsxoOfUOhsk9NQB4B31HdQ2tllAQ849bbwBwrP/A+rCrZiAo6yiNlVCzfu7psOutLRZFPC7nRjzRdUSJo8BbjqBu8dY/AyN06zcQZ0bvRiSFxfKoV+VS6l9A8lyyL4jC0dwLKmSZESThgOOFFpyahciMsy146Mgr8aG+syNq3mPW6UjU0Wwycp66d2rjl9bxReEikombNVPT1q4BpsQ6NlQo0nHZ3yX+z680F+uh9R8YKEMTvd1+Qvryawd+EHAAA="}
   
    Output(BASE64 Encoded): QBazp7jo/QrtHysfTvATARKKVRgCj9HtFkm4Ha380To=

• 3.4. Create the HTTP header string by concatenating all HTTP headers that are identified in the sigD attribute in the JWS header. For now the only HTTP header expected for this part is the Digest created in step 3.3..

Example

    Output: Digest:SHA-256=QBazp7jo/QrtHysfTvATARKKVRgCj9HtFkm4Ha380To=

• 3.5. Combine the Base64url encoded JWS Protected Header created in step 3.2 with the HTTP headers string created in 3.4., separated by ".".

So the structure is as follows: [result of step 3.2].[result of step 3.4]

