JsonApi
Menu
Operations
Tools

Session connection

Access tokens are stored in this browser and shared across tabs.

Use the access token received from the login endpoint.

Create access key

Grant only the minimum permissions the integration really needs.

Leave blank if the key does not need an expiration date.

Keys granted

Check permissions, recent activity and IP restrictions of each key.

Client-side encryption The AES-256-GCM engine runs locally in the browser Open the tool

Create AES-256-GCM envelopes in the browser. The key is not sent to JsonApi or saved with the session.

Instructions for use
  1. Generate and save keys Select Generate keys, copy the Base64URL key and immediately save it to your password manager or KMS.
  2. Encode JSON Enter pure JSON in the editing area and select Encode JSON. The content will be replaced by encrypted envelope.
  3. Save resources Send the envelope in the data field and set encrypted: true. Never send the encryption key to the API.
  4. Decoding Paste the correct key and envelope into the tool, then select Decode the envelope.

Payload sent to API

{
  "name": "Encrypted record",
  "private": true,
  "encrypted": true,
  "data": {
    "v": 1,
    "alg": "A256GCM",
    "iv": "<base64url-iv>",
    "ciphertext": "<base64url-ciphertext>"
  }
}

Encrypted resources cannot use collection schema, extras, score, search or content analytics. Losing the key means the original data cannot be restored.

Losing the key means losing data. Save the key in password manager or KMS. Do not place locks in resource, log, URL or API requests.

SupportCRUD, versions, export, private/public access
Not supportedSearch, collection schemas, extras, scoring, and content analytics