# Create classification
Source: https://docs.qanapi.com/api-reference/create-classification
/openapi/openapi.yaml post /v3/classifications
# Create configuration
Source: https://docs.qanapi.com/api-reference/create-configuration
/openapi/openapi.yaml post /v3/configurations
# Create user
Source: https://docs.qanapi.com/api-reference/create-user
/openapi/openapi.yaml post /v3/users
# Decrypt data
Source: https://docs.qanapi.com/api-reference/decrypt-data
/openapi/openapi.yaml post /v3/encryption/{proxy}/decrypt
# Delete classification
Source: https://docs.qanapi.com/api-reference/delete-classification
/openapi/openapi.yaml delete /v3/classifications/{classification}
# Delete configuration
Source: https://docs.qanapi.com/api-reference/delete-configuration
/openapi/openapi.yaml delete /v3/configurations/{configuration}
# Delete user
Source: https://docs.qanapi.com/api-reference/delete-user
/openapi/openapi.yaml delete /v3/users/{user}
# Encrypt data
Source: https://docs.qanapi.com/api-reference/encrypt-data
/openapi/openapi.yaml post /v3/encryption/{proxy}/encrypt
# Get activity logs
Source: https://docs.qanapi.com/api-reference/get-activity-logs
/openapi/openapi.yaml get /v3/logs/activity
# Get API Key
Source: https://docs.qanapi.com/api-reference/get-api-key
/openapi/openapi.yaml get /v3/api-keys/{apiKey}
# Get API logs
Source: https://docs.qanapi.com/api-reference/get-api-logs
/openapi/openapi.yaml get /v3/logs/api
# Get classification
Source: https://docs.qanapi.com/api-reference/get-classification
/openapi/openapi.yaml get /v3/classifications/{classification}
# Get configuration
Source: https://docs.qanapi.com/api-reference/get-configuration
/openapi/openapi.yaml get /v3/configurations/{configuration}
# Get current user
Source: https://docs.qanapi.com/api-reference/get-current-user
/openapi/openapi.yaml get /v3/users/me
# Get Qanapi Flow logs
Source: https://docs.qanapi.com/api-reference/get-qanapi-flow-logs
/openapi/openapi.yaml get /v3/logs/qanapi-flow
# Get unified logs
Source: https://docs.qanapi.com/api-reference/get-unified-logs
/openapi/openapi.yaml get /v3/logs/unified
# Get user
Source: https://docs.qanapi.com/api-reference/get-user
/openapi/openapi.yaml get /v3/users/{user}
# List API Keys
Source: https://docs.qanapi.com/api-reference/list-api-keys
/openapi/openapi.yaml get /v3/api-keys
# List classifications
Source: https://docs.qanapi.com/api-reference/list-classifications
/openapi/openapi.yaml get /v3/classifications
# List configurations
Source: https://docs.qanapi.com/api-reference/list-configurations
/openapi/openapi.yaml get /v3/configurations
# List roles
Source: https://docs.qanapi.com/api-reference/list-roles
/openapi/openapi.yaml get /v3/roles
# List users
Source: https://docs.qanapi.com/api-reference/list-users
/openapi/openapi.yaml get /v3/users
# Restore user
Source: https://docs.qanapi.com/api-reference/restore-user
/openapi/openapi.yaml patch /v3/users/{user}/restore
# Revoke API Key
Source: https://docs.qanapi.com/api-reference/revoke-api-key
/openapi/openapi.yaml post /v3/api-keys/{apiKey}/revoke
# Rotate API Key
Source: https://docs.qanapi.com/api-reference/rotate-api-key
/openapi/openapi.yaml post /v3/api-keys/{apiKey}/rotate
# Update classification
Source: https://docs.qanapi.com/api-reference/update-classification
/openapi/openapi.yaml patch /v3/classifications/{classification}
# Update configuration
Source: https://docs.qanapi.com/api-reference/update-configuration
/openapi/openapi.yaml patch /v3/configurations/{configuration}
# Update user
Source: https://docs.qanapi.com/api-reference/update-user
/openapi/openapi.yaml patch /v3/users/{user}
# Classifications
Source: https://docs.qanapi.com/get-started/classifications
Learn about classifications and how they be used to secure your data.