Example based on the above calculated values

    Output: eyJiNjQiOmZhbHNlLCJjcml0IjpbImI2NCIsInNpZ1QiLCJzaWdEIl0sInNpZ1QiOiIyMDI0LTA0LTIyVDE0OjA0OjQxWiIsInNpZ0QiOnsicGFycyI6WyJkaWdlc3QiXX0sIng1YyI6WyJNSUlGa3pDQ0Ezc0NGQXE0bUFUWGt2a0FjOTMrTEdMMUtlbzFXZEtlTUEwR0NTcUdTSWIzRFFFQkN3VUFNSUdGTVFzd0NRWURWUVFHRXdKT1RERVdNQlFHQTFVRUNBd05UbTl2Y21RZ1NHOXNiR0Z1WkRFU01CQUdBMVVFQnd3SlFXMXpkR1Z5WkdGdE1SQXdEZ1lEVlFRS0RBZFRZVzVrWW05NE1Rd3dDZ1lEVlFRTERBTkRRVlF4S2pBb0JnTlZCQU1NSVZOcFoyNXBibWNnUTJWeWRHbG1hV05oZEdVZ1YwbFVTRTlWVkNCVVVsVlRWREFlRncweU1qRXlNVEl3T1RNM01qTmFGdzB6TWpFeU1Ea3dPVE0zTWpOYU1JR0ZNUXN3Q1FZRFZRUUdFd0pPVERFV01CUUdBMVVFQ0F3TlRtOXZjbVFnU0c5c2JHRnVaREVTTUJBR0ExVUVCd3dKUVcxemRHVnlaR0Z0TVJBd0RnWURWUVFLREFkVFlXNWtZbTk0TVF3d0NnWURWUVFMREFORFFWUXhLakFvQmdOVkJBTU1JVk5wWjI1cGJtY2dRMlZ5ZEdsbWFXTmhkR1VnVjBsVVNFOVZWQ0JVVWxWVFZEQ0NBaUl3RFFZSktvWklodmNOQVFFQkJRQURnZ0lQQURDQ0Fnb0NnZ0lCQUxtOUNTQ0NuM29neXcrd0FKMFNpZndkWDFmdkNCZFFmNTN0bGVCZ1lmUGtTOHBGS1BEdUdCWmZIS2NOcmlkajNhRVArQVZBZjlKNEdMZ0tTV3UxMG03aFBybGRFN1ExYkR3OTJyNFVobDJFamY0cmFoMlc4ZUc5N09aRFFMRExkcTJhaExyUzk5REtlZVoyN1B2eHNORjRSL0UyMlh3R3hTeS9sRXZ6T2d3Zk02bUEzYXdSTHYwWjFOVGh1WTdOc09ocmhqMWROMnNpQkdhRUZWY0taWDZ3K0ZTeFRjS0IxbUNUeWpPaGZRSGcydDdvcHJQMUhCSytqOHp4ZnpJNXp2Q0h5WGh4RlBPZXlhNFRnS2t3OElRZ1VmbDIySGpPM3ZrNFR5TDJNWG41VjMrb0s2anhwTnJtZHJySXVLVVBNK0VqMCt2alNqbFNxY3Q3RHlQbERLOTlMNTBCanNiQTFPSXkyUmJsRVl1SWNmaW13bzFGa1drbk1qYmFUazh2VGdMSGxlZ0hTTU1DZXQrUVRiZGU1RnRKeGxxa3NYaDZraU4yK3BoUUIzcGdpQktHaEZwN2k4NngwWEhKczdIaVNxTUdxNzhrSmhaOENQcGpIb0NMTmg1T1drQ0FNMTFFK253VmJqa0JxYXpsc3k0dm4yVmdYaExCYVZNeFBvOGRpRDFOS1JMZXkrbnU5SUFQbFM3MlpFWWVraEc4bUpRTktTTDhEMzdZWlVFWmloaERtTXdISDlFWHBFRmZ0Y0lvaExQVmZIKzJYcVRaU3RjcVUrak5ZNlFNcXR1Y3FjL0YycjBhWDM2Vngya2ozSS9Ob0VBc1FWUnNST0dERUNhbUFnMEZIOStKb2lyQytRWTk5TitkZ3Z1alVsbTM0WUxrcEVSZWhsUjJzUDc3QWdNQkFBRXdEUVlKS29aSWh2Y05BUUVMQlFBRGdnSUJBR1J1dlFNaWpmUHlvMUg2U3RlejhoMmd6YmExOHhMdFB6elFJTzVKTHNyOVUxV1pRWllEb0tkN3IxejVMRjZtM2dQTDVEeWJ1N0thOGRScTVVck94NVRHOWc4UFJhSjhsOU52UmRmc1JocUx5UFpxeFlyTDFNSGNJZEFpN05rbGRIbUpVVFE2eDFzN1FHUjl2aUpHb0NzZVQ2cGhVTXd1QklDTFRZeTE1ZHFTRTJNSFd6bmcyTmdVKzJFWDVNQjBkK0Y4Q3RXMnp0TVM3V1ZudkVwWHhpdlRoSVdqekZMbUlRNnV5MWZvNWswNFYyeVVzN0Y2Wm5FaTBoOWgrV3YrbGRON3JtQ09JMU4vc1V6RklweDAwODgwWktKQk5sY0NkVkpRV0tDWkdUTUtvOHNqZWlqejVFT1VyRkxBbDkyR21YT09CdlovWFZZc0puVmtSa0JtSThVdW9VZWlaWEc1L3d2QjZ6ekJWWWFQWGtHbHBCOTZ1RkVldWF6cnR4YkhDbVZHbWMwQ1BGa2FqRDl6alB0TDNveEF4T1dWcDM3S3lQWVVVTGs0UWRYZzdSM09RL0ZIMWFrTDY2ajZ1N0FraEJjdzRnV2o2aCt5bGFkeWxrMW5WajdUdy9USHUwTUs1MDJUMjlDVGVqbGoyZHBzbmE5Wk12WVR4WXo5ZStNdi9nRHJvSklvWjJuT29tOHBHbHdiaXV4d1M4MWo2OThlZWU3Y0h5cFZuL0RvUWhwTXBtbXYvL0JrbkZXNm51M3NKcTNoT1BNTVNXWmE2V3hGYXBHQVdycWs5ZnRtYXRWbjJ1UlZrUTB6bTY2ZG1wK2VsakN3N2dYeUMrSGtGM2dpVjA2YVRsbmJyVUZKTnhsS1BBVy9KVDFLY2xSOUdQTjhFeWlabXpnK1ZEM0wiXSwidHlwIjoiSk9TRSIsImFsZyI6IlJTMjU2In0.Digest:SHA-256=QBazp7jo/QrtHysfTvATARKKVRgCj9HtFkm4Ha380To=

• 3.6. Compute the JWS Signature value. This is created using the private key associated with the certificate identified in the JWS Protected Header "x5c" and using the signature algorithm identified by "alg" (which for now will only be RS256).

