Decrypt payload
The inverse of encrypt, with the same two modes and the same forwarding behaviour. An envelope is refused unless it was produced in the configuration it is presented to, independently of the AEAD check, and unless the caller holds the clearance the record carries.
Envelopes from the legacy PHP implementation, which begin qanapi:, are
refused as a format error rather than attempted and failed.
Authorizations
A machine credential, qk_ followed by its secret. The first twelve
characters are an indexed prefix; the rest is compared in constant time
against a stored SHA-256 hash. A key reaches only the configurations it is
linked to.
It may also be sent as Authorization: Bearer qk_..., which is
recognised by the prefix.
Headers
Comma-separated dot paths to encrypt or decrypt, for example
ssn,user.address.postcode. Absent in whole-body mode.
"ssn,user.dob"
Treat the whole body as one payload. true, 1, yes or on.
"true"
Alternative spelling of whole-body mode; full_body.
full_body, full-body Forward the processed payload to this absolute URL and relay the answer
back. Every request header travels except x-qanapi-*, authorization
and the hop-by-hop set. Restricted by FORWARD_ALLOWED_HOSTS where the
installation sets it.
Path Parameters
The configuration's proxy slug. Sixteen random lowercase characters unless one was pinned at creation.
"952zpx6vyig3sdyp"
Body
The body is of type string.
Response
The plaintext, in the shape it was encrypted from.