Essence Encryption API

All OpenAPI documents

Version v1 · OpenAPI 3.0.1 · 3 operations · Download the JSON document

Zero-knowledge encryption service for Essence Platform. CRITICAL: All encryption happens client-side. Server only manages metadata.

Generated from the Encryption service's code at build time (api-specs/generated/Encryption/Essence.Core.Encryption.Api.json) and drift-checked in CI. It describes what the code registers, which is not the same as what any one deployment has routed.

Encryption

POST/api/v1/encryptdeprecated

Removed: server-side encryption is not available. Encrypt client-side instead. Always returns HTTP 410 Gone with migration guidance (FR-01.021).

Authentication: not declared in the document

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

• EncryptDataRequestDto as application/*+json, application/json, text/json

Responses

400Bad Request — ProblemDetails

410Gone — ProblemDetails

POST/api/v1/encrypt/batchdeprecated

Removed: server-side batch encryption is not available. Encrypt client-side instead. Always returns HTTP 410 Gone with migration guidance (FR-01.021).

Authentication: not declared in the document

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

• BatchEncryptRequestDto as application/*+json, application/json, text/json

Responses

400Bad Request — ProblemDetails

410Gone — ProblemDetails

POST/api/v1/encrypt/decryptdeprecated

Removed: server-side decryption is not available. Decrypt client-side instead. Always returns HTTP 410 Gone with migration guidance (FR-01.021).

Authentication: not declared in the document

Parameters

Takes no parameters.

Request body

Not marked as required in the document.

• DecryptDataRequestDto as application/*+json, application/json, text/json

Responses

400Bad Request — ProblemDetails

410Gone — ProblemDetails

Schemas

BatchEncryptRequestDto

Request for batch encryption of multiple data items.

Property	Type	Required	Description
items	EncryptDataRequestDto[]	yes	List of items to encrypt.

DecryptDataRequestDto

Request to decrypt data using AES-256-GCM. WARNING: In production, decryption happens CLIENT-SIDE.

Property	Type	Required	Description
associatedData	string | null	no	Optional associated data used during encryption (base64 encoded).
authTag	string	yes	Authentication tag (base64 encoded, 16 bytes).
encryptedData	string	yes	Encrypted data (base64 encoded).
iv	string	yes	Initialization vector (base64 encoded, 12 bytes for GCM).
keyId	string (uuid)	yes	Key ID used for decryption.

EncryptDataRequestDto

Request to encrypt data using AES-256-GCM. WARNING: In production, encryption happens CLIENT-SIDE. This endpoint should only be used for testing/demonstration.

Property	Type	Required	Description
associatedData	string | null	no	Optional associated data for authenticated encryption (base64 encoded). This data is not encrypted but is authenticated.
keyId	string (uuid)	yes	Key ID to use for encryption.
plaintextData	string	yes	Plaintext data to encrypt (base64 encoded). CRITICAL: Never send unencrypted sensitive data to server in production!

ProblemDetails

Property	Type	Required	Description
detail	string | null	no	—
instance	string | null	no	—
status	integer (int32) | null	no	—
title	string | null	no	—
type	string | null	no	—