API reference Resources
Data encryption
Stored content only the workspace's own age key can open.
21 operations
Where this workspace stands with data encryption
Response200
The state, any job, and the keys used before
Of stored, what is sealed today.
Batch keys still locked to it: rows under them read as locked with an earlier key.
When interaction retention will have removed the last row under it. null when no batch key is locked to it.
The same moment under the name a reader wants: when it stopped being used.
off, encrypting, on, rekeying or decrypting.
A running job.
Progress, per kind of content.
encrypt, decrypt, rekey_browser or rekey_server.
Rows to walk. 0 until the sweep has counted.
null until there is a rate to go by.
Set only while a browser holds the lease on a change of key.
browser or server during a change of key.
The email of whoever set it.
Errors
- 401
No valid session
Fetch batch keys by id
The batch keys these rows need. Whoever may read interaction content may fetch them: they open with nothing but the workspace's private key.
Query parameters
Comma-separated batch key ids, at most 500.
Response200
Those of them that exist
Base64 of HMAC-SHA256 under the batch key, over the text oxelone-batch-check-v1 and the id as 16 bytes.
During a change of key: whether its copy for the new key is here.
The key wrapped is locked to.
Base64 of a binary age file: <id> <base64 of the key>\n.
Errors
- 400
An id that is not one, or more than 500
- 403
Caller lacks interaction_content:read in this workspace
Download every batch key as a zip
Every batch key under the current key as a zip of <id>.age files, to open with age --decrypt on your own computer. Each file holds one line, so the output concatenates into a file this API can read.
Response200
One <id>.age per batch key
Errors
- 403
Caller lacks settings:manage in this workspace
Page through every batch key
Page through the batch keys under the current key, for a change of key or for turning off in this browser.
Query parameters
The last id of the page before.
At most 500, and 500 when absent.
Response200
One page, by id
Base64 of HMAC-SHA256 under the batch key, over the text oxelone-batch-check-v1 and the id as 16 bytes.
During a change of key: whether its copy for the new key is here.
The key wrapped is locked to.
Base64 of a binary age file: <id> <base64 of the key>\n.
Pass as after; absent on the last page.
Errors
- 403
Caller lacks settings:manage in this workspace
Ask for a code that only the holder of this key can read
Request bodyChallengeInput
An age1… X25519 public key.
Response200
An age file holding the code
An armored age file. age --decrypt with the private key prints the code.
Errors
- 403
Caller lacks settings:manage in this workspace
- 409
plan_feature, orkey_reused: this workspace has used that key, and the error says when it was last in use- 422
not_a_public_keyorprivate_key- 503
This deployment has no key configured
Turn off encryption
Turn off. New data goes readable at once, and the stored rows are decrypted in the background with the opened keys already sent.
Response200
Turning off
Of stored, what is sealed today.
Batch keys still locked to it: rows under them read as locked with an earlier key.
When interaction retention will have removed the last row under it. null when no batch key is locked to it.
The same moment under the name a reader wants: when it stopped being used.
off, encrypting, on, rekeying or decrypting.
A running job.
Progress, per kind of content.
encrypt, decrypt, rekey_browser or rekey_server.
Rows to walk. 0 until the sweep has counted.
null until there is a rate to go by.
Set only while a browser holds the lease on a change of key.
browser or server during a change of key.
The email of whoever set it.
Errors
- 403
Caller lacks settings:manage in this workspace
- 409
keys_missingorstate_conflict- 503
This deployment has no key configured
Cancel turning off
Cancel turning off. The opened keys are destroyed, and what was already opened is encrypted again.
Response200
Encrypting again
Of stored, what is sealed today.
Batch keys still locked to it: rows under them read as locked with an earlier key.
When interaction retention will have removed the last row under it. null when no batch key is locked to it.
The same moment under the name a reader wants: when it stopped being used.
off, encrypting, on, rekeying or decrypting.
A running job.
Progress, per kind of content.
encrypt, decrypt, rekey_browser or rekey_server.
Rows to walk. 0 until the sweep has counted.
null until there is a rate to go by.
Set only while a browser holds the lease on a change of key.
browser or server during a change of key.
The email of whoever set it.