Example

    Output: dtbzPygYKSh2w5PieQjCJLJUAml4MA0IxinnrekuvwQ7MXqwrYrMLda3S3HQWwCQyUvlo752Qq-nJK_j4gu7p0lydJCrUo2IwAqRzRSo5NM4-eoapn0C-gRNmm50SfYRrasbN1AhHZYIbL1ZB811opzqPCtZl2S_6xdWzo_CUcosXbiv3hITIa9m4nGpN7TfbX-D88jLGvZx7khTRm7hY8CTo6_Bt71QfcYK06e5CCFGAumIWUtkJzL6bUsqPSihU40CIhXjk_Lo-AL2vsskwiXC-Ldouy-zcvyKAERbvTz4JSJtr2ZhSANrfW8AgTqoZ3rUEtcINv1faeYypzIrzd785-sQk5Tv5ZDUad0EISj_Aq1V5KWvM_D-BXbOweS__XXMcnnuc7l-RToHygk7NaN_ZfHOBzBvhAXILKb5ywAb0TviUxsfA6eBd5ehj0eEm215Y1LmwFCQoOK0D8G1fsQpfG6o1zdt8g2CGf-H9BFPrX6VtBVkzoh0otcV8JDz-HzrYJS65zinjyZntnCZZ-LGHnA1H5vrq-A-oeFOcwDcZ4Vl37INE5EXLP_sl7o2DSRrUK3vwuC9nPUaSqxrkNgB9uWMMsfrxqbQO-zVYM64aZr0CrMtn3arIsPnnsvvd0tqwdyyzY_iAY57UJfcD0l5GdaNzQ82ShnlzdbbsTQ

• 3.7. Build the JSON Web Signature. Create JSON Web Signature by concatenating the Base64url encoded JWS Protected header from step 3.2. and the JWS Signature Value from step 3.6., separated by "..".

