Decrypt a JWE (Compact or General JSON)

post

https://{host}:{port}/api/v3/crypto/decrypt

Parses and decrypts the given JWE using the private key
identified by its kid header. Returns the plaintext
(Base64-encoded) plus metadata about key selection, algorithm, and
any warnings.

Supports both JWE Compact Serialization (SIMPLE keys) and JWE General JSON Serialization (COMPOSITE keys).

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

JSON object with exactly one field:
• jweToken – JWE to decrypt (String for Compact format, Map for General JSON format)

Request body for decrypting JWE in Compact or General JSON format.
The token already contains the kid, key-encryption
algorithm (alg), content-encryption algorithm
(enc) and all cryptographic parameters (IV, CEK,
ciphertext, authentication tag); therefore no
additional fields are required.

Supports both SIMPLE keys (String/Compact) and COMPOSITE keys (Map/General JSON).

jweToken

string

RFC 7516 JWE to be decrypted.

SIMPLE keys: String (Compact format)
COMPOSITE keys: Map (General JSON format)

Headers

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

Responses

200Data decrypted successfully.

400Bad Request: • Malformed Base64 or missing/blank JWE header 'kid', OR • Key does not support the requested operation (e.g., trying to decrypt with an encrypt-only key)

401Unauthorized: missing or invalid JWT token.

404Not Found: specified key does not exist or lacks a private component.

409Conflict: key is in an invalid state (e.g. revoked or suspended).

413Payload Too Large: plaintext exceeds 5 MB after decryption.

422Unprocessable Entity: JWE Compact serialization is malformed.

500Internal Server Error: unexpected error during decryption.