Digital Signing through VNeID / RS-HUB

From sharing consent to signing outcome

Separate VNeID sharing feedback from the signing outcome in the application. RSS provides tracking references and lookup operations; bind outcomes to the document and chosen provider.

RS-HUB route RSS documentation Annotated demonstrations

REFERENCE FLOW

VNeID → RS-HUB → CA/RSSP → Signature

Reference architecture

Document and policy

Version • signer • authority

VNeID / RS-HUB

Applicable identity and signing service route

GoPaperless Agent

Desktop application handoff

REST API

Asynchronous transaction integration

Trusted SIC

Transaction-bound authorization

CA / RSSP

Signature creation with the applicable key and certificate

Verification and evidence

Output • state • correlation

RESPONSIBILITY

Make responsibility boundaries explicit.

Do not present Mobile-ID as the owner of VNeID or RS-HUB.

RAR/C06 · VNeID

Identity ecosystem

Authorized identity authentication / attribute sharing within applicable scope.

RS-HUB

Signing route

Remote-signing route according to the applicable integration model.

CA/RSSP

Signing service

Credential and signature creation according to service arrangement.

Mobile-ID

Orchestration

Integration, transaction handling, monitoring, verification and evidence according to implemented scope.

CLAIM BOUNDARY

Scope-first wording

Do not use wording such as ‘full access to the national population database’. Describe authentication/attribute sharing only within the applicable service, consent, permission and legal scope.

REFERENCE

Sequence linking identity, attributes and signing

01
Enterprise application
Persist the business reference and request state; prepare the approved redirect.
02
Mobile-ID
Orchestrate the request and maintain separate correlation for authentication, attribute sharing and signing.
03
RAR/C06 / VNeID
Authenticate through the applicable service; the user grants or denies consent.
04
ShareInfo / callback
Receive authorized attributes and validate the state against the initiated request.
05
User / RS-HUB
Request separate signing authorization on the applicable route; login is not consent to sign.
06
CA / RSSP
Create the signature within provider scope and return it for validation and reconciliation.

REFERENCE

Exception lane and recovery responsibility

If the table is wider than its frame, scroll horizontally to see all columns; use arrow keys when the table region has focus.

Exception lane and recovery responsibility
Outcome	Application / operator action
Cancel or deny	Return the user outcome; do not initiate signing.
Timeout or expired challenge	Reconcile first; create a new request only with renewed user confirmation.
Callback state mismatch	Reject and investigate correlation, session and redirect binding.
Attribute unavailable or denied	Apply business policy; never substitute inferred identity data.
Signing provider unavailable	Preserve the uncertain state; reconcile or escalate without silently switching routes.

REFERENCE

Responsibility boundaries and evidence

If the table is wider than its frame, scroll horizontally to see all columns; use arrow keys when the table region has focus.

Responsibility boundaries and evidence
Component	Responsibility	Evidence to review
Enterprise	Business record, representative authority and acceptance	Record reference, version and approval
Mobile-ID	Contract-scoped orchestration, correlation and handoff	Request, callback, state and audit
RAR/C06 / VNeID	Applicable identity / attribute service	Authentication result and consent scope
CA / RSSP	Signing credential and signature creation	Certificate, signed output and verification

Digital Signing through VNeID / RS-HUB

From sharing consent to signing outcome

VNeID → RS-HUB → CA/RSSP → Signature

Make responsibility boundaries explicit.

Identity ecosystem

Signing route

Signing service

Orchestration

Scope-first wording

Sequence linking identity, attributes and signing

Exception lane and recovery responsibility

Responsibility boundaries and evidence

Related content