Skip to main content
API v2 uses custom HTTP headers to manage authentication, maintain user sessions, and control encryption/decryption tasks.

Authentication Headers

string
required
Your unique API key. All v2 API keys are typically prefixed with qapi_.
You can manage and rotate your API keys in the API Keys section.
string
A Bearer token used to authenticate the active user. Required for all endpoints except Login.

Content Control

string
required
Must be set to application/json for all requests containing a JSON payload.
string
A comma-separated list of fields in the JSON payload to be processed (encrypted or decrypted).
This header is required for encryption and decryption requests. For other API calls, it can be omitted.
Dot Notation: You can use dot notation to target nested fields within multi-dimensional objects.

Dot Notation Example

When working with nested JSON structures, use the X-Qanapi-Fields header to specify exactly which fields should be touched.
Request

Advanced Routing

string
A URL to forward the request to after encryption. If provided, the processed payload will be sent to this destination instead of being returned to the client.
When using X-Qanapi-Destination, all non-Qanapi headers (e.g., Custom-App-Header) will be forwarded to the destination URL along with the processed payload.

Try it out

See these headers in action by testing the Encryption endpoints.