Classifications are a fundamental component of Qanapi's **Zero Trust** architecture, serving as the policy engine that
defines granular access controls and data handling rules for your sensitive information.
By tagging data with classifications, you can strictly control who can access it and how it is processed across
different services, including direct API usage and our Live Redaction integration for Google Docs™.
## Access Control
Classifications act as gatekeepers for your encrypted data. You can manage access at a granular level by assigning:
Grant specific application users the ability to encrypt or decrypt data associated with a classification. Any
user in your **Users** area can be added directly to a classification.
Assign roles to a classification to manage access for groups of users within your application. Any of the 4
roles can be directly assigned to classifications.
This ensures that only authorized entities can perform cryptographic operations on data protected by a specific
classification through the API.
## Live Redaction Integration
Classifications are essential for **Live Redaction**, enabling secure data masking and encryption based on
organizational identity. This is the central mechanism for allowing users with different access to view the same
document.
### Provider Configurations & Google Groups
You can add **Provider Configurations** to a classification and specify **Google Groups**. This integration allows
Qanapi to verify membership in these groups before granting access to encrypted data, bridging your organizational
identity with your data security policy.
### Enabling Encryption
To enable encryption within Live Redaction, you **must** assign any relevant classifications to your provider
configuration. Without this assignment, Live Redaction will not have the necessary context to perform encryption
operations. This is done
## Creating Classifications
You can manage your classifications through two primary methods:
Create and manage classifications in the site at the **Classifications** link in the sidebar.
Programmatically manage classifications using the API.
See the [Classifications API Reference](/api-reference/list-classifications) for more details.
# Configurations
Source: https://docs.qanapi.com/get-started/configurations
Learn about configurations and how they manage your add-ons and encryption settings.
In Qanapi, **Configurations** are the central building blocks for managing your tools and security settings. They act as
isolated objects that hold specific settings, credentials, and encryption keys.
Understanding the difference between the two types of configurations is crucial for setting up your environment correctly.
## Types of Configurations
There are two primary types of configurations: **Provider Configurations** and **Encryption Configurations**.
Provider Configurations are used to manage your connection to external services, such as **Qanapi Flow**.
* **Purpose**: They hold the authentication details (OAuth, Service Accounts) and metadata required to interact with
the provider's API.
* **Scope**: A provider configuration typically maps to a single organization or workspace within a provider.
* **Usage**: Use these to manage who has access to certain features and to monitor the usage of specific provider-linked
services.
* **Add-Ons**: All your active add-ons (e.g., Client-Side Encryption, Email Classification, Live Redaction) are linked
to a Provider Configuration.
Encryption Configurations are dedicated to managing the security and cryptographic aspects of your data.
* **Purpose**: They store Master Encryption Keys (MEK), algorithms, and versioning information used for data protection.
* **Scope**: These are decoupled from provider authentication, allowing you to use the same encryption standard across
different providers or multiple configurations for different security levels.
* **Usage**: When you enable an add-on that requires encryption (like Client-Side Encryption), you will assign it
to an Encryption Configuration.
* **Isolation**: By separating encryption from the provider configuration, we ensure that your cryptographic keys are
managed independently of your service credentials.
## Key Differences
| Feature | Provider Configuration | Encryption Configuration |
| :- | :- | :- |
| **Primary Focus** | API Connectivity & Authentication | Data Security & Cryptography |
| **Typical Data** | OAuth tokens, Service Account JSON, Admin emails | Encryption keys (MEK), Algorithms (AES), Proxy Slugs |
| **Add-On Link** | Owns the activation keys for services | Assigned to specific activation keys for security |
| **Customizability** | Focused on provider-specific settings | Focused on security standards and key rotation |
# Introduction
Source: https://docs.qanapi.com/get-started/introduction
Welcome to the Qanapi API Documentation
# Qanapi API Documentation
Qanapi is an advanced API-based encryption service designed to provide granular control over your sensitive data. As a
third-party key management service, Qanapi enables organizations to encrypt and decrypt data with ease, while securely
managing encryption keys.
