Keys

Keys can be accessed either:

• Through a vault (requires a Vault Access Key), or
• Directly as a public resource (requires a resource-specific public token)

Keys are immutable and not versioned.

Authentication

Vault access (standard)

Authorization: Bearer VAULT_ACCESS_KEY
Accept: application/json

Public key access (resource token)

Authorization: Bearer RESOURCE_PUBLIC_TOKEN

Public tokens only apply to keys that were marked Public when created.

List Keys in a Vault

Use include=keys:

GET /api/v1/vaults/{vault_id}?include=keys

Example:

curl --request GET \
  --url "https://secryn.example.com/api/v1/vaults/{vault_id}?include=keys" \
  --header "Accept: application/json" \
  --header "Authorization: Bearer VAULT_ACCESS_KEY"

Returned fields

id, name, type, key_type, key_size, activation_date, expiration_date, tags

Activation filter

Vault listing only includes keys that are:

• activation_date is null, or
• activation_date <= now()

Expired keys in list

If a key is expired, it may be returned in the list as:

{ "id": "<key-id>", "message": "Resource expired" }

Fetch a Key from a Vault by ID

Use the vault endpoint with resource=:

GET /api/v1/vaults/{vault_id}?resource={key_id}

Example:

curl --request GET \
  --url "https://secryn.example.com/api/v1/vaults/{vault_id}?resource={key_id}" \
  --header "Authorization: Bearer VAULT_ACCESS_KEY"

Response type

When fetching a key by resource ID, Secryn returns the key file contents (PEM) with:

• Content-Type: application/x-pem-file
• Cache headers disabled (no-store, no-cache)

Status codes

• 403 Forbidden -> key is not active yet (activation_date in the future)
• 410 Gone -> key is expired
• 404 Not Found -> key does not exist in that vault

Fetch a Public Key Directly

If a key was created with Public visibility, it can be accessed directly using the public token:

GET /api/v1/keys/{key_id}

Authorization: Bearer RESOURCE_PUBLIC_TOKEN

Example:

curl --request GET \
  --url "https://secryn.example.com/api/v1/keys/{key_id}" \
  --header "Authorization: Bearer RESOURCE_PUBLIC_TOKEN"

Public access behavior:

• No vault access key required
• Token is valid only for that key
• Response is PEM (application/x-pem-file)
• Access is logged

Notes

• Keys cannot be edited and have no versions
• Vault listing filters keys by activation date
• Expired keys return 410 when fetched directly
• All access is recorded in Request Logs