Keys

All routes are protected. See Encryption for what each field holds.

Get the key setCopy Anchor Link

GET /api/v1/keys

Answers the caller's key set. 404 means the vault has not been set up yet; clients use it to decide between "create your vault" and "unlock".

{
  "data": {
    "user_id": "…",
    "kdf": "argon2id",
    "kdf_salt": "base64",
    "kdf_memory_kib": 65536,
    "kdf_iterations": 3,
    "kdf_parallelism": 1,
    "encrypted_vault_key": "base64",
    "public_key": "base64",
    "encrypted_private_key": "base64",
    "created_at": "…",
    "updated_at": "…"
  }
}

Create the key setCopy Anchor Link

POST /api/v1/keys

Sets up the vault, once. A second call answers 409.

Answers 201 with the stored key set.

Change the master passwordCopy Anchor Link

PUT /api/v1/keys

Takes the five kdf_* and encrypted_vault_key fields above. The key pair does not change, so everything already shared with the user stays readable.

Look up a public keyCopy Anchor Link

GET /api/v1/keys/[email protected]

Answers what is needed to share with that user:

{
  "data": { "user_id": "…", "name": "Ada", "email": "[email protected]", "public_key": "base64" }
}

404 when there is no such user, or they have not set up a vault.