## What is Qanapi?
Qanapi offers robust data classification features, allowing you to control who can access specific parts of your data
based on classifications and access groups. With quantum-hardened encryption and FIPS 140-3 compliant security, Qanapi
provides enterprise-grade data protection while maintaining flexibility and ease of use.
Start using Qanapi with our quickstart guide
Directly encrypt and decrypt JSON fields via high-performance proxy endpoints.
## Key Features
Qanapi supports multiple encryption strategies including AES-256 (FIPS 140-3 and quantum-resistant).
Create and manage data classification tags to associate with your encrypted data, enabling fine-grained access
control.
Seamlessly encrypt, classify, and protect data within any HTTP request, ensuring sensitive data is never exposed
to the destination.
Qanapi is designed with security and compliance in mind, supporting various frameworks including FedRAMP, DoD
IL4, CMMC 2.0, ISO 27001, PCI DSS, HIPAA, and GDPR.
# Quickstart
Source: https://docs.qanapi.com/get-started/quickstart
Get started with Qanapi in just a few minutes
# Qanapi Quickstart Guide
This guide will help you get up and running with Qanapi quickly. Follow these steps to start protecting your sensitive
data with Qanapi's advanced encryption services.
1. Visit [qanapi.cloud](https://qanapi.cloud) and click "Create an account"
2. Fill out the registration form with your information
3. Verify your email address
4. Log in to your new Qanapi tenant dashboard
By creating an account, you acknowledge that the system is subject to U.S. government information
regulations. Be sure to review the legal notice at the bottom of the registration page.
Once logged in, you'll need to create an Encryption Configuration:
1. Go to the Configurations > Encryptions
2. Click Add Encryption
1. Name it whatever you prefer and select your algorithm of choice
3. Click Create Config
To interact with the Qanapi API, you'll need an API key:
1. Go to Karst\_Gorge > API Keys
2. Click Create New Key
3. Select the user, the configs to use and the permissions it can use.
4. Click Create Key
5. Copy the key that is displayed. This should be used as your X-Qanapi-Authorization header.
6. Go to one of the Encryption configurations the key is assigned to and copy the proxy string.
1. This is used in the encrypt and decrypt routes to tell the API what settings to use.
Your API key will only be displayed once. Make sure to store it securely as it cannot be retrieved later.
That's it! You are now ready to use the Encryption API. Visit
[the API reference](/api-reference/list-configurations) to learn what routes are available.
# SDKs
Source: https://docs.qanapi.com/karst_gorge/sdks
Official SDKs and client libraries for integrating Qanapi's post-quantum encryption into your applications.
## Overview
Qanapi provides official, open-source SDKs across multiple programming languages to streamline integrating post-quantum
encryption, key management, and zero-trust data classification into your software architecture.
Key capabilities provided by all official SDKs:
* **Type Safety & Intellisense:** Full type definitions and auto-completion across all supported frameworks.
* **Flexible Engine Routing:** Out-of-the-box support for both Qanapi Cloud (Fully Managed) and self-hosted `Karst_Gorge`
engine endpoints.
* **Automatic Resilience:** Native handling of retries, backoff strategies, and connection pooling.
## Available SDKs
Explore our supported languages and package registries below:
Official package for server-side TypeScript or JavaScript Node.js, Deno and Bun applications.
Python package for backend services, data pipelines, and AI/LLM security workflows.
High-performance Go module built for microservices, proxies, and cloud infrastructure.
JVM client library designed for Kotlin and Java applications across Spring Boot, Ktor, and Android.
Need support for another programming language or framework? Check out our [REST API Reference](/v3/overview) or
contact our team at [support@qanapi.com](mailto:support@qanapi.com).
## Package Registry Quick Reference
| Language | Registry Link | Package Identifier |
| :- | :- | :- |
| **TypeScript** | [npm Repository](https://www.npmjs.com/package/qanapi) | `qanapi` |
| **Python** | [PyPI Index](https://pypi.org/project/qanapi/) | `pypi.org/project/qanapi/` |
| **Go** | [pkg.go.dev Reference](https://pkg.go.dev/github.com/qanapi/qanapi-sdk-golang) | `github.com/qanapi/qanapi-sdk-golang` |
| **Kotlin / Java** | [Sonatype Central](https://central.sonatype.com/artifact/cloud.qanapi/qanapi-kotlin) | `cloud.qanapi:qanapi-kotlin` |
# Guided Setup
Source: https://docs.qanapi.com/qanapi-flow/guided-setup
Getting started with your bundle
# What is it?
The Guided Setup is a guided walkthrough to help setting up any bundle or trial your account may require. If you purchase
any of our bundles, the setup will guide you through setting them up all at once. It groups the steps by
where they need to be completed (i.e.; Google Admin Console vs. Google Cloud Platform Console). This is meant to get
the products up and running quickly.
