Signed Reports
Issue a signed, persisted PDF report whose integrity anyone can verify, and understand the four report kinds you can sign.
A signed report is a PDF report that CallMeter has rendered, stored, and cryptographically signed. Once a report is signed, the exact file is kept as an immutable record, and anyone who receives it can confirm two things: that the file came from CallMeter, and that not a single byte has changed since it was signed.
This is the building block for the other two guides in this section — sharing a report with someone logged out and verifying a report's integrity.
What signing does
When you sign a report, CallMeter:
- Renders the report to a PDF.
- Stores that exact PDF as a persisted artifact.
- Computes a SHA-256 digest of the stored bytes.
- Signs the digest with a server-held Ed25519 key.
- Records the signature, the signing key's public key, a
keyId, and a short Report reference alongside the stored file.
Verification always checks the stored bytes — the file is never re-rendered to verify it, because two renders of the same report are not guaranteed to be byte-identical. The bytes that were signed are the record.
Every signed report's PDF carries, in its footer and on its cover, a Report reference and the URL of the public verification page. The reference is an invoice-style identifier — a convenient way to refer to a report in conversation or support. It is not how you verify one: verification is done by uploading the file itself (a reference copied off a PDF proves nothing about that file). See Verifying Reports.
Which reports you can sign
All four report shapes are signable:
| Kind | What it covers |
|---|---|
| Test run | A full test-run report for one run. |
| Endpoint | A single endpoint's report within a run. |
| Compare endpoints | A side-by-side comparison of several endpoints in a run. |
| Compare runs | A side-by-side comparison of several runs of a test. |
Signing applies to PDF reports only. The JSON and CSV exports are unchanged and are not signed.
How to sign a report
Signing lives in the Sign & share panel on each report surface — the test-run page, an endpoint report, and the two comparison pages.
- Open the report you want to sign.
- In the Sign & share panel, choose Sign this report.
- CallMeter renders, stores, signs, and records the report, then shows its Report reference.
Signing requires the Editor role (or higher) on the project. Signing the same report twice does not create a duplicate — CallMeter returns the report that already exists for that exact selection, so the Report reference stays stable.
Signing is only available for runs that have finished. A run that is still in progress can't be signed until it completes.
What happens next
- To let someone outside CallMeter open the report, mint a share link — see Sharing Reports.
- To check a report you have received, use the verification page — see Verifying Reports.
Analyzing Results
Interpret test run metrics, drill into per-endpoint data, use filters, read time-series charts, compare runs, and identify quality patterns.
Sharing Reports
Mint expiring, revocable share links that let anyone open a signed report logged out, and control who can create or revoke them.