03 · RP API v3

One session. Three flows.

The relying party (RP) opens a session, delivers a request to the user's phone and gets the answer by long-poll. v3 (current spec 3.2.7) adds device-link flows and strengthens fraud protection. e-ID Mongolia's RP-API has the same structure.

Flows

Ranked by fraud resistance

This is how SK itself ranks the flows: strongest is the user opening the link themselves, weakest is push alone.

Strongest

Device link

QR (another device) or Web2App / App2App (same device). The session is bound to that device. Anonymous authentication is possible.

Improved

QR + push

Combines a push to a known device with a QR code.

Weakest

Push only

Sends a notification by registration number. Relies on the user spotting fraud — the verification code matters here.

Endpoints

Key v3 paths

Method	Path	Purpose	e-ID MN
POST	/authentication/device-link/anonymous	QR / Web2App / App2App authentication	yes
POST	/authentication/device-link/etsi/{id}	A specific person, device link	yes
POST	/authentication/notification/etsi/{id}	Push authentication	yes
POST	/authentication/notification/document/{doc}	Push, by document number	yes
POST	/signature/device-link/…	Signature, device link	yes
POST	/signature/notification/…	Signature, push	yes
POST	/signature/certificate-choice/…	Certificate choice	yes
GET	/session/{sessionID}?timeoutMs=	Long-poll, ≤ 120 s	yes
POST	/authentication/qr	“My QR” — a person shares their data as a JWS	MN only

Smart-ID: rp-api.smart-id.com/v3/, demo sid.demo.sk.ee/smart-id-rp/v3/. e-ID Mongolia: rp.eidmongolia.mn, discovery ca.eidmongolia.mn/.well-known/eid.

Protocol

ACSP_V2 and RAW_DIGEST

ACSP_V2 (authentication): the RP sends a 64-byte random rpChallenge. The data to be signed joins fields such as smart-id|ACSP_V2|serverRandom|rpChallenge|userChallenge|rpName|…|interactions|flowType into one string.
RAW_DIGEST_SIGNATURE (signature): the RP computes the document hash in advance and sends it. The document itself is never transmitted.
Algorithms: v3 recommends RSASSA-PSS, with SHA-2 and SHA-3. PKCS#1 v1.5 for the legacy format.
Since v3.2.0, codes 471/472 are replaced by 404 + RFC 9457 problem details, and HTTP/2 is supported.

Device link

Link structure

deviceLinkBase?

deviceLinkType=QR|Web2App|App2App

&elapsedSeconds=n(QR only)

&sessionToken=…

&sessionType=auth|sign|cert

&version=1.0

&lang=…

&authCode=HMAC-SHA256(sessionSecret, payload)

The QR code is regenerated on the backend every second.
sessionSecret never reaches the frontend.
Authentication can be anonymous; signing cannot.

Interactions and SDKs

What shows on the phone

Type	Text	Device link	Push
displayTextAndPIN	60 characters	✓	✓
confirmationMessage	200 characters	✓	✓
…AndVerificationCodeChoice	200 characters, pick from 3 codes	—	✓

Language	Smart-ID	e-ID Mongolia
Java	Official, v3	—
TypeScript / Node	Community, v3	Official, full + lite
Go	Community, v2	Official, full
.NET	Community, v2	PAdES · QR, partial
PHP	Official, v2 authentication	—