Before starting, you will need to have a Qanapi account. You can use the
[quickstart guide](/get-started/quickstart) to get started. You will also need to start a trial or [purchase a
bundle](/qanapi-flow/purchase) for this area to show.
1. In your account, once you have started the trial or purchased a bundle, a new page will appear in the left side
navigation.
2. Click the Guided Setup link.
1. You will need both a provider configuration and an encryption configuration.
2. The [quickstart guide](/get-started/quickstart) will walk you through the Encryption Configuration.
3. The [purchase guide](/qanapi-flow/purchase) will walk you through the Provider Configuration.
4. If your bundle included S/MIME, you MUST add a service account json to the Provider Configuration.
1. There is a guide for how to do this in the Guided Setup.
1. Go through each step in order to get set up with the products.
2. Some steps will validate your information with Google. Not all steps can be validated from the API.
3. Once all steps are completed, the Mark Setup Completed button will
be enabled.
4. Click on it to complete the setup.
1. If your bundle included S/MIME, a window will pop up to give you extra options..
# Live Redaction
Source: https://docs.qanapi.com/qanapi-flow/live-redaction
Helpful guides and details
# Requirements
In order for Live Redaction to function you need 3 things:
1. A Google Organization
2. A valid license in [https://qanapi.cloud](https://qanapi.cloud).
3. At least 1 [classification](/get-started/classifications).
Once you have this, and you have added the add on to your Google account/organization, it will work.
# Converting Versions
There used to be an HTTP Endpoint version of Live Redaction. This version used Google response cards and hover mechanics
to handle the encryption and decryption logic. When we upgraded to the Apps Script version, there needed to be a way to
convert these older ones to the new version. The way you do this is pretty simple.
1. Hover over the old style encryption.
2. Click the "" icon. This will copy the URL to your clipboard.
![Copy URL]()
Paste the copied URL anywhere in the document that you want it.
1. Highlight your URL.
2. Click "Detect Version" on the sidebar.
3. In the new area at the top you will see 2 options:
1. **Encrypt**: This will convert the old URL into a new encryption string. It will have the same classification
color as the original encryption.
2. **Decrypt**: This will convert the old URL into a plain text string of the decrypted data.
![Highlight Old URL]()
![Convert URL]()
# Purchasing Qanapi Flow
Source: https://docs.qanapi.com/qanapi-flow/purchase
How to get started with our suite of products.
# How to purchase
Before starting, you will need to have a Qanapi account. You can use the
[quickstart guide](/get-started/quickstart) to get started.
For CSE and Live Redaction you will need an Encryption Configuration as well. The above Quickstart walks you through
creating one as the second step.
Once logged in, you'll need to create a Provider Configuration:
1. Go to the Configurations > Providers
2. Click Add Provider
3. Select either OAuth or Service Account for your authentication method.
4. Fill out the form with your provider's credentials.
5. Click Create & Save or Authenticate with Google
1. Now that you have your provider, you can purchase a bundle.
1. You can do this from:
1. Any page under Qanapi Flow.
2. From the Billing page.
3. On your new Provider in the Providers page.
2. Click the
Purchase Keys.
3. Select your Provider (unless coming from the Providers page) and then your bundle.
1. Fill out your billing details with Stripe.
2. Complete the purchase.
3. You will be redirected to your Provider details page.
4. Once the Stripe order finishes, your new keys will appear.
1. For each key you purchased through the bundle, you will need to configure them.
2. Under Qanapi Flow you will see links for each
product.
3. Click through each product you purchased.
1. If they require an Encryption Configuration, you must assign it first.
2. Click the Setup Guide button
and follow the steps to fully set up the product in your Google Org.
That's it! You are now ready to use Qanapi Flow products!
# S/MIME
Source: https://docs.qanapi.com/qanapi-flow/smime
Helpful guides and troubleshooting
# Google S/MIME Setup
1. Go to the [Google Admin SDK API](https://console.cloud.google.com/marketplace/product/google/admin.googleapis.com)
in Google Console.
2. Click the Enable button and wait for it to finish.
3. It will redirect you to the SDK API management page.
If you see a "Manage" button, this is already enabled.
1. Go to the [Gmail SDK API](https://console.cloud.google.com/marketplace/product/google/gmail.googleapis.com)
in Google Console.
2. Click the Enable button and wait for it to finish.
3. It will redirect you to the SDK API management page.
If you already see a "Manage" button, this is already enabled.
1. Go to [Gmail User Settings](https://admin.google.com/ac/apps/gmail/usersettings) in Google Admin.
2. Click the section at the bottom for "S/MIME".
3. Check
Enable S/MIME encryption for sending and receiving emails.
4. Check
Allow users to upload their own certificates.
5. ClickSave.
1. Go to [Client-Side Encryption](https://admin.google.com/ac/cse/keyservice) in Google Admin.
2. In the "Assignment" section, under "Encryption status by app", click
Edit for Gmail.
3. Select On and click
Save.
# Ordering Certificates for Users
1. Select S/MIME (/flow/smime) in the Qanapi App.
2. Click the Manage link on the Provider.
3. Select the non-active users you wish to enable by clicking the checkbox next to each one.
4. Click the Enable button.
5. Certificates will be ordered for each selected user, and the status will change to
Pending Order.
6. Once the order has processed in the background, the status will change to
Pending Approval and the user will receive an email to verify their email
address.
7. Users will follow the link in the email and click the Approve button.
8. The status will change to Pending Upload, and the app will attempt to upload
the certificate (or CSE Identity) to Gmail. This may take up to 5 minutes.
9. After a successful upload, the status will change to Active.
You may view a user's Gmail certificate information by clicking the "Certificate Info" button next to a user on
the Qanapi S/MIME management page
## Cancelling Certificates for Users
1. Select S/MIME (/flow/smime) in the Qanapi App.
2. Click the Manage link on the Provider.
3. Select the active users you wish to disable by clicking the checkbox next to each one.
4. Click the Disable button.
5. Users will have their status updated to Pending Cancellation.
6. The certificate (or CSE Identity) will be removed from Gmail and the status will update to
Cancelled.
# Sending a signed email
1. In Gmail, open a new draft email by clicking the "Compose" button.
2. Click the lock icon () in the top right of the email.
3. Under "Digital Signature", click the "Sign Message" option.
4. Draft the email and click "Send".
5. Once sent, the email should have a certificate icon () under
the sender's name.
# Encrypting emails
To send encrypted emails with another email address, both senders must first send signed emails to exchange public
certificates.
1. In Gmail, draft and send a signed email to the desired recipient.
2. The recipient must do the same, replying to the first email with their own signed email.
3. Begin a reply to this email and click the lock icon () in the top
right of the email.
4. Under the "Additional encryption" section, click the "Turn on" link. A verification dialog may open a warning about
the loss of any existing body to the email.
5. Draft the email and click "Send". This may take a few seconds as Gmail encrypts the email.
6. Once sent, the email should have a green lock icon () or blue shield icon
() under the sender's name.
All future replies to this email chain will now be encrypted with the recipient
A green lock icon denotes Hosted S/MIME, where Gmail uses certificates uploaded from Qanapi.
A blue shield
icon denotes CSE-wrapped S/MIME, where Gmail uses Qanapi's Client-Side Encryption
# Troubleshooting
The most likely cause is that the user was created recently. Google needs time to replicate its changes. This can
take several minutes to several hours.
This happens when using Google's [Client-Side Encryption](https://admin.google.com/ac/cse/keyservice) where the Key
Service is set to a different URI than the Provider Configuration.
The most likely cause is failure to exchange signatures before sending encrypted emails. The signature exchange
allows Gmail to capture the sender's public encryption keys in order to properly encrypt emails.
# Custom Headers
Source: https://docs.qanapi.com/v3/headers
Unique headers used in API v3 to control authentication, data selection, and request routing.
