Protected Requests

By default, anyone with the request link can open and complete it. A protected request locks it to one specific person: before they can open the form or sign, they must prove who they are with an eID. If someone else logs in — or no one logs in — they are turned away.

Use it for sensitive requests where you must be certain who is on the other end.

Protect a request

Add accessRestriction when you create the request. Each allowed signer has an authMethod (how they prove who they are to open the form) and an authIdentifier (a national ID for an eID, or a phone number for SMS). Make that same person the primarySigner, so the person who must verify is the one who receives and signs.

POST /v2/forms/{formId}/requests
Content-Type: application/json

{
  "answers": { ... },
  "primarySigner": { "fullName": "Jane Smith", "email": "[email protected]" },
  "accessRestriction": {
    "allowedSigners": [
      { "authMethod": "MIT_ID", "authIdentifier": "1207450000" }
    ]
  }
}

Property	Type	Required	Description
`accessRestriction.allowedSigners`	array	yes	The people allowed in. Exactly one for now.
`allowedSigners[].authMethod`	string	yes	How they prove their identity to open the form. See Supported methods.
`allowedSigners[].authIdentifier`	string	yes	Their identifier: a national ID for an eID, or a phone number for SMS.
`allowedSigners[].signingMethod`	string	no	Use only when signing must be verified with a different method than the one that opens the form — e.g. open with SMS, sign with itsme.
`allowedSigners[].signingIdentifier`	string	no	The national ID checked at signing. Required when `signingMethod` is set.

When signingMethod/signingIdentifier are omitted, signing is verified with the same identity used to open the form.

Supported methods

Method	value	Region	Identifier	Opens form	Signs
MitID	`MIT_ID`	Denmark	CPR number, 10 digits	✓	✓
BankID	`BANKID_NO`	Norway	Fødselsnummer, 11 digits	✓	✓
BankID	`BANKID_SE`	Sweden	Personnummer	✓	✓
FTN	`FTN_FI`	Finland	Henkilötunnus, incl. its century sign and check character (e.g. `131052-308T`)	✓	✓
SMS code	`SMS`	Any	Mobile phone number in international format (e.g. `+4512345678`)	✓	✓
itsme	`ITSME`	Belgium	Rijksregisternummer, 11 digits	—	✓

ITSME can only be a signingMethod — it verifies identity at signing, not when opening the form. A typical Belgian setup opens with SMS and signs with ITSME.

What the respondent sees

Opening the link asks them to verify — logging in with their eID, or entering a one-time code texted to the phone number you set. Only if it matches the identity you set are they let in; anyone else is refused. When they sign, the same check runs against the signing identity — the one from signingMethod/signingIdentifier if you set them, otherwise the identity used to open the form.

Signing is always secure

A protected request is signed with an eID. Insecure signing methods are always turned off for the primary signer, even if the form is otherwise configured to allow them. This keeps their signature tied to their verified identity. Any predefined signers keep their normal signing options.

Limits

You can't protect a request on a form that lets respondents add their own extra signers. Forms whose signers are all set in advance are fine — only the protected person is locked; the predefined signers get a normal link.

A request with an invalid identifier (national ID or phone number), more than one allowed signer, a method that can't open the form used as authMethod, or a form that allows extra signers is rejected with 400 Bad Request.