Bankid No BankID CSC API

Name: BankID CSC API
Brand: BankID CSC API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentIdentity AuthIdentity Verificationoauth27 EndpointsREST

For Agents

Issue BankID CSC OAuth tokens, list and authorise a user's signing credentials, and produce remote digital signatures over hash values for Norway-bound documents.

Install Jentic One Beta

Connect the BankID CSC API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the BankID CSC API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fbankid.no%2Fbankid" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fbankid.no%2Fbankid" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with BankID CSC API.

Obtain OAuth2 client-credentials tokens scoped to esign/csc or esign/nnin

Enumerate the CSC methods a BankID remote service supports

List the signing credentials associated with a BankID user identifier

GET STARTED

Start building with BankID CSC API

Explore with Jentic One

View OpenAPI Document

Jentic publishes the only available OpenAPI specification for BankID CSC API, keeping it validated and agent-ready. BankID CSC is the Cloud Signature Consortium implementation for Norway's BankID, used for legally binding remote electronic signatures. The seven endpoints cover OAuth2 token issuance, service info, listing and retrieving a user's credentials, authorising access to a credential, and producing a remote digital signature over one or multiple hash values. The spec ships with both preproduction and production server URLs, and it follows the CSC v2 standard so signing flows from any compliant signer can be wired against it.

Use Cases

Patterns agents use BankID CSC API for, with concrete tasks.

★ Norwegian Legal eSign Backend

Build the signing backend for a Norwegian eSign product by combining the OAuth2 token endpoint, /credentials/list, /credentials/authorize, and /signatures/signHash. The flow obtains client credentials, surfaces the user's BankID-bound certificates, asks the user to authorise the credential, then signs the document hash. The result is a CMS or PAdES-compatible signature attached to a PDF or other artefact.

Get an access token via POST /oauth2/token, call /credentials/list for the user, /credentials/authorize for the chosen credential, then POST /signatures/signHash with the document hash.

Cross-Border eIDAS Workflow

Integrate BankID CSC into a cross-border eIDAS-compliant signing platform that already supports other CSC-compliant providers. Because BankID exposes the standard CSC v2 endpoints, the same signer client routes Norwegian users to BankID and other-country users to their respective CSC service. The /info endpoint advertises which CSC methods the remote service supports for compatibility checks.

Call POST /info to enumerate supported CSC methods, then route the user to the correct authorize and signHash flow.

Document Hash Signing

Hash a document client-side, send only the hash to BankID CSC for signing, and assemble the final signature artefact in the calling system. /signatures/signHash accepts one or multiple hash values per call, which means a batch of pages or documents can be signed with a single user authorisation step. This minimises the data flowing across the BankID boundary.

Send a list of two SHA-256 hashes to POST /signatures/signHash and assemble the resulting signatures into the corresponding PDFs.

AI Agent Integration via Jentic

An agent built on Jentic can orchestrate a full BankID CSC signing flow on behalf of a user once the user has authorised the credential, by calling token, credentials, authorize, and signHash in order. Jentic stores the OAuth client secret in your Jentic One instance so the agent never sees the raw credential.

Search Jentic for 'sign a document hash with bankid', load the schema for POST /signatures/signHash, and execute it after walking through the OAuth2, list, and authorize steps.

Key Endpoints

7 endpoints — jentic publishes the only available openapi specification for bankid csc api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/oauth2/token

Get an access token

POST

/info

Service info and supported CSC methods

POST

/credentials/list

List user credentials

POST

/credentials/info

Retrieve credential identity and certificate chain

POST

/credentials/authorize

Authorise access to a credential for remote signing

POST

/signatures/signHash

Calculate remote digital signature over hash values

POST

/oauth2/token

Get an access token

POST

/info

Service info and supported CSC methods

POST

/credentials/list

List user credentials

POST

/credentials/info

Retrieve credential identity and certificate chain

POST

/credentials/authorize

Authorise access to a credential for remote signing

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Wiring BankID CSC by hand means running the OAuth2 client-credentials grant, minting short-lived bearer tokens, and sequencing the credential list, authorize, and signHash calls yourself. Through Jentic you install once, import the BankID CSC API from the API Directory, store the client credentials once, and your agent calls it.

Permission scoping

BankID CSC carries its targets in the request body rather than the URL path, so scope the agent to the operations it needs, such as listing credentials and authorizing a signature. You choose that operation set, so the signHash operation is not included unless you add it.

Credential isolation

Your BankID OAuth2 client id and secret are stored once, encrypted, by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'sign a document hash with bankid' or 'list signing credentials', and Jentic returns the matching CSC operation with its input schema so the agent walks the token, list, authorize, signHash sequence without browsing the reference docs.

FAQs

Specific to using BankID CSC API through Jentic.

Why is there no official OpenAPI spec for BankID CSC API?

BankID does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call BankID CSC API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

What authentication does the BankID CSC API use?

The API uses OAuth2 client credentials with scopes esign/csc and esign/nnin (the BankIDClientCredentials scheme). Tokens are issued from /oauth2/token and used as a bearer JWT (the CSCToken scheme). Through Jentic, the OAuth client ID and secret live in the encrypted vault and are exchanged for tokens at execution so the agent never holds them.

Can I sign multiple document hashes in one BankID CSC API call?

Yes. POST /signatures/signHash accepts one or multiple hash values in a single request. This lets you sign a batch of pages or documents with a single credential authorisation step rather than one round-trip per hash.

What are the rate limits for the BankID CSC API?

Rate limits are not declared in the OpenAPI spec. BankID enforces limits per OAuth client and environment; check your contract with BankID and use the preproduction environment (csc-gw.preprod.esign-stoetest.cloud) for load testing before production cutover.

How do I run a remote signature through Jentic?

Search Jentic for 'sign a document hash with bankid', load the schema for POST /signatures/signHash, and execute it after the OAuth2, /credentials/list, and /credentials/authorize steps. Jentic injects the bearer token from the prior OAuth2 step.

Does the BankID CSC API support a test environment?

Yes. The spec ships two servers: a public testing environment at https://csc-gw.preprod.esign-stoetest.cloud/csc/v2 and a production environment at https://csc-gw.esign-stoe.cloud/csc/v2. Use the preprod URL during integration to avoid hitting real signing flows.

Can I limit what my agent is allowed to do with the BankID CSC API?

Yes. Because Jentic One is self-hosted, your own rules decide which of the seven BankID CSC operations and which credentials the agent may use, and because this API carries its targets in the request body rather than the URL path, you scope the agent to only the operations it needs, such as listing credentials and authorizing a signature. You choose that operation set, so the signHash operation is not available to the agent unless you add it.

Bankid No BankID CSC API

Connect the BankID CSC API to your agent

Capabilities

Start building with BankID CSC API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs