Code Signing with Upload & Sign

This API is used for code signing with upload and sign. It establishes the policies and permissions that oversee the process of uploading and signing code files. Its primary purpose is to ensure a secure and authorized code signing process, playing a crucial role in preserving control and compliance throughout code deployment and execution.

Before you begin

  • Configure the signing policy with relevant details, ensuring mapping to the enrolled certificate (also identified as the signing key on the signing policy page).
  • The file types selected during policy creation are the only ones permitted for upload. Supported file types include: PS1, EXE, CAT, MSI, JS, JAR, APK, VBS, CAB, WSF, DLL, PSM1, PSD1, PS1XML, JSE, and VBE.

Request Structure

Endpoint: /code-signing-upload-sign-file-policy
Type: POST
Sample URL: https://<IP/HostName/TenantName>:<GWPORT>/avxapi/code-signing-upload-sign-file-policy?gwsource=external

To understand the elements of the sample URL, click here.
Content-Type: application/json
Table 1. Input Parameter
Name Description
sessionId

Header

 (Mandatory) After successfully logging in, a unique identifier assigned to a user's session after successful authentication. The session ID remains valid until it expires. The session ID is a string value.

Example: "ce7f1a14-2bf9-4e4a-89a8-bc780a255813"
username

Header

 (Mandatory) AppViewX login username, represented as a string value.

Example: "User"
password

Header

 (Mandatory) AppViewX login username, represented as a string value.

Example: "AppViewX@123"
Payload (Mandatory) Input data for request body in application/json format. For payload details, see Payload section.

Payload

Name Description
file

binary

 (Mandatory) Upload the file for code signing.

Example: "binary"
fileName

String

 (Mandatory) Name of the file which is a string value.

Example: "AppViewX.jar"
fileType

String

 (Mandatory) Specific format of a file providing essential metadata for proper handling and processing which is a string value.

Example: "JAR"
signingPolicy

String

 (Mandatory) Enter the signing policy for code signing which is a string value.

Example: "testPolicyByAppViewX"
signingKey

String

 (Mandatory) Enter the signing key for code signing which is a string value.

Example: "GCA_CSP_Cert=E8:F1:1A:04:29:BF:72:44:85:2A:18:12: 70:5F:74:F6:42:79:CA"
signedType

String

 (Mandatory) Select the code signed type, a string that specifies File Based sign.

Example: "File Based Signing"
signatureType

String

 (Optional) This ensures compliance with a designated signature format while also allowing for potential support of additional signing types in the future.

Example: "RAW"
addOnFields

List<Map<String, String>>

 (Optional) Specify additional fields needed for code signing.

Example: "addOnFields": [{"Version":"V1"},{"Build":"1"}]

Response Structure

  • Status Code: 200 OK
  • Message: Successful
  • Headers:
    • Content-Type: application/json
Table 2. Response Parameters
Name Description
response Contains the response attributes for the upload and sign request.
message Success message or failure description in case of error.
appStatusCode Application specific status code for the response. Will be non-null for failure response.
tags More info in case of failure response.

Status Codes

HTTP Code appStatusCode Response Message
200 OK null Successful
400 Bad Request CODE_SIGNING_0080 Wrong Input Payload for the text fields in the text block
400 Bad Request CODE_SIGNING_0081 Invalid Number added in the Add-ons section
400 Bad Request CODE_SIGNING_0082 Mandatory fields are missing in the Add-ons Section
500 Internal Server Error CODE_SIGNING_0063 Your chosen signing type is not supported by the selected policy
403 Forbidden CODE_SIGNING_0058 Unsupported file type is uploaded. The policy selected doesn't support uploaded file type
500 Internal Server Error CODE_SIGNING_0062 Ip provided is invalid
403 Forbidden CODE_SIGNING_0031 Permissions are not there to upload file for signing
500 Internal Server Error CODE_SIGNING_0070 Signing Key is not mapped to the given policy.
500 Internal Server Error CODE_SIGNING_0073 Certificate is not present in the cert inventory
500 Internal Server Error CODE_SIGNING_0087 Signing Key is Revoked/Expired
500 Internal Server Error CODE_SIGNING_0020 Error in generating the signed file
500 Internal Server Error CODE_SIGNING_0023 I/O Exception occurred
500 Internal Server Error CODE_SIGNING_0022 Error in generating the signature file
500 Internal Server Error CODE_SIGNING_0021 Error in updating the signed data
500 Internal Server Error CODE_SIGNING_00220 Your chosen signature type is currently not supported.

Sample Request/Response

Use Case

To sign a file using code-signing-upload-sign-file-policy API.

Request URL
https://<IP/HostName/TenantName>:<GWPORT>/avxapi/code-signing-upload-sign-file-policy?gwsource=external
Request Payload 
{
"payload" : {
file: (binary)
fileName: AppViewX.jar
fileType: JAR
signingPolicy: testPolicyByAppViewX
signingKey: GCA_CSP_Cert=E8:F1:1A:04:29:BF:72:44:85:2A:18:12:70:5F:74:F6:42:79:CA
signedType: File Based Signing
signatureType: RAW
addOnFields: [{"Version":"V1"},{"Build":"1"}]
    }
}
Sample Response 
{
    "response": "65252c675e3734782705b4cd",
    "message": null,
    "appStatusCode": null,
    "tags": null,
    "headers": null
}

What's Next

Reference

Understanding the sample URL:
  • IP/HostName/TenantName: Replace with the actual IP address, hostname, or tenant name based on the specific configuration in AppViewX.
    • IP: A unique identifier assigned to each device connected to a computer network that uses the Internet Protocol for communication

      The IP address will be included in the endpoint URL for an on-prem deployment.

    • HostName: A human-readable label assigned to a device (host) on a network

      The hostname will be included in the endpoint URL for an on-prem deployment.

    • TenantName: An identifier label for a tenant given to indicate which tenant's data the API request will access/modify

      The tenant name will be included in the endpoint URL for a SaaS deployment.

  • GWPORT: AppViewX gateway port

    A gateway port refers to a network port through which data is sent and received to communicate with a gateway in an on-prem deployment.

    Example: 31443

  • avxapi: Path parameter value (static) that is part of the endpoint's URL
  • Endpoint: Endpoint of the API, for example: execute-hook
  • gwsource: Source or origin of a gateway, for example: external.