Errors
- 403
Caller lacks settings:manage in this workspace
- 409
state_conflict
Turn data encryption on with a verified key
Request bodyEnableInput
Response200
On, and encrypting what is stored
Of stored, what is sealed today.
Batch keys still locked to it: rows under them read as locked with an earlier key.
When interaction retention will have removed the last row under it. null when no batch key is locked to it.
The same moment under the name a reader wants: when it stopped being used.
off, encrypting, on, rekeying or decrypting.
A running job.
Progress, per kind of content.
encrypt, decrypt, rekey_browser or rekey_server.
Rows to walk. 0 until the sweep has counted.
null until there is a rate to go by.
Set only while a browser holds the lease on a change of key.
browser or server during a change of key.
The email of whoever set it.
Errors
- 403
Caller lacks settings:manage in this workspace
- 409
plan_feature,key_reusedorstate_conflict- 422
not_verifiedorchallenge_expired
List rows that could not be converted
The rows the sweep could not convert. Each is retried hourly, and none stops the job.
Response200
Up to 200, oldest first
A code: the_blob_did_not_open, no_opened_key and the like.
Errors
- 403
Caller lacks settings:manage in this workspace
Send opened batch keys
Send opened batch keys for a job on the server. Each is checked against its check value, kept for that job, and destroyed when it ends. The private key is never sent.
Request bodyOpenedInput
Up to 500.
Base64 of 32 bytes.
disable or rekey.
Response200
Stored; send the same chunk again safely
Batch keys under the current key with an opened copy here.
Errors
- 400
An unknown purpose, or more than 500 keys
- 403
Caller lacks settings:manage in this workspace
- 409
state_conflict- 422
wrong_keyorunknown_batch, namingbatch_id; nothing in the chunk is stored- 503
This deployment has no key configured
Destroy unused opened batch keys
Destroy opened batch keys sent for a job that did not start. Keys a running job is using stay; ending that job destroys them.
Response204
Destroyed, or nothing to destroy
Errors
- 403
Caller lacks settings:manage in this workspace
Hold the running job. New data still follows the state
Response200
Held
Of stored, what is sealed today.
Batch keys still locked to it: rows under them read as locked with an earlier key.
When interaction retention will have removed the last row under it. null when no batch key is locked to it.
The same moment under the name a reader wants: when it stopped being used.
off, encrypting, on, rekeying or decrypting.
A running job.
Progress, per kind of content.
encrypt, decrypt, rekey_browser or rekey_server.
Rows to walk. 0 until the sweep has counted.
null until there is a rate to go by.
Set only while a browser holds the lease on a change of key.
browser or server during a change of key.
The email of whoever set it.
Errors
- 403
Caller lacks settings:manage in this workspace
- 409
No job is running
Start changing key
Start changing key. New batch keys are locked to both keys from here on.
Request bodyRekeyInput
The verified_key_id of the new key.
browser or server.
Response200
Changing key
Of stored, what is sealed today.
Batch keys still locked to it: rows under them read as locked with an earlier key.
When interaction retention will have removed the last row under it. null when no batch key is locked to it.
The same moment under the name a reader wants: when it stopped being used.
off, encrypting, on, rekeying or decrypting.
A running job.
Progress, per kind of content.
encrypt, decrypt, rekey_browser or rekey_server.
Rows to walk. 0 until the sweep has counted.
null until there is a rate to go by.
Set only while a browser holds the lease on a change of key.
browser or server during a change of key.
The email of whoever set it.
Errors
- 400
An unknown mode
- 403
Caller lacks settings:manage in this workspace
- 409
key_reused,state_conflict, or in server modekeys_missing- 422
not_verifiedorchallenge_expired
Send re-locked batch keys
Send batch keys re-locked to the new key. Idempotent, and safe to resume.
Request bodyCopiesInput
Up to 500.
Base64 of a binary age file locked to the new key.
Response200
Stored
Errors
- 400
Not base64, not an age file, or more than 500 copies
- 403
Caller lacks settings:manage in this workspace
- 409
state_conflict- 422
unknown_batch
Discard a change of key
Discard a change of key. The new key stays in the history and cannot be used again.
Response200
Back on the current key
Of stored, what is sealed today.
Batch keys still locked to it: rows under them read as locked with an earlier key.
When interaction retention will have removed the last row under it. null when no batch key is locked to it.
