Decrypt data (streaming).

post

https://staging.ankatech.co/api/v3/crypto/stream/decrypt

The request is multipart/mixed with two parts:

application/jose+json — JWE General-JSON header (detached ciphertext).
application/octet-stream — proprietary binary envelope followed by the ciphertext and GCM tag.

The response is multipart/mixed (PRD §64):
PART 1 (application/octet-stream) is the decrypted plaintext and
the trailing PART 2 (application/json) is a
StreamVerdict emitted AFTER the end-of-stream AES-GCM tag is verified

({verdict,operation,reason,correlationId,timestamp}). Because the GCM
tag is only known at end-of-stream, a tamper is reported through an
INVALID verdict in PART 2 — never a silently truncated success.

Supports both SIMPLE keys (single recipient)
and COMPOSITE keys (multiple recipients).

For COMPOSITE keys, decryption uses all recipients to derive
the final content encryption key.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

Sequential multipart body — the parts are read in the order they arrive and the server never buffers the payload.

header MUST be sent before file. A file-first body is rejected with 400 application/problem+json, type .../errors/multipart-part-order. This is a property of streaming, not a policy: the server cannot look ahead past a 512 MiB payload to find the part that tells it what to do with it.

header is bounded at 2 MiB; file has no size limit.

header

object

required

Detached General-JSON JWET header used by the streaming
decryption endpoint – the kid is
mandatory.

file

required

Binary envelope + ciphertext + tag.

Headers

string

enum

Defaults to application/problem+json

Generated from available response content types

Allowed:

Responses

Language

Credentials

Bearer

JWT

URL

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

multipart/mixed

application/problem+json

200multipart/mixed: PART 1 decrypted plaintext, trailing PART 2 the end-of-stream StreamVerdict (VALID/INVALID after the AES-GCM tag check).

400Malformed multipart, invalid JWE header, or key does not support the requested operation. PQC session transport is also refused here: an X-PQC-Transport: true or X-PQC-Session header on this route yields .../errors/pqc-transport-not-available-for-streaming, refused before any body byte is read.

401Unauthorized.

404kid not found or unsuitable.

409Conflict: the tenant's key-protection backend is not configured - never declared, or declared but not yet bound. Durable: complete the setup rather than retrying. No Retry-After is sent.

413Payload Too Large: the small part (metadata or header) exceeded its 2 MiB cap. file has NO size limit — this response never refers to the payload.

429Too Many Requests: the streaming concurrency bound is full, either globally or for this tenant. Retry-After carries the suggested delay in seconds. This bound replaced the edge client_max_body_size ceiling PRD §130 removed, so it is emittable on every streaming endpoint.

500Unexpected error during streaming decryption.

503Service Unavailable: the tenant's key-protection backend is bound but not currently usable. Transient - retry after the Retry-After interval. The body is oracle-safe and names no backend, token, slot, PIN or vendor.