Example

    Output: eyJiNjQiOmZhbHNlLCJjcml0IjpbImI2NCIsInNpZ1QiLCJzaWdEIl0sInNpZ1QiOiIyMDI0LTA1LTE2VDExOjI0OjIyWiIsInNpZ0QiOnsicGFycyI6WyJkaWdlc3QiXX0sIng1YyI6WyJNSUlGa3pDQ0Ezc0NGQXE0bUFUWGt2a0FjOTMrTEdMMUtlbzFXZEtlTUEwR0NTcUdTSWIzRFFFQkN3VUFNSUdGTVFzd0NRWURWUVFHRXdKT1RERVdNQlFHQTFVRUNBd05UbTl2Y21RZ1NHOXNiR0Z1WkRFU01CQUdBMVVFQnd3SlFXMXpkR1Z5WkdGdE1SQXdEZ1lEVlFRS0RBZFRZVzVrWW05NE1Rd3dDZ1lEVlFRTERBTkRRVlF4S2pBb0JnTlZCQU1NSVZOcFoyNXBibWNnUTJWeWRHbG1hV05oZEdVZ1YwbFVTRTlWVkNCVVVsVlRWREFlRncweU1qRXlNVEl3T1RNM01qTmFGdzB6TWpFeU1Ea3dPVE0zTWpOYU1JR0ZNUXN3Q1FZRFZRUUdFd0pPVERFV01CUUdBMVVFQ0F3TlRtOXZjbVFnU0c5c2JHRnVaREVTTUJBR0ExVUVCd3dKUVcxemRHVnlaR0Z0TVJBd0RnWURWUVFLREFkVFlXNWtZbTk0TVF3d0NnWURWUVFMREFORFFWUXhLakFvQmdOVkJBTU1JVk5wWjI1cGJtY2dRMlZ5ZEdsbWFXTmhkR1VnVjBsVVNFOVZWQ0JVVWxWVFZEQ0NBaUl3RFFZSktvWklodmNOQVFFQkJRQURnZ0lQQURDQ0Fnb0NnZ0lCQUxtOUNTQ0NuM29neXcrd0FKMFNpZndkWDFmdkNCZFFmNTN0bGVCZ1lmUGtTOHBGS1BEdUdCWmZIS2NOcmlkajNhRVArQVZBZjlKNEdMZ0tTV3UxMG03aFBybGRFN1ExYkR3OTJyNFVobDJFamY0cmFoMlc4ZUc5N09aRFFMRExkcTJhaExyUzk5REtlZVoyN1B2eHNORjRSL0UyMlh3R3hTeS9sRXZ6T2d3Zk02bUEzYXdSTHYwWjFOVGh1WTdOc09ocmhqMWROMnNpQkdhRUZWY0taWDZ3K0ZTeFRjS0IxbUNUeWpPaGZRSGcydDdvcHJQMUhCSytqOHp4ZnpJNXp2Q0h5WGh4RlBPZXlhNFRnS2t3OElRZ1VmbDIySGpPM3ZrNFR5TDJNWG41VjMrb0s2anhwTnJtZHJySXVLVVBNK0VqMCt2alNqbFNxY3Q3RHlQbERLOTlMNTBCanNiQTFPSXkyUmJsRVl1SWNmaW13bzFGa1drbk1qYmFUazh2VGdMSGxlZ0hTTU1DZXQrUVRiZGU1RnRKeGxxa3NYaDZraU4yK3BoUUIzcGdpQktHaEZwN2k4NngwWEhKczdIaVNxTUdxNzhrSmhaOENQcGpIb0NMTmg1T1drQ0FNMTFFK253VmJqa0JxYXpsc3k0dm4yVmdYaExCYVZNeFBvOGRpRDFOS1JMZXkrbnU5SUFQbFM3MlpFWWVraEc4bUpRTktTTDhEMzdZWlVFWmloaERtTXdISDlFWHBFRmZ0Y0lvaExQVmZIKzJYcVRaU3RjcVUrak5ZNlFNcXR1Y3FjL0YycjBhWDM2Vngya2ozSS9Ob0VBc1FWUnNST0dERUNhbUFnMEZIOStKb2lyQytRWTk5TitkZ3Z1alVsbTM0WUxrcEVSZWhsUjJzUDc3QWdNQkFBRXdEUVlKS29aSWh2Y05BUUVMQlFBRGdnSUJBR1J1dlFNaWpmUHlvMUg2U3RlejhoMmd6YmExOHhMdFB6elFJTzVKTHNyOVUxV1pRWllEb0tkN3IxejVMRjZtM2dQTDVEeWJ1N0thOGRScTVVck94NVRHOWc4UFJhSjhsOU52UmRmc1JocUx5UFpxeFlyTDFNSGNJZEFpN05rbGRIbUpVVFE2eDFzN1FHUjl2aUpHb0NzZVQ2cGhVTXd1QklDTFRZeTE1ZHFTRTJNSFd6bmcyTmdVKzJFWDVNQjBkK0Y4Q3RXMnp0TVM3V1ZudkVwWHhpdlRoSVdqekZMbUlRNnV5MWZvNWswNFYyeVVzN0Y2Wm5FaTBoOWgrV3YrbGRON3JtQ09JMU4vc1V6RklweDAwODgwWktKQk5sY0NkVkpRV0tDWkdUTUtvOHNqZWlqejVFT1VyRkxBbDkyR21YT09CdlovWFZZc0puVmtSa0JtSThVdW9VZWlaWEc1L3d2QjZ6ekJWWWFQWGtHbHBCOTZ1RkVldWF6cnR4YkhDbVZHbWMwQ1BGa2FqRDl6alB0TDNveEF4T1dWcDM3S3lQWVVVTGs0UWRYZzdSM09RL0ZIMWFrTDY2ajZ1N0FraEJjdzRnV2o2aCt5bGFkeWxrMW5WajdUdy9USHUwTUs1MDJUMjlDVGVqbGoyZHBzbmE5Wk12WVR4WXo5ZStNdi9nRHJvSklvWjJuT29tOHBHbHdiaXV4d1M4MWo2OThlZWU3Y0h5cFZuL0RvUWhwTXBtbXYvL0JrbkZXNm51M3NKcTNoT1BNTVNXWmE2V3hGYXBHQVdycWs5ZnRtYXRWbjJ1UlZrUTB6bTY2ZG1wK2VsakN3N2dYeUMrSGtGM2dpVjA2YVRsbmJyVUZKTnhsS1BBVy9KVDFLY2xSOUdQTjhFeWlabXpnK1ZEM0wiXSwidHlwIjoiSk9TRSIsImFsZyI6IlJTMjU2In0..dtbzPygYKSh2w5PieQjCJLJUAml4MA0IxinnrekuvwQ7MXqwrYrMLda3S3HQWwCQyUvlo752Qq-nJK_j4gu7p0lydJCrUo2IwAqRzRSo5NM4-eoapn0C-gRNmm50SfYRrasbN1AhHZYIbL1ZB811opzqPCtZl2S_6xdWzo_CUcosXbiv3hITIa9m4nGpN7TfbX-D88jLGvZx7khTRm7hY8CTo6_Bt71QfcYK06e5CCFGAumIWUtkJzL6bUsqPSihU40CIhXjk_Lo-AL2vsskwiXC-Ldouy-zcvyKAERbvTz4JSJtr2ZhSANrfW8AgTqoZ3rUEtcINv1faeYypzIrzd785-sQk5Tv5ZDUad0EISj_Aq1V5KWvM_D-BXbOweS__XXMcnnuc7l-RToHygk7NaN_ZfHOBzBvhAXILKb5ywAb0TviUxsfA6eBd5ehj0eEm215Y1LmwFCQoOK0D8G1fsQpfG6o1zdt8g2CGf-H9BFPrX6VtBVkzoh0otcV8JDz-HzrYJS65zinjyZntnCZZ-LGHnA1H5vrq-A-oeFOcwDcZ4Vl37INE5EXLP_sl7o2DSRrUK3vwuC9nPUaSqxrkNgB9uWMMsfrxqbQO-zVYM64aZr0CrMtn3arIsPnnsvvd0tqwdyyzY_iAY57UJfcD0l5GdaNzQ82ShnlzdbbsTQ

