API

Secryn API reference for self-hosted vault access.

API Reference

The Secryn API is served by your self-hosted instance. There is no hosted api.secryn.com endpoint.

Base URL

https://your-secryn-instance/api/v1

Authentication

Send a bearer token on every request:

curl -H "Authorization: Bearer VAULT_ACCESS_KEY" \
  -H "Accept: application/json" \
  "https://your-secryn-instance/api/v1/vaults/VAULT_ID"

A vault access key belongs to one vault. It is read-only: the vault, key, and certificate routes accept GET and HEAD. It does not inherit a user role. The access key is not accepted as a query parameter.

Public keys and certificates use a different bearer token, scoped to that single resource. Secrets are never public.

Details are in Authentication.

What the API can read

Vaults — secrets in a vault, plus keys and certificates when requested
Secrets — secret values require the vault access key
Keys — vault access, or a public resource token
Certificates — vault access, or a public resource token
Examples

Secret values and secret versions are encrypted with Laravel encryption keyed by APP_KEY. Private keys are stored in a SECRYN-PRIVATE-V1 envelope encrypted with that same key. A public token returns public material only. See the security model.

Errors

Status	Meaning
401	Missing bearer token, or the access key does not match the vault
403	Resource exists but is not active yet
404	Resource not found
405	Method not allowed. These routes do not accept writes
410	Resource is expired

The API may include X-RateLimit-* headers. Limits are a property of your instance, not a hosted pricing tier.

Authentication