# Task: Carimbar um PDF com data e hora

I want my application to do what Lacuna's "Carimbar um PDF com data e hora" demo does: Adicione um carimbo do tempo a um PDF com o Rest PKI Core, o serviço em nuvem da Lacuna, comprovando que ele existia como está naquele momento.

- Docs: https://docs.lacunasoftware.com/pt-br/articles/rest-pki/core
- Live demo: https://try.lacunasoftware.com/pt/pki-suite/timestamp-a-pdf
- This demo for AI agents: https://try.lacunasoftware.com/pt/pki-suite/timestamp-a-pdf.md

## Samples

- Lacuna's samples for this product: https://github.com/LacunaSoftware/PkiSuiteSamples

## Call sequence

Recorded on 2026-10-12 against the real products with Lacuna's public test certificates and data. Keys, tokens, sessions, ids, file contents and personal data are masked.

### 1. Rest PKI Core adds a document timestamp from the PkiBrazil tier over the whole PDF, and the stamped PDF is downloaded from the temporary link it returns.

On the server: `IRestPkiService.StampPdfAsync, then IRestPkiService.OpenReadAsync`

`POST https://core.pki.rest/api/pdf/stamp` → 200

Request:

```json
{
  "File": {
    "MimeType": "application/pdf",
    "Content": "<Content, 1609 bytes>",
    "Name": "document.pdf",
    "Length": 0,
    "ContentType": "application/pdf"
  },
  "TimestampTier": "PkiBrazil",
  "ForceBlobResult": true
}
```

Response:

```json
{
  "file": {
    "mimeType": "application/pdf",
    "blobToken": "***",
    "url": "https://restpkicore.lacunasoftware.com/api/blobs?token={value}",
    "length": 21365,
    "contentType": "application/pdf",
    "location": "https://restpkicore.lacunasoftware.com/api/blobs?token={value}"
  }
}
```

`GET https://restpkicore.lacunasoftware.com/api/blobs?token={value}` → 200

Response:

```json
"<application/pdf, 21365 bytes>"
```

### 2. PKI SDK opens the stamped PDF and reads the new timestamp back, the last of its signers marked as a timestamp, for the result.

On the server, in process: `PadesSignature.Open(pdf)`

## Patterns to copy

- Always name a timestamp tier on the stamp call (the Demo uses `PkiBrazil`): a stamp takes no security context.
- Set `ForceBlobResult = true`, or Rest PKI Core returns the file inline in a reference the client can't read; then download it with `OpenReadAsync(File.Url)`. Never log that link, which carries an access ticket.
- Each stamp is billed: if only the download fails, the PDF was already stamped.
- Read the new timestamp back by opening the stamped PDF with PKI SDK: document timestamps are among the PAdES signers with `IsTsp` set, the newest last.

## What to do

Implement this in my project with its existing stack, language, framework and conventions, following the call sequence and the patterns above, and adapting the samples rather than copying them whole. Ask me before adding any dependency or package. Keep API keys and private keys out of the browser and out of the repository.