Secure PDF Documents with Protected Watermarks

Pair a Visible Watermark with PDF Usage Controls

A watermark communicates information that should remain visible when a document travels beyond its original system. It can identify ownership, label a file as confidential or draft, name the intended recipient, or apply consistent branding. The mark provides context, but the PDF remains editable unless a separate security control limits those actions.

pdfRest combines two focused API tools for this workflow. Watermark PDF adds the visible text or artwork. Restrict PDF applies a permissions password and disables selected actions such as editing page content, editing annotations, copying content, or printing. Chaining them produces a marked document whose watermark is protected against standard PDF editing operations.

For example, a client-reporting platform can add Confidential — Prepared for Example Client across each review copy and then restrict content and annotation editing before delivery. The recipient sees the document's status and intended audience, while common editor commands cannot be used to select or remove the watermark.

Apply the Right Watermark for the Document

Watermark PDF accepts either text or a PDF file as the watermark source. Text options include font, size, RGB or CMYK color, opacity, rotation, position, and page range. File-based watermarks support logos, designed stamps, and other artwork, with controls for scale, opacity, position, and rotation.

The behind_page option can place the watermark beneath existing page content when the design calls for a more subtle background treatment. By default, it appears above the page content. Page selection allows the application to mark every page or only the sections governed by a particular distribution rule.

These settings can be generated from trusted application data. A document portal might combine a classification label, recipient name, and distribution date into a text watermark, while a publishing system could apply an approved logo asset by resource ID. The same template then produces consistent placement and appearance across every document in the category.

Restrict the Editing Actions That Matter

The Restrict PDF request accepts the watermarked PDF as a file or resource ID. new_permissions_password protects the security settings, and repeated restrictions[] fields identify the actions to disable. The protected-watermark workflow typically includes edit_content and edit_annotations; it can also restrict copying or printing when those controls match the distribution policy.

The restrictions are granular, so an application does not have to apply the same policy to every audience. An internal review copy may permit printing but prevent content editing, while an externally distributed copy may also disable copying and annotation changes. pdfRest applies the selected controls through Adobe PDF technology and returns a new resource ID for the secured output.

Chain Watermark and Restrict Requests

The official cURL workflow below sends the source PDF to /watermarked-pdf, extracts its outputId, and supplies that value to /restricted-pdf.

Protected Watermark Workflow Code Example   |   Load this into API Lab↗

#!/bin/bash

# Apply a visible watermark, then protect it against standard PDF editing operations.
API_URL="https://api.pdfrest.com"

# For the EU-based service, use:
# API_URL="https://eu-api.pdfrest.com"

API_KEY="xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

WATERMARKED_OUTPUT=$(curl -X POST "$API_URL/watermarked-pdf" \
  -H "Accept: application/json" \
  -H "Content-Type: multipart/form-data" \
  -H "Api-Key: $API_KEY" \
  -F "file=@/path/to/client_report.pdf" \
  -F "watermark_text=Confidential — Prepared for Example Client" \
  -F "output=watermarked_report")

WATERMARKED_ID=$(jq -r '.outputId' <<< "$WATERMARKED_OUTPUT")

echo "$WATERMARKED_OUTPUT" | jq -r '.'

RESTRICTED_OUTPUT=$(curl -X POST "$API_URL/restricted-pdf" \
  -H "Accept: application/json" \
  -H "Content-Type: multipart/form-data" \
  -H "Api-Key: $API_KEY" \
  -F "id=$WATERMARKED_ID" \
  -F "output=protected_report" \
  -F "restrictions[]=edit_annotations" \
  -F "restrictions[]=edit_content" \
  -F "restrictions[]=copy_content" \
  -F "new_permissions_password=password")

echo "$RESTRICTED_OUTPUT" | jq -r '.'

# Optional deletion step — OFF by default.
# Save all desired files before enabling this step.
# DELETE_SENSITIVE_FILES=true
if [ "$DELETE_SENSITIVE_FILES" = "true" ]; then
  INPUT_PDF_ID=$(jq -r '.inputId[0]' <<< "$WATERMARKED_OUTPUT")
  RESTRICTED_ID=$(jq -r '.outputId' <<< "$RESTRICTED_OUTPUT")
  curl -X POST "$API_URL/delete" \
    -H "Accept: application/json" \
    -H "Content-Type: multipart/form-data" \
    -H "Api-Key: $API_KEY" \
    -F "ids=$INPUT_PDF_ID, $WATERMARKED_ID, $RESTRICTED_ID" | jq -r '.'
fi

This sequence keeps the watermarked intermediate file inside pdfRest and ensures the restriction step operates on the intended output. The final response provides the secured PDF URL and resource ID for delivery or another approved operation.

Use API Lab to configure both steps. The Watermark PDF and Restrict PDF API references list the current styling, page-selection, password, and restriction fields.

Watermark PDF

Restrict PDF