The same moment under the name a reader wants: when it stopped being used.
off, encrypting, on, rekeying or decrypting.
A running job.
Progress, per kind of content.
encrypt, decrypt, rekey_browser or rekey_server.
Rows to walk. 0 until the sweep has counted.
null until there is a rate to go by.
Set only while a browser holds the lease on a change of key.
browser or server during a change of key.
The email of whoever set it.
Errors
- 403
Caller lacks settings:manage in this workspace
- 409
state_conflict
Finish changing key
Finish changing key: the sample's answers against the stored check values, and if every one matches the new key takes over in one transaction.
Request bodyFinishInput
Base64 of HMAC-SHA256 under the batch key, over the text oxelone-batch-check-v1 and the id as 16 bytes.
Response200
The new key is active
Of stored, what is sealed today.
Batch keys still locked to it: rows under them read as locked with an earlier key.
When interaction retention will have removed the last row under it. null when no batch key is locked to it.
The same moment under the name a reader wants: when it stopped being used.
off, encrypting, on, rekeying or decrypting.
A running job.
Progress, per kind of content.
encrypt, decrypt, rekey_browser or rekey_server.
Rows to walk. 0 until the sweep has counted.
null until there is a rate to go by.
Set only while a browser holds the lease on a change of key.
browser or server during a change of key.
The email of whoever set it.
Errors
- 403
Caller lacks settings:manage in this workspace
- 409
copies_missingorstate_conflict- 422
wrong_check,unknown_batchorsample_incomplete; nothing is switched
Say the tab changing key is still open
Say the tab changing key is still there. With none for 60 seconds, the change reads as paused.
Response204
Noted
Errors
- 403
Caller lacks settings:manage in this workspace
- 409
No change of key is running in a browser
Get the final check sample
Twenty random new copies to open with the new private key.
Response200
The copies the finish must prove
Base64 of HMAC-SHA256 under the batch key, over the text oxelone-batch-check-v1 and the id as 16 bytes.
During a change of key: whether its copy for the new key is here.
The key wrapped is locked to.
Base64 of a binary age file: <id> <base64 of the key>\n.
Errors
- 403
Caller lacks settings:manage in this workspace
- 409
copies_missingorstate_conflict
Let a held job go on
Response200
Running
Of stored, what is sealed today.
Batch keys still locked to it: rows under them read as locked with an earlier key.
When interaction retention will have removed the last row under it. null when no batch key is locked to it.
The same moment under the name a reader wants: when it stopped being used.
off, encrypting, on, rekeying or decrypting.
A running job.
Progress, per kind of content.
encrypt, decrypt, rekey_browser or rekey_server.
Rows to walk. 0 until the sweep has counted.
null until there is a rate to go by.
Set only while a browser holds the lease on a change of key.
browser or server during a change of key.
The email of whoever set it.
Errors
- 403
Caller lacks settings:manage in this workspace
- 409
No job is running
Start over with a new key
Use a new key from now on, when the old one is lost. Rows under the old key stay under it until retention removes them.
Request bodyStartOverInput
The workspace's name, typed.
Response200
New data uses the new key
Of stored, what is sealed today.
Batch keys still locked to it: rows under them read as locked with an earlier key.
When interaction retention will have removed the last row under it. null when no batch key is locked to it.
The same moment under the name a reader wants: when it stopped being used.
off, encrypting, on, rekeying or decrypting.
A running job.
Progress, per kind of content.
encrypt, decrypt, rekey_browser or rekey_server.
Rows to walk. 0 until the sweep has counted.
null until there is a rate to go by.
Set only while a browser holds the lease on a change of key.
browser or server during a change of key.
The email of whoever set it.
Errors
- 400
The workspace name does not match
- 403
Caller lacks settings:manage in this workspace
- 409
key_reusedorstate_conflict- 422
not_verifiedorchallenge_expired
Prove the key with its code
Request bodyVerifyInput
The key the code was asked for. The newest code for it is the one tried.
Response200
The key is proved
What turning on, changing key and starting over each require.
Errors
- 403
Caller lacks settings:manage in this workspace
- 409
plan_feature- 422
wrong_code,challenge_expired,challenge_exhaustedornot_verified; a wrong code also says how many tries are left- 503
This deployment has no key configured