Encrypting & Decrypting Data

1. Create a key

curl -X POST https://redeyed.com/api/v1/kms/keys \
  -H "X-Api-Key: $KEY" -H 'Content-Type: application/json' \
  -d '{"alias":"orders","type":"symmetric"}'

2. Encrypt

curl -X POST https://redeyed.com/api/v1/kms/keys/orders/encrypt \
  -H "X-Api-Key: $KEY" -H 'Content-Type: application/json' \
  -d '{"plaintext":"4111 1111 1111 1111","aad":"order:8842"}'
# -> { "data": { "ciphertext": "AQAA…", "key_version": 1 }, ... }

3. Decrypt

curl -X POST https://redeyed.com/api/v1/kms/keys/orders/decrypt \
  -H "X-Api-Key: $KEY" -H 'Content-Type: application/json' \
  -d '{"ciphertext":"AQAA…","aad":"order:8842"}'
# -> { "data": { "plaintext_b64": "…", "plaintext": "4111 …" }, ... }

Associated data (AAD)

The optional aad is authenticated but not encrypted. If you encrypt with an aad, you must pass the same aad to decrypt — great for binding a ciphertext to a record id so it can't be replayed elsewhere.

Rotation

POST /api/v1/kms/keys/{alias}/rotate mints a new key version. The version is embedded in every ciphertext, so data encrypted before a rotation still decrypts.

Binary data

Send plaintext_b64 instead of plaintext for binary. decrypt always returns plaintext_b64, plus plaintext when the result is valid UTF-8.