Encrypt payload
Two modes, chosen by header:
X-Qanapi-Fieldsnames dot-separated paths inside a JSON body. Each named leaf is replaced by an envelope string; everything else is returned untouched.X-Qanapi-Full-Body: truetreats the whole body as one payload and returns a single envelope astext/plain, whatever the body was.
Every payload gets a fresh key encryption key and data encryption key, so a nonce is never reused under a key. Strictly AES-256-GCM: a request asking for another algorithm is refused rather than quietly honoured.
Setting X-Qanapi-Destination turns the call into a proxy. See the
response description and docs/api-guide.md.
Authorizations
A machine credential, qk_ followed by its secret. The first twelve
characters are an indexed prefix; the rest is compared in constant time
against a stored SHA-256 hash. A key reaches only the configurations it is
linked to.
It may also be sent as Authorization: Bearer qk_..., which is
recognised by the prefix.
Headers
Comma-separated dot paths to encrypt or decrypt, for example
ssn,user.address.postcode. Absent in whole-body mode.
"ssn,user.dob"
Treat the whole body as one payload. true, 1, yes or on.
"true"
Alternative spelling of whole-body mode; full_body.
full_body, full-body Apply a classification to what is being encrypted, by slug or id. Refused unless the caller holds that clearance.
Fail the request when a named field path matched nothing, rather than silently returning the document unchanged. Off by default; worth setting in any caller that would rather hear about a typo than store plaintext.
"true"
Forward the processed payload to this absolute URL and relay the answer
back. Every request header travels except x-qanapi-*, authorization
and the hop-by-hop set. Restricted by FORWARD_ALLOWED_HOSTS where the
installation sets it.
Path Parameters
The configuration's proxy slug. Sixteen random lowercase characters unless one was pinned at creation.
"952zpx6vyig3sdyp"
Body
Any JSON document in field mode. In whole-body mode the body may be any bytes at all, including non-JSON.
Response
In field mode, the document with the named fields replaced by
envelopes. In whole-body mode, one envelope as text/plain.
When X-Qanapi-Destination was set this is instead whatever the
destination answered, relayed verbatim with its own status, body and
headers, and stamped with X-Qanapi-Forwarded-To.