Decrypt key
Samvaad calls this endpoint to decrypt an Encrypted Data Encryption Key (EDEK) using the corresponding master key in your Key Management System (KMS) or HSM.
The plaintext key is then cached securely in memory by Samvaad for a short, configurable duration to perform data encryption and decryption operations. The key_alias is used to identify which master key should be used for decryption.
Authentication
AuthorizationBearer
A token sent in the Authorization header.
This can be one of two types:
- A short-lived JWT obtained from the
/authendpoint. - A long-lived, static API Key provided during setup.
In both cases, the header format is Authorization: Bearer <token>.
Headers
x-request-id
A unique identifier for this specific API call, generated by the client (Samvaad).
x-trace-id
An identifier to trace a single request across multiple services.
x-request-timestamp
The ISO 8601 timestamp of when the client sent the request.
Request
The request containing the key alias and the encrypted key data.
data
The request payload to decrypt a key.
Response headers
X-Request-Id
A unique identifier for the request, generated by your service.
X-Trace-Id
The identifier for an end-to-end operation, passed from the client to be echoed in the response.
X-Request-Duration
The time in milliseconds the server took to process the request.
X-Response-Timestamp
The ISO 8601 timestamp of when the response was generated.
Response
The DEK was successfully decrypted.
data
The response payload containing the decrypted key.
Errors
400
Bad Request Error
401
Unauthorized Error
404
Not Found Error
422
Unprocessable Entity Error
500
Internal Server Error