Step 4 - Add the JWS as a HTTP header

The signer must include an HTTP header called Signature with its value set to the signature computed in Step 3.

Example

```shell
'Accept: application/json'  \
-H 'Authorization: Bearer X1PTWZre0fnW72l263yrhAWB2FDwx3tg' \
-H 'X-Request-Id: bc69c490-9524-413f-971a-21f1aecd9fe5' \
-H 'Content-Type: application/json'  \
-H 'API-Key: X1QTWZre0fnW72l263yrhAWB2FDwx3tg' \
-H 'Digest:SHA-256=QBazp7jo/QrtHysfTvATARKKVRgCj9HtFkm4Ha380To=' \
-H 'Signature:eyJiNjQiOmZhbHNlLCJjcml0IjpbImI2NCIsInNpZ1QiLCJzaWdEIl0sInNpZ1QiOiIyMDI0LTA1LTE2VDExOjI0OjIyWiIsInNpZ0QiOnsicGFycyI6WyJkaWdlc3QiXX0sIng1YyI6WyJNSUlGa3pDQ0Ezc0NGQXE0bUFUWGt2a0FjOTMrTEdMMUtlbzFXZEtlTUEwR0NTcUdTSWIzRFFFQkN3VUFNSUdGTVFzd0NRWURWUVFHRXdKT1RERVdNQlFHQTFVRUNBd05UbTl2Y21RZ1NHOXNiR0Z1WkRFU01CQUdBMVVFQnd3SlFXMXpkR1Z5WkdGdE1SQXdEZ1lEVlFRS0RBZFRZVzVrWW05NE1Rd3dDZ1lEVlFRTERBTkRRVlF4S2pBb0JnTlZCQU1NSVZOcFoyNXBibWNnUTJWeWRHbG1hV05oZEdVZ1YwbFVTRTlWVkNCVVVsVlRWREFlRncweU1qRXlNVEl3T1RNM01qTmFGdzB6TWpFeU1Ea3dPVE0zTWpOYU1JR0ZNUXN3Q1FZRFZRUUdFd0pPVERFV01CUUdBMVVFQ0F3TlRtOXZjbVFnU0c5c2JHRnVaREVTTUJBR0ExVUVCd3dKUVcxemRHVnlaR0Z0TVJBd0RnWURWUVFLREFkVFlXNWtZbTk0TVF3d0NnWURWUVFMREFORFFWUXhLakFvQmdOVkJBTU1JVk5wWjI1cGJtY2dRMlZ5ZEdsbWFXTmhkR1VnVjBsVVNFOVZWQ0JVVWxWVFZEQ0NBaUl3RFFZSktvWklodmNOQVFFQkJRQURnZ0lQQURDQ0Fnb0NnZ0lCQUxtOUNTQ0NuM29neXcrd0FKMFNpZndkWDFmdkNCZFFmNTN0bGVCZ1lmUGtTOHBGS1BEdUdCWmZIS2NOcmlkajNhRVArQVZBZjlKNEdMZ0tTV3UxMG03aFBybGRFN1ExYkR3OTJyNFVobDJFamY0cmFoMlc4ZUc5N09aRFFMRExkcTJhaExyUzk5REtlZVoyN1B2eHNORjRSL0UyMlh3R3hTeS9sRXZ6T2d3Zk02bUEzYXdSTHYwWjFOVGh1WTdOc09ocmhqMWROMnNpQkdhRUZWY0taWDZ3K0ZTeFRjS0IxbUNUeWpPaGZRSGcydDdvcHJQMUhCSytqOHp4ZnpJNXp2Q0h5WGh4RlBPZXlhNFRnS2t3OElRZ1VmbDIySGpPM3ZrNFR5TDJNWG41VjMrb0s2anhwTnJtZHJySXVLVVBNK0VqMCt2alNqbFNxY3Q3RHlQbERLOTlMNTBCanNiQTFPSXkyUmJsRVl1SWNmaW13bzFGa1drbk1qYmFUazh2VGdMSGxlZ0hTTU1DZXQrUVRiZGU1RnRKeGxxa3NYaDZraU4yK3BoUUIzcGdpQktHaEZwN2k4NngwWEhKczdIaVNxTUdxNzhrSmhaOENQcGpIb0NMTmg1T1drQ0FNMTFFK253VmJqa0JxYXpsc3k0dm4yVmdYaExCYVZNeFBvOGRpRDFOS1JMZXkrbnU5SUFQbFM3MlpFWWVraEc4bUpRTktTTDhEMzdZWlVFWmloaERtTXdISDlFWHBFRmZ0Y0lvaExQVmZIKzJYcVRaU3RjcVUrak5ZNlFNcXR1Y3FjL0YycjBhWDM2Vngya2ozSS9Ob0VBc1FWUnNST0dERUNhbUFnMEZIOStKb2lyQytRWTk5TitkZ3Z1alVsbTM0WUxrcEVSZWhsUjJzUDc3QWdNQkFBRXdEUVlKS29aSWh2Y05BUUVMQlFBRGdnSUJBR1J1dlFNaWpmUHlvMUg2U3RlejhoMmd6YmExOHhMdFB6elFJTzVKTHNyOVUxV1pRWllEb0tkN3IxejVMRjZtM2dQTDVEeWJ1N0thOGRScTVVck94NVRHOWc4UFJhSjhsOU52UmRmc1JocUx5UFpxeFlyTDFNSGNJZEFpN05rbGRIbUpVVFE2eDFzN1FHUjl2aUpHb0NzZVQ2cGhVTXd1QklDTFRZeTE1ZHFTRTJNSFd6bmcyTmdVKzJFWDVNQjBkK0Y4Q3RXMnp0TVM3V1ZudkVwWHhpdlRoSVdqekZMbUlRNnV5MWZvNWswNFYyeVVzN0Y2Wm5FaTBoOWgrV3YrbGRON3JtQ09JMU4vc1V6RklweDAwODgwWktKQk5sY0NkVkpRV0tDWkdUTUtvOHNqZWlqejVFT1VyRkxBbDkyR21YT09CdlovWFZZc0puVmtSa0JtSThVdW9VZWlaWEc1L3d2QjZ6ekJWWWFQWGtHbHBCOTZ1RkVldWF6cnR4YkhDbVZHbWMwQ1BGa2FqRDl6alB0TDNveEF4T1dWcDM3S3lQWVVVTGs0UWRYZzdSM09RL0ZIMWFrTDY2ajZ1N0FraEJjdzRnV2o2aCt5bGFkeWxrMW5WajdUdy9USHUwTUs1MDJUMjlDVGVqbGoyZHBzbmE5Wk12WVR4WXo5ZStNdi9nRHJvSklvWjJuT29tOHBHbHdiaXV4d1M4MWo2OThlZWU3Y0h5cFZuL0RvUWhwTXBtbXYvL0JrbkZXNm51M3NKcTNoT1BNTVNXWmE2V3hGYXBHQVdycWs5ZnRtYXRWbjJ1UlZrUTB6bTY2ZG1wK2VsakN3N2dYeUMrSGtGM2dpVjA2YVRsbmJyVUZKTnhsS1BBVy9KVDFLY2xSOUdQTjhFeWlabXpnK1ZEM0wiXSwidHlwIjoiSk9TRSIsImFsZyI6IlJTMjU2In0..dtbzPygYKSh2w5PieQjCJLJUAml4MA0IxinnrekuvwQ7MXqwrYrMLda3S3HQWwCQyUvlo752Qq-nJK_j4gu7p0lydJCrUo2IwAqRzRSo5NM4-eoapn0C-gRNmm50SfYRrasbN1AhHZYIbL1ZB811opzqPCtZl2S_6xdWzo_CUcosXbiv3hITIa9m4nGpN7TfbX-D88jLGvZx7khTRm7hY8CTo6_Bt71QfcYK06e5CCFGAumIWUtkJzL6bUsqPSihU40CIhXjk_Lo-AL2vsskwiXC-Ldouy-zcvyKAERbvTz4JSJtr2ZhSANrfW8AgTqoZ3rUEtcINv1faeYypzIrzd785-sQk5Tv5ZDUad0EISj_Aq1V5KWvM_D-BXbOweS__XXMcnnuc7l-RToHygk7NaN_ZfHOBzBvhAXILKb5ywAb0TviUxsfA6eBd5ehj0eEm215Y1LmwFCQoOK0D8G1fsQpfG6o1zdt8g2CGf-H9BFPrX6VtBVkzoh0otcV8JDz-HzrYJS65zinjyZntnCZZ-LGHnA1H5vrq-A-oeFOcwDcZ4Vl37INE5EXLP_sl7o2DSRrUK3vwuC9nPUaSqxrkNgB9uWMMsfrxqbQO-zVYM64aZr0CrMtn3arIsPnnsvvd0tqwdyyzY_iAY57UJfcD0l5GdaNzQ82ShnlzdbbsTQ' \
-d '{"fileName":"sbx.xml.gz","fileData":"H4sIAAAAAAAAA7VVUXOiMBB+91c4vGsgtmoZTEdR77yqdZTe3JtDSURmJHohVnu//pagVSG093KZUch+u9/usruJ83iMN9U3JpJoyzuGVTeNKuPBlkY87Bgv3rDWNh5Jxelvg33MuARtnnSMveB2lGztRFL1xKaJsS1ZsLaPCbV3fsTrpmllv4ZRUWYARR1jLeXORuhwONQPjfpWhAiMLfRrMl4Eaxb7tYgn0ucBM0ilCstxExkLl0pPrEY8kjwTK+ib2H2n4iJQwkkSjigx02U5KNvdariC9aUXE2xaDzWzUcOWZ7Xse2zjloPO4K3J9PV55R0TAozn1xynFJvFPiZWHZtActrd6qThhzP5TpxpTJ42Ppfc92NgzCuiD81LriifrDOL5YivcqaZEFJeuN5y4C0n3vLHnrMlhsg/sILJRFLizYdKJX3/D8kDs7crxKugxVswftsUgYwbUhnMukBLNaZIZ6vS0Dhz5uw3HRwDyfvyqvgOupbfWvRfpdC4hYr12Wsk2V7oyle0UkTdIJAasnxBLkCvOyXTcRN3e9PuA6z2nXXXeoD2SAHNxyiUFundZtGEumCGER/BAPLSoHojl6TxTMcYipLuNIGUsZwCynt23LUIe4IsxoOfUOhsk9NQB4B31HdQ2tllAQ849bbwBwrP/A+rCrZiAo6yiNlVCzfu7psOutLRZFPC7nRjzRdUSJo8BbjqBu8dY/AyN06zcQZ0bvRiSFxfKoV+VS6l9A8lyyL4jC0dwLKmSZESThgOOFFpyahciMsy146Mgr8aG+syNq3mPW6UjU0Wwycp66d2rjl9bxReEikombNVPT1q4BpsQ6NlQo0nHZ3yX+z680F+uh9R8YKEMTvd1+Qvryawd+EHAAA="}'