REST API

Create a secret

Stores a client-side encrypted envelope. Anonymous calls (no Authorization) are allowed with anonymous limits. Supply `Idempotency-Key` to make retries safe (authenticated only).

Idempotency-Key (header)

List your secrets (metadata only)

state (query)

q (query)

Search your private labels.

sort (query)

page (query)

pageSize (query)

environment (query)

Get secret metadata (receipt)

Authorized by the receipt token (`X-Receipt-Token`), the owner's API key with `secrets:read`, or the owner's session.

id (path, required)

Secret identifier (128-bit, base64url).

Pre-redemption status (public)

Does not consume the secret. Returns KDF parameters the recipient needs to derive the proof.

id (path, required)

Secret identifier (128-bit, base64url).

Redeem (open) a secret

Verifies `proof` (HKDF-derived from the link key and passphrase) and, if valid, consumes one view atomically and returns the envelope. A wrong proof never consumes; after `maxFailedAttempts` the secret is destroyed.

id (path, required)

Secret identifier (128-bit, base64url).

Destroy a secret before it is read

id (path, required)

Secret identifier (128-bit, base64url).

Plan, limits and usage for the current period

List API keys (session only)

Create an API key (session only). The token is returned once.

Revoke an API key

keyId (path, required)

List endpoints and recent deliveries

Create an endpoint. The signing secret is returned once.

Delete an endpoint

id (path, required)