Skip to content

eID Gerege — Relying Party (RP) Integration

A guide to connecting a third-party system (bank, service) to eID Gerege to obtain mobile authentication and qualified electronic signatures. The wire protocol is Smart-ID compatible.

Discovery: GET https://rp-api.eidmongolia.mn/.well-known/eid — returns endpoints/capabilities/PKI as machine-readable JSON.

1. Registration

The RP is registered in advance by the operator. Provide the following: - relyingPartyUUID — a stable UUID (you provide it, or the operator issues one) - relyingPartyName — display name - mTLS client-cert subject — in production you connect to the RP-API over a TLS client cert; the cert's subject DN must match the registration - permissions — the permitted operations (authentication / signature)

Operator: POST /v3/admin/relying-parties (admin-only).

2. Connecting

  • Base: https://rp-api.eidmongolia.mn/v3
  • Auth (prod): Authorization: Bearer <api_secret> (RP is resolved by SHA-256 hash) or an mTLS client certificate (subject must match the registered RP) + relyingPartyUUID/relyingPartyName in the body. Additionally: IP allowlist (allowed_ips).
  • Body of every request: relyingPartyUUID, relyingPartyName, certificateLevel (QUALIFIED|ADVANCED|QSCD), signatureProtocol (ACSP_V2), interactions.

3. Authentication

Endpoint Purpose
POST /v3/authentication/device-link/anonymous QR/Web2App — citizen not known in advance
POST /v3/authentication/notification/etsi/{semanticsIdentifier} Push — PNOMN-<civilId>
POST /v3/authentication/notification/document/{documentNumber} Push — device UUID

Response (notification): { sessionID, vc: { value }, ... }. vc.value is the verification code shown to the citizen. device-link/anonymous additionally returns sessionToken, sessionSecret, and deviceLinkBase, where vc is a plain string (example: RP_GEREGE_INTEGRATION.md §1.1).

4. Signature

Endpoint Purpose
POST /v3/signature/certificate/{documentNumber} Certificate selection before signing
POST /v3/signature/notification/document/{documentNumber} Push — signs the document digest (SHA-256, base64)
POST /v3/signature/notification/etsi/{semanticsIdentifier} Push — by PNOMN-<civilId>

Sign body additionally: digest (base64), hashType (SHA256|SHA384|SHA512).

5. Polling the session (long-poll)

GET /v3/session/{sessionId}?timeoutMs=120000
- RUNNING — in progress - COMPLETE + result.endResult=OK → signature.value (detached signature), cert.value (X.509) - COMPLETE + other endResult (USER_REFUSED, TIMEOUT, …) → refused

6. PKI (validation)

  • OCSP: endpoints.ocsp from the discovery doc
  • CRL: endpoints.crl from the discovery doc
  • Issued certificates chain from the eID Gerege root CA.

7. Citizen identifiers

Field Example
semanticsIdentifier PNOMN-111949212017 (natural person), NTRMN-1234567 (organization)
documentNumber UUID returned at enrollment
registrationNumber Mongolian registration number (МА74101813) — resolved in push lookup
civilId National ID card number

Example RP client: web/src/lib/rpclient.ts (working TypeScript implementation).