# Authentication Header
Your unique API key. All v3 API keys are prefixed with `qapi_`.
You can manage and rotate your API keys in the [API Keys section](/api-reference/list-api-keys).
# Content Control
Must be set to `application/json` for all requests containing a JSON payload.
A comma-separated list of fields in the JSON payload to be processed (encrypted or decrypted).
This header is **required** for encryption and decryption requests. For other API calls, it can be omitted.
**Dot Notation:** You can use dot notation to target nested fields within multi-dimensional objects.
## Dot Notation Example
When working with nested JSON structures, use the `X-Qanapi-Fields` header to specify exactly which fields should be
touched.
```bash Request theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl -X POST https://{subdomain}.qanapi.cloud/api/v3/encryption/{proxy}/encrypt \
-H "X-Qanapi-Authorization: qapi_..." \
-H "X-Qanapi-Fields: user.email, user.address.zip" \
-d '{
"user": {
"name": "John Doe",
"email": "john@example.com",
"address": {
"city": "New York",
"zip": "10001"
}
}
}'
```
# Classifications
The ID or slug of a classification to assign to the encrypted data.
If you use this header with an encryption request, the key(s) it generates will be tagged with that classification.
This means that if any other user or api key tries to decrypt the data, they MUST have access to the classification.
If they do not, they will not be able to decrypt the data. This adds an extra layer of security on the data you encrypt
through our system.
# Advanced Routing
A URL to forward the request to after processing. If provided, Qanapi will act as a transparent proxy.
When using `X-Qanapi-Destination`, all non-Qanapi headers (e.g., `Authorization`, `Custom-App-Header`) will be
forwarded to the destination URL along with the processed payload.
See these headers in action by testing the Encryption endpoints.
# Overview
Source: https://docs.qanapi.com/v3/overview
The Qanapi API v3 provides a powerful set of HTTP endpoints that allows you to seamlessly encrypt and protect data within any HTTP request.
Welcome to the Qanapi API v3. This version introduces enhanced configuration management, unified logging, and streamlined
encryption workflows to ensure your sensitive data remains protected from end to end.
Directly encrypt and decrypt JSON fields via high-performance proxy endpoints.
Manage provider and encryption configurations for your secure data flow.
Create, rotate, and revoke secure access keys for your applications.
Monitor activity, API usage, and Qanapi Flow events in a single view.
## Authentication
All API requests must be authenticated using an API key passed in the `X-Qanapi-Authorization` header.
API keys in v3 are prefixed with `qapi_` for easy identification and security scanning.
```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl -H "X-Qanapi-Authorization: qapi_your_api_key_here" \
https://your-subdomain.qanapi.cloud/api/v3/users/me
```
## Base URL
The API v3 is hosted on customer-specific subdomains to ensure isolation and performance.
```bash Base URL theme={"theme":{"light":"github-light","dark":"github-dark"}}
https://{subdomain}.qanapi.cloud/api/v3
```
You can get your own account for free at [qanapi.cloud](https://qanapi.cloud).
## Core Components
### Configurations
Configurations are the heart of Qanapi. They define how we interact with your identity provider and which strategy is
used for encryption.
* **Provider Configurations**: Configure integrations with external services like Google.
* **Encryption Configurations**: Define the logic for data protection within your requests.
You can learn more about configurations in our [Configuration Guide](/get-started/configurations).
### User Management
Manage your team's access with granular roles and permissions. API v3 supports:
* Listing and creating users.
* Role-based access control.
* Two-factor authentication (2FA) status tracking.
* Soft-deletion and restoration of user accounts.
### Observability
Keep a full audit trail of everything happening in your environment.
* **Activity Logs**: Track administrative actions taken by users.
* **API Logs**: Monitor request-level details, including status codes and proxying info.
* **Qanapi Flow Logs**: Specialized logging for automated data flows.
Ensure you monitor your API logs for `403 Forbidden` responses, which may indicate insufficient permissions for the
provided API key.
## Next Steps
Ready to start building? Check out our quickstart guide or dive into the specific endpoint documentation.
Get up and running with v3 in minutes.
Explore the full technical specification for every endpoint.