Sign-then-encrypt data (streaming, nested JWE(JWS)).

post

https://staging.ankatech.co/api/v3/crypto/stream/sign-encrypt

Consumes a multipart/form-data request with a JSON
SignEncryptStreamRequest metadata part ({signKid, encryptKid,

validityDays?}) and a binary file part. The payload is signed with
signKid and the resulting compact JWS is encrypted with
encryptKid, so the signature is carried encrypted. signKid

and encryptKid MUST be different and homogeneous (both symmetric or
both asymmetric). The response is the nested ciphertext streamed as
multipart/mixed (JWE header + ciphertext).

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

Sequential multipart body — the parts are read in the order they arrive and the server never buffers the payload.

metadata MUST be sent before file. A file-first body is rejected with 400 application/problem+json, type .../errors/multipart-part-order. This is a property of streaming, not a policy: the server cannot look ahead past a 512 MiB payload to find the part that tells it what to do with it.

metadata is bounded at 2 MiB; file has no size limit.

metadata

object

required

JSON metadata sent with multipart streaming sign-encrypt requests.

file

required

Plaintext file (binary). No size limit.

Headers

string

enum

Defaults to application/problem+json

Generated from available response content types

Allowed:

Responses

Language

Credentials

Bearer

JWT

URL

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/problem+json

200Nested JWE(JWS) produced (stream).

400Malformed metadata, same signKid/encryptKid, or invalid input. PQC session transport is also refused here: an X-PQC-Transport: true or X-PQC-Session header on this route yields .../errors/pqc-transport-not-available-for-streaming, refused before any body byte is read.

401Unauthorized.

403Missing scope or cross-tenant key reference.

404signKid or encryptKid not found / unsuitable.

409Conflict: the tenant's key-protection backend is not configured - never declared, or declared but not yet bound. Durable: complete the setup rather than retrying. No Retry-After is sent.

413Payload Too Large: the small part (metadata or header) exceeded its 2 MiB cap. file has NO size limit — this response never refers to the payload.

429Too Many Requests: the streaming concurrency bound is full, either globally or for this tenant. Retry-After carries the suggested delay in seconds. This bound replaced the edge client_max_body_size ceiling PRD §130 removed, so it is emittable on every streaming endpoint.

500Unexpected failure during streaming sign-encrypt.

503Service Unavailable: the tenant's key-protection backend is bound but not currently usable. Transient - retry after the Retry-After interval. The body is oracle-safe and names no backend, token, slot, PIN or vendor.