# Task: Validar um arquivo assinado

I want my application to do what Lacuna's "Validar um arquivo assinado" demo does: Valide todas as assinaturas de um arquivo assinado, PAdES, CAdES, XAdES ou XMLDSig, com o PKI SDK no servidor.

- Docs: https://docs.lacunasoftware.com/pt-br/articles/pki-sdk
- Live demo: https://try.lacunasoftware.com/pt/pki-suite/validate-a-signed-file
- This demo for AI agents: https://try.lacunasoftware.com/pt/pki-suite/validate-a-signed-file.md

## Samples

- .NET (aspnet-mvc): [Validate a signed PDF using PKI SDK](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/dotnet/mvc/PkiSuiteAspNetMvcSample/Controllers/OpenPadesSignatureSdkController.cs)
- .NET (aspnet-core-angular): [Validate a signed PDF using PKI SDK](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/dotnet/spa/PkiSuiteAspNetSpaSample/Controllers/OpenPadesSdkController.cs)
- .NET (aspnet-mvc): [Validate a CMS/CAdES signature using PKI SDK](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/dotnet/mvc/PkiSuiteAspNetMvcSample/Controllers/OpenCadesSignatureSdkController.cs)
- .NET (aspnet-mvc): [Validate a signed XML using PKI SDK](https://github.com/LacunaSoftware/PkiSuiteSamples/blob/master/dotnet/mvc/PkiSuiteAspNetMvcSample/Controllers/OpenXmlSignatureSdkController.cs)

## Call sequence

Recorded on 2026-10-12 against the real products with Lacuna's public test certificates and data. Keys, tokens, sessions, ids, file contents and personal data are masked.

### 1. PKI SDK finds the signatures in the file by its content and validates each one under the Signature policy it carries, ICP-Brasil AD-RT for this sample.

On the server, in process: `PadesSignature.Open(pdf), then PadesSignature.ValidateSignature(signer, policy)`

## Patterns to copy

- This Demo calls no API: PKI SDK validates the file inside the server's process.
- Validate each signature under the policy it carries: PKI SDK's ICP-Brasil policies for an ICP-Brasil policy OID, otherwise the format's basic policy, and XMLDSig's basic policy for an XML signature with no XAdES signed properties.
- A detached CMS signature needs the file it signs, given with `SetExternalData` before validating.
- Report a PDF's document timestamps (`IsTsp` signers) as timestamps, not signatures, and parse uploaded XML with DTDs prohibited and no resolver.

## What to do

Implement this in my project with its existing stack, language, framework and conventions, following the call sequence and the patterns above, and adapting the samples rather than copying them whole. Ask me before adding any dependency or package. Keep API keys and private keys out of the browser and out of the repository.