Skip to main content
POST
Encrypt payload

Authorizations

X-Qanapi-Authorization
string
header
required

A machine credential, qk_ followed by its secret. The first twelve characters are an indexed prefix; the rest is compared in constant time against a stored SHA-256 hash. A key reaches only the configurations it is linked to.

It may also be sent as Authorization: Bearer qk_..., which is recognised by the prefix.

Headers

X-Qanapi-Fields
string

Comma-separated dot paths to encrypt or decrypt, for example ssn,user.address.postcode. Absent in whole-body mode.

Example:

"ssn,user.dob"

X-Qanapi-Full-Body
string

Treat the whole body as one payload. true, 1, yes or on.

Example:

"true"

X-Qanapi-Mode
enum<string>

Alternative spelling of whole-body mode; full_body.

Available options:
full_body,
full-body
X-Qanapi-Classification
string

Apply a classification to what is being encrypted, by slug or id. Refused unless the caller holds that clearance.

X-Qanapi-Require-Fields
string

Fail the request when a named field path matched nothing, rather than silently returning the document unchanged. Off by default; worth setting in any caller that would rather hear about a typo than store plaintext.

Example:

"true"

X-Qanapi-Destination
string<uri>

Forward the processed payload to this absolute URL and relay the answer back. Every request header travels except x-qanapi-*, authorization and the hop-by-hop set. Restricted by FORWARD_ALLOWED_HOSTS where the installation sets it.

Path Parameters

proxy
string
required

The configuration's proxy slug. Sixteen random lowercase characters unless one was pinned at creation.

Example:

"952zpx6vyig3sdyp"

Body

Any JSON document in field mode. In whole-body mode the body may be any bytes at all, including non-JSON.

Response

In field mode, the document with the named fields replaced by envelopes. In whole-body mode, one envelope as text/plain.

When X-Qanapi-Destination was set this is instead whatever the destination answered, relayed verbatim with its own status, body and headers, and stamped with X-Qanapi-